Repository navigation
Support the 0.79.0 release after upstream CI and workspace changes #37
Description
The current packaging consumer cannot process the upcoming 0.79.0 release after the upstream workspace and CI migrations.
- The product-v2 schema and strict parser lack the new host/runtime ABI and independent runtime-release fields.
- Node package assembly still expects
sdk/node; its smoke calls the removed owner-keypair API. The upstream console verifier now boots Rust automation, which is unsuitable for this composition-only job. - Unix products carry bundled plugin archives that the consumer rejects or drops. PR fix(packaging): keep the product's bundled plugins in native packages and Homebrew #36 requires a plugin manifest the current producer does not emit.
- Open PRs Require producer-declared native runtime license files #30–Validate the Linux glibc floor in runtime manifests #33 contain relevant license, glibc, CUDA dependency, and automatic-client QA changes that need integration against the current contract.
Audit inputs: packaging 06c6aa8, upstream 15da969d74c1e1d879029d9c1ce05f6314dd21a5. Coordinate acceptance with Mesh-LLM/mesh-llm#2775.
Acceptance requires current producer-shaped negative/positive fixtures, the complete packaging precheck, real native-package byte-preservation/reproducibility checks, and a full nonpublishing run against the immutable 0.79.0 RC. Stable distribution completion must also verify the downstream readiness receipt, because the upstream dispatcher does not wait for packaging.
Activity
ndizazzo commentedon Nov 1, 2026
Implementation merged in #38 at
294a0ae1d7642d0a330e5f34a2a970682d166c82. The older #30, #31, #32, #33, and #36 were closed as incorporated; their branches remain available.Remaining acceptance is coordinated with Mesh-LLM/mesh-llm#2775. The RC has not published yet. Once it does, run all 11 native rows, Homebrew, and four npm targets with publication disabled, bound to the RC commit and native-runtimes.json digest. Keep this issue open until the readiness receipt and stable distribution results have been checked.
ndizazzo commentedon Nov 1, 2026
Post-merge Packaging Precheck also passed on main 294a0ae: https://github.com/Mesh-LLM/mesh-packaging/actions/runs/41338913553. The full RC rehearsal is waiting for the upstream candidate assets; no publication was performed by this audit.
ndizazzo commentedon Nov 1, 2026
Supplemental infrastructure rehearsal is running: https://github.com/Mesh-LLM/mesh-packaging/actions/runs/41339711692.
This uses the published October 30 preview, not the 0.79.0 RC, while upstream finishes candidate preparation. The preview has the exact current product schema and native manifest format.
Identity:
294a0ae1d7642d0a330e5f34a2a970682d166c82v0.78.0-preview.40959817943.11253a2a490ab5cf7a7897cb6bb06297f4f286a67native-runtimes.jsonSHA-256:aecff7cb55e384ad17d91143bcec73a4b46b1665ec50bda8f241df573d3aafc8dry_run=true; every publication switch is false.Verified so far:
The npm lifecycle check then failed because this older preview does not export
Node.fromConfig. Current upstream does export it, so this result does not identify a 0.79.0 defect and does not justify weakening the current smoke. Homebrew remains queued for a macOS runner. Release assembly and the terminal readiness report are still pending; aggregate readiness is expected to fail because of the preview SDK mismatch.The complete 0.79.0 RC rehearsal and stable publication verification remain required.
ndizazzo commentedon Nov 1, 2026
The supplemental preview run 41339711692 has completed. Its readiness receipt is
failure, bound to the expected upstream SHA and manifest digest; every publication job was skipped.All 11 native packages and 11 final runtime images passed. Homebrew failed before audit/install because Homebrew 7 refused the generated formula as untrusted. The npm lifecycle failure is the previously documented older-preview API mismatch. Release assembly was skipped.
#39 now fixes the formula trust admission and a separate verified coverage gap: every selected native Node target must install and start the same assembled npm tarball before publication. Previously only Linux x64 ran the lifecycle, while the other targets only received archive/import checks. The new gate also verifies runner architecture and fails readiness for any failed/cancelled/skipped required consumer.
