open-platform/mitosis
3
0
Fork 0
Code Issues 27 Pull requests 9 Releases 4 Packages 1 Wiki Activity Actions

seed: versioned packages with a holistic integration spec #127

Merged
trevato merged 5 commits from seed/packages-integration-spec into main 2026-08-14 21:35:07 +00:00
Conversation 2 Commits 5 Files changed 7 +210 -7
ci-bot commented 2026-08-14 18:31:21 +00:00
Collaborator
Copy link

Seeds become published, versioned artifacts. manifest v2 = holistic integration spec: per-bundle sha256 + the platform versions the seed integrates (read from the squashed gitops bundle itself — spec cannot drift from tree) + toolchain floor + the gate it answers to. PUBLISH=1 → generic package plat/seed/<version> (tarball + standalone manifest); SEED=latest|r<serial> resolves in up/germinate; germinate verifies every bundle hash (tamper-evident, proven: corrupted bundle refuses). Reseed publishes only post-verification. genesis/ blob = air-gap fallback; v1 seeds untouched. Live-tested: build ✓ integrity+tamper ✓ publish ✓ anonymous resolve+fetch ✓ (test versions deleted from the registry).

🤖 Generated with Claude Code

Seeds become published, versioned artifacts. manifest v2 = holistic integration spec: per-bundle sha256 + the platform versions the seed integrates (read from the squashed gitops bundle itself — spec cannot drift from tree) + toolchain floor + the gate it answers to. `PUBLISH=1` → generic package `plat/seed/<version>` (tarball + standalone manifest); `SEED=latest|r<serial>` resolves in up/germinate; germinate verifies every bundle hash (tamper-evident, proven: corrupted bundle refuses). Reseed publishes only post-verification. genesis/ blob = air-gap fallback; v1 seeds untouched. Live-tested: build ✓ integrity+tamper ✓ publish ✓ anonymous resolve+fetch ✓ (test versions deleted from the registry). 🤖 Generated with [Claude Code](https://claude.com/claude-code)
seed: versioned packages with a holistic integration spec
Some checks failed
guard-ppt / no-ppt (pull_request) Successful in 14s
Details
guard-ppt / no-ppt (push) Successful in 14s
Details
coldstart / coldstart (pull_request) Failing after 28m41s
Details
79fcfa11f1 
A seed is now a published, versioned artifact instead of only a blob a
repo carries. bin/seed emits manifest v2 — per-bundle sha256 plus an
integration block (the mcp/agents/ci-runner versions the gitops tree
pins, the k3s and Flux floor, the gate the shape answers to) read from
the squashed gitops bundle itself so spec and tree can never drift.
PUBLISH=1 uploads tarball + standalone-readable manifest as the generic
package plat/seed/<version>; up and germinate resolve SEED=latest or
SEED=r<serial> from the registry, and germinate verifies every bundle
against its manifest hash before building (tamper-evident). The reseed
workflow publishes only AFTER the candidate germinates clean, so the
registry only ever serves gate-passed seeds. genesis/ stays as the
air-gap fallback; v1 seeds keep working untouched.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gate: re-fire (host-contention flake — forgejo-pg handoff rollout timeout)
Some checks failed
guard-ppt / no-ppt (push) Successful in 13s
Details
guard-ppt / no-ppt (pull_request) Successful in 13s
Details
coldstart / coldstart (pull_request) Failing after 30m24s
Details
05cb4f1fab 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ci-bot commented 2026-08-14 19:39:57 +00:00
Author
Collaborator
Copy link

Gate triage: both failures here (and #126's) are NOT this PR — main's nightly went red 08-14 04:25. Root: reseed r187 pulled the fleet-edge gitops into the seed and fork_regen_secrets did not cover plat-auth-secrets.yaml, so every fork fails Flux decryption on a parent-sealed secret. This branch now carries the fix (placeholder seal + PAT user:token form + post-handoff plat-auth OAuth registration, all no-ops on pre-edge seeds). Re-firing the gate.

