CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-09-20 20:00:45 +02:00
Code Issues Packages Projects Releases Wiki Activity

record live Context and device evidence

Browse Source
This commit is contained in:
Sinabina
2026-07-17 12:43:53 -07:00
parent 8b7c31d8a4
commit c0f280dbf7
8 changed files with 81 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/gstack-2/ARCHITECTURE.md
+13 -9
View File
@@ -193,8 +193,10 @@ Context.dev consent false; `context setup` is the only path that selects
Context.dev and persists export consent with the protected key.
The deterministic Context contract is green at 22 pass / 0 fail and 139
assertions. No verified key was available for a live provider smoke, so provider
behavior remains blocked rather than inferred from the contract suite.
assertions. A verified-key live smoke also passed the official Markdown scrape
endpoint with protected input and an isolated temporary home. The redacted
artifact records the endpoint and cleanup guarantees without storing the key or
provider response body.
See [CONTEXT-DEV.md](./CONTEXT-DEV.md) and [PRIVACY.md](./PRIVACY.md).
@@ -210,12 +212,14 @@ The existing DebugBridge/CoreDevice harness remains the sole physical-iOS
backend. The candidate distinguishes hardware UDID from CoreDevice UUID,
returns bounded 504 responses for a suspended app, asserts the expected bundle
around coordinate mutations, preserves typed snapshot/mutation/restoration,
and keeps bridge symbols debug-only. Device signing and provisioning are
remediable setup gates, not product failures. A live signed-device pass is
still required before release. Current preflight evidence is 9 pass / 0 fail /
1 deploy skip and 29 assertions. The direct smoke returned
`signing_unavailable` / `setup_gate`; no app was installed and no pass artifact
was written.
and keeps bridge symbols debug-only. Device signing, provisioning, and
CoreDevice compatibility are setup gates, not product failures. A live
signed-device pass is still required before release. The earlier target's
preflight evidence is 9 pass / 0 fail / 1 deploy skip and 29 assertions; its
direct smoke returned `signing_unavailable`. The latest explicitly selected
target returned `device_not_wired` because iOS 16.7.10 exposes no supported
CoreDevice service. Neither attempt installed or launched an app, and no pass
artifact was written.
PDF rendering and Mermaid/Excalidraw remain internal capabilities. GStack does
not add Typst, hosted document rendering, alternate diagram services, local
@@ -251,7 +255,7 @@ means the replacement still lacks its required release evidence.
| 20 | Partial ship failures are not reliably idempotent | **Implemented at runtime primitive:** claimed effects become uncertain and are not automatically repeated. | Crash/resume and completed-effect tests pass. End-to-end ship resume remains pending. |
| 21 | Parser failures become empty success | **Implemented in iOS device discovery:** parse/tool failures are typed errors. | `tunnel-bootstrap.test.ts` malformed-JSON regression passes in the focused daemon suite. |
| 22 | Setup failures become product failures | **Partly implemented:** iOS discovery/setup categories and runtime doctor return actionable setup state. | Automated categories exist; live signing/provisioning gate pending. |
| 23 | Runtime network activity is not obvious | **Implemented for Context runtime:** selection, mode, and consent are explicit; status/doctor report them; zero lookup/fetch before Context selection+consent. | Context contract: 22 pass / 0 fail / 139 assertions, including persisted non-export fallbacks. Verified-key live smoke remains blocked. |
| 23 | Runtime network activity is not obvious | **Implemented for Context runtime:** selection, mode, and consent are explicit; status/doctor report them; zero lookup/fetch before Context selection+consent. | Context contract: 22 pass / 0 fail / 139 assertions, including persisted non-export fallbacks; verified-key official-endpoint live smoke passed. |
| 24 | Context restore selects another worktree | **Implemented for canonical state resume:** current repo+worktree project ID scopes inspection/resume. | Linked-worktree identity test passes; compatibility end-to-end restore test pending. |
| 25 | Preambles repeat large sections in every skill | **Implemented structurally:** six thin lazy dispatchers share infrastructure and load one preserved module on demand. | Current generated six-name/description catalog is 982 characters, about 246 token-equivalents versus the correctly parsed baseline of about 1,100 (77.6% lower). Re-measure if frontmatter changes. |
docs/gstack-2/CONTEXT-DEV.md
+6 -5
View File
@@ -2,9 +2,10 @@
Context.dev is the only newly authorized external service in GStack 2. It is
optional and restricted to public web context. The current automated contract
is green at 22 pass / 0 fail and 139 assertions. No verified account key was
available, so the live smoke has not run and provider behavior remains
unverified; see [TEST-EVIDENCE.md](./TEST-EVIDENCE.md).
is green at 22 pass / 0 fail and 139 assertions. A verified-key live smoke also
passed against the official Markdown scrape endpoint on 2026-07-17; see the
[redacted evidence artifact](../../evals/context-dev/live-smoke-2026-07-17.json)
and [TEST-EVIDENCE.md](./TEST-EVIDENCE.md).