At
8a9e054bb938f3f79d4988b3219099d9ed271033, 206 local tests passed with five expected local skips, matrix coverage is 100%, actionlint is clean, and independent source review found no actionable issues. The isolated Homebrew trust record contains only the generated formula. Hosted precheck is 41341803646; corrected Homebrew-only dry run is 41341832014. Current-artifact four-platform SDK execution and the complete 0.79.0 RC qualification remain pending.ndizazzo commentedon Nov 1, 2026
Both packaging changes are merged: #38 and #39. Main is now
c8d4e5993b4a747d7884455a2cd30f3e19fde26f.PR #39 adds native SDK lifecycle consumers on macOS ARM64, Linux ARM64/x64, and Windows x64, gates publication/readiness on their results, admits only the generated Homebrew formula under tap trust, checks installed host bytes, and bounds forced cleanup. Local validation passed 208 tests with five expected local skips. The latest PR Precheck passed. CodeRabbit's full review covered the functional changes at
c27470ewithout actionable findings; its review of the documentation-only follow-up was rate-limited. The merged tree matches the tested PR tree exactly.The Homebrew trust rehearsal passed audit, installation, automatic client readiness, bounded shutdown, and terminal readiness, with every publication job skipped. The final formula rehearsal remains queued for a macOS runner. Its workflow and formula bytes match merged main. The exact preview archive and host manifest digest verify; its host imports only system libraries and has no runtime search paths requiring Homebrew relocation. That static evidence does not replace the pending installed-byte assertion.
Merged-main Precheck is running. Keep this issue open for the final Homebrew receipt, the actual 0.79.0 RC's complete native/Homebrew/four-platform SDK rehearsal, and verified stable distribution including the Homebrew tap. Preview evidence does not qualify the 0.79.0 artifacts.
ndizazzo commentedon Nov 1, 2026
The final Homebrew rehearsal passed. Audit, installation, installed-host digest equality, automatic client readiness, bounded shutdown, and terminal readiness all succeeded. Every publication job was skipped. The downloaded formula is byte-identical to the same preview version/digest rendered from merged main
c8d4e59.The successful receipt binds preview tag
v0.78.0-preview.40959817943.1, upstream SHA1253a2a490ab5cf7a7897cb6bb06297f4f286a67, and native manifest digestaecff7cb55e384ad17d91143bcec73a4b46b1665ec50bda8f241df573d3aafc8. This closes the supplemental Homebrew gate, not the actual 0.79.0 RC gate.The downstream tap audit found one more release-path issue. Both tap workflows audit before installation and omit formula trust. Recent successful scheduled syncs skipped testing because the formula was unchanged. Homebrew tap PR #1 adds formula-specific trust and a publication-disabled manual rehearsal that validates even an unchanged candidate. Its exact-revision test and dry-run sync are queued. The stable formula itself has no diff.
ndizazzo commentedon Nov 1, 2026
The companion Homebrew tap fix merged at
e81e3a25e41c99aadf99315f88a8b21397098632. The merged tree is identical to the reviewed and tested head; the stable formula bytes are unchanged.0.78.1formula.Publish formulawas skipped andReport current versionsucceeded. No tap update occurred during the rehearsal.Manual tap sync now defaults to
dry_run=true. Stable publication through a manual sync requires explicit-f dry_run=false; scheduled changed-candidate publication keeps its existing behavior.Packaging PR #40 merged at
f96f9edbdc2bdf154abc489bdb05e8b85e48c848, recording these results and correcting the current operator checklist. Final-head precheck 41351796526 passed and all review findings are resolved. Upstream still dispatches without waiting, so the release operator must verify the terminal packaging receipt and all requested channels.The actual 0.79.0 RC tuple is not yet available. Full RC validation, all four native SDK lifecycle consumers, and stable distribution remain open.