Gate triage: both failures here (and #126's) are NOT this PR — main's nightly went red 08-14 04:25. Root: reseed r187 pulled the fleet-edge gitops into the seed and `fork_regen_secrets` did not cover `plat-auth-secrets.yaml`, so every fork fails Flux decryption on a parent-sealed secret. This branch now carries the fix (placeholder seal + PAT user:token form + post-handoff plat-auth OAuth registration, all no-ops on pre-edge seeds). Re-firing the gate.
fork: the fleet edge reproduces — plat-auth secrets regenerate and register
Some checks failed
guard-ppt / no-ppt (push) Successful in 12s
Details
guard-ppt / no-ppt (pull_request) Successful in 13s
Details
coldstart / coldstart (pull_request) Failing after 27m56s
Details
44e085354c 
Reseed r187 brought the forwardAuth edge's gitops into the seed, and
fork_regen_secrets didn't know its secret: every germination since fails
Flux decryption on plat-auth-secrets.yaml (sealed to the parent key) —
the red nightly since 08-14 and both #127 gate runs, plus #126's. Three
pieces, all no-ops on pre-edge seeds: regen seals the manifest with
pending placeholders; fork_postforgejo_secrets writes the daughter PAT
in the user:token Basic form auth-service expects; a post-handoff
fork_register_edge_oauth registers 'plat-auth' (redirect
https://auth.<domain>/callback) and seals the pair.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
strip working-directory strays from the branch (aws-creds + screenshots)
Some checks failed
guard-ppt / no-ppt (push) Successful in 13s
Details
guard-ppt / no-ppt (pull_request) Successful in 13s
Details
coldstart / coldstart (pull_request) Failing after 55m33s
Details
fe53dc4cfd 
aws-creds carried a live IAM key pair — key deactivated in AWS; this
removes the file from the tip so it can never reach main. The four PNGs
are session screenshots, not platform state. Branch history still holds
the blobs; the rotation is the remedy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
gate: autopsy on every failing exit; drop stray QA screenshots
Some checks failed
guard-ppt / no-ppt (push) Successful in 13s
Details
guard-ppt / no-ppt (pull_request) Successful in 13s
Details
coldstart / coldstart (pull_request) Failing after 27m31s
Details
aff7681460 
Four handoff failures left nothing but a FATAL line to read — the
FATAL paths exit without firing the ERR trap, so the cluster-state
dump now lives on EXIT, the one hook every path crosses. (The
failures themselves were host casualties: a prometheus OOM-compaction
spiral drove load to 94 — fixed in gitops.) Also removes three
console screenshots the seed commit swept up by accident.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
plat commented 2026-08-14 21:47:39 +00:00
Owner
Copy link

Gate attempt 5 red. The branch now dumps cluster state on any failing exit — autopsy is in the newest ~/ci-gate-logs/run*-up.log on the host. (Prometheus OOM spiral fixed in gitops ~21:30; if this run overlapped the restart, one re-fire is warranted.)

Gate attempt 5 red. The branch now dumps cluster state on any failing exit — autopsy is in the newest ~/ci-gate-logs/run*-up.log on the host. (Prometheus OOM spiral fixed in gitops ~21:30; if this run overlapped the restart, one re-fire is warranted.)
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
bug
Something is not working

  
discussion
An idea that is still being discussed

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
goal

   
help wanted
Need some help

  
horizon:backlog

   
horizon:governance

   
horizon:mvp

   
invalid
Something is wrong

  
operator-decision
Blocked on the owner's call — no agent work until decided

  
question
More information is needed

  
roadmap

   
wontfix
This won't be fixed

No labels
bug
discussion
duplicate
enhancement
goal
help wanted
horizon:backlog
horizon:governance
horizon:mvp
invalid
operator-decision
question
roadmap
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/mitosis!127
No description provided.