## Choose a public-web mode
@@ -158,5 +159,5 @@ gstack uninstall --purge --yes
```
Standard skill installation and pure judgment do not require a Context.dev
account. The 22-test deterministic contract is not a substitute for the
blocked verified-key live smoke.
account. The live smoke used protected input and an isolated temporary home;
it did not persist the key in the repository or permanent GStack state.
docs/gstack-2/HOST-COMPATIBILITY.md
+2 -2
View File
@@ -167,8 +167,8 @@ nor model weights and reports the L4 capability unavailable.
| Platform | Source-level target | Candidate evidence |
|---|---|---|
| macOS | Node runtime + local browser + physical iOS where applicable | Runtime installer 24/336 and deterministic clean macOS arm64 bundle audit pass. The uninterrupted broad singleton run is green at 6,240 pass / 226 expected skips / 0 fail across 383 files. The signed-device gate remains pending. |
| Linux | Node runtime + local browser | Declared Dev Container GStack 2 suite passed at 136/0 with 1,127 assertions across 15 files; log: `/tmp/gstack2-devcontainer-gate-candidate-final4.log`. The one-assertion difference from the focused macOS result is the platform-conditional read-only-mode check. A clean Linux arm64 container used production-only install with the development SDK and model runtime absent, passed a local-browser journey and Sharp full-page screenshot, and uninstalled while preserving state. Native-host broad Linux remains pending. |
| Native Windows | Node runtime; curated free tests; browser fallback where retained | **Blocked:** native Windows CI pending. The local Windows-safe singleton lane is green at 2,815 pass / 57 expected skips / 0 fail across 213 files, but it is not native evidence. |
| Linux | Node runtime + local browser | Declared Dev Container GStack 2 suite passed at 136/0 with 1,127 assertions across 15 files; log: `/tmp/gstack2-devcontainer-gate-candidate-final4.log`. The one-assertion difference from the focused macOS result is the platform-conditional read-only-mode check. A clean Linux arm64 container used production-only install with the development SDK and model runtime absent, passed a local-browser journey and Sharp full-page screenshot, and uninstalled while preserving state. The candidate workflow targets GitHub-hosted `ubuntu-24.04`, but this local-only HEAD has no remote ref for that runner. Native-host broad Linux remains pending. |
| Native Windows | Node runtime; curated free tests; browser fallback where retained | **Blocked:** native Windows CI pending. The local Windows-safe singleton lane is green at 2,815 pass / 57 expected skips / 0 fail across 213 files, but it is not native evidence. The candidate workflow targets GitHub-hosted `windows-latest`; it cannot access this local-only HEAD without an explicitly authorized remote test ref. |
| Dev Container | Pure skills and optional runtime; browser only when container supports it | Declared image builds; generated freshness and the 136-test GStack 2 suite pass, as does the clean runtime install/browser smoke. Full broad Linux coverage remains pending. |
The six portable skills remain useful when runtime installation fails. A
docs/gstack-2/IOS-PHYSICAL-DEVICE.md
+19 -8
View File
@@ -6,7 +6,8 @@ The harness is intentionally fail-closed. A setup problem is not a product failu
## Current validation status
Validated locally at the July 17, 2026 checkpoint with Xcode 26.6 and the wired iPhone supplied for this work:
The earlier target was validated locally at the July 17, 2026 checkpoint with
Xcode 26.6:
| Identifier kind | Example form | Used for |
|---|---|---|
@@ -15,14 +16,15 @@ Validated locally at the July 17, 2026 checkpoint with Xcode 26.6 and the wired
Exact local identifiers are deliberately not committed. Successful evidence stores only a SHA-256 fingerprint derived from both identifiers and omits the user-assigned device name.
The daemon suite is green at 95 pass / 0 fail and 229 assertions. The physical
E2E preflight records 9 pass / 0 fail / 1 deploy skip and 29 assertions. The
host, pairing/trust, Developer Mode, wired transport, `devicectl`, `xcodegen`,
and DevToolsSecurity gates pass. The unsigned Release build also passes and
contains no DebugBridge module symbols or artifacts.
The daemon suite is green at 95 pass / 0 fail and 229 assertions. For that
earlier target, the physical E2E preflight records 9 pass / 0 fail / 1 deploy
skip and 29 assertions. Its host, pairing/trust, Developer Mode, wired
transport, `devicectl`, `xcodegen`, and DevToolsSecurity gates pass. The
unsigned Release build also passes and contains no DebugBridge module symbols
or artifacts.
The direct physical-device smoke is externally blocked at automatic signing.
It returned typed code `signing_unavailable`, category `setup_gate`. The
The earlier direct physical-device smoke was externally blocked at automatic
signing. It returned typed code `signing_unavailable`, category `setup_gate`. The
underlying Xcode diagnostic is:
```text
@@ -33,6 +35,15 @@ That is a setup gate, not a DebugBridge failure. No app was installed or
launched, and no pass artifact was written. The deploy skip and typed smoke
failure must not be represented as a physical-device pass.
The latest user-selected target was a legacy iPhone (`iPhone10,6`) on iOS
16.7.10. Its lockdown/USB pairing validates, but `devicectl` reports
`pairingState=unsupported`, no wired CoreDevice transport, and pairing fails
with CoreDevice error 1011. The harness therefore returns typed code
`device_not_wired` before build or deploy. The other connected phone was not
used. Because CoreDevice is the locked backend, substituting a legacy or
third-party device driver would not satisfy this gate; a CoreDevice-compatible
iPhone is required.
## Hardware UDID versus CoreDevice UUID
An iPhone has two identifiers relevant to this flow:
docs/gstack-2/PRIVACY.md
+4 -2
View File
@@ -24,8 +24,10 @@ Context client requires persisted selection `context`, mode `context`, and
`local-browser`, and `none` persist with consent false.
The deterministic Context contract is green at 22 pass / 0 fail and 139
assertions. No verified key was available for a live provider smoke; those unit
results are not live-egress evidence.
assertions. A verified-key live provider smoke also passed the official
Markdown scrape endpoint. It used explicit consent, protected key input, and
an isolated temporary home that was removed afterward; the committed artifact
contains no credential or response body.
## Public Context.dev gate
docs/gstack-2/STATUS.md
+20 -16
View File
@@ -4,11 +4,10 @@
The candidate contains substantial implementation, but it is not a released or
verified GStack 2. `DONE` is prohibited until every P0 gate is backed by the
required evidence layer. Current blockers include physical-iPhone signing, a
verified Context.dev key smoke, native Windows CI, a passing live v3
installed-host adversarial run, native Linux evidence, and the signed physical
iPhone loop. No branch push, draft PR, or PR-ready claim is authorized by this
status.
required evidence layer. Current blockers include a CoreDevice-compatible
signed physical iPhone, native Windows CI, a passing live v3 installed-host
adversarial run, native Linux evidence, and the signed physical-iPhone loop. No
branch push, draft PR, or PR-ready claim is authorized by this status.
## Implemented candidate surface
@@ -79,7 +78,9 @@ status.
fail and 139 assertions; deprecated search is typed unsupported rather than
fabricated. `context options` and explicit
`context select host|local-browser|none` choices persist without granting
Context.dev consent. No verified key was available for the live smoke.
Context.dev consent. A verified-key live smoke passed the official Markdown
scrape endpoint using protected input and an isolated temporary home; the key
was not persisted in the repository or permanent GStack state.
- [x] iOS candidate fixes implemented for UDID/CoreDevice identity, malformed
device-list errors, suspended-app bounded timeout, and active-bundle checks.
- [x] Default/free-test roots now include `design/test` and
@@ -92,7 +93,9 @@ status.
- [x] Physical-iOS preflight recorded 9 pass / 0 fail / 1 deploy skip and 29
assertions. The direct smoke then returned typed code
`signing_unavailable`, category `setup_gate`; it installed no app and wrote no
pass artifact.
pass artifact. A later attempt against the explicitly selected iPhone10,6 on
iOS 16.7.10 returned `device_not_wired`; legacy USB pairing validates, but
CoreDevice pairing is unsupported. The other connected phone was not used.
- [x] Installed-host adversarial evidence is retained without relabeling:
v1 **failed**; immutable v2 **failed** even though QA passed because the
classifier produced false negatives for debug, review, and ship; v3 offline
@@ -125,17 +128,18 @@ status.
- [ ] Complete native Linux and Windows matrices. The uninterrupted macOS
broad singleton run is green at 6,240/226/0 across 383 files, and the local
Windows-safe singleton lane is green at 2,815/57/0 across 213 files. Neither
substitutes for native execution on its named platform.
substitutes for native execution on its named platform. The candidate
workflow targets GitHub-hosted `ubuntu-24.04` and `windows-latest`, but remote
execution requires explicit authorization for a CI-only ref because this
candidate is intentionally local-only before P0 passes.
- [ ] Integrate the passing complete local-browser suite and live journey into
final cancellation/leak evidence. The production dependency and managed
bundle audit contains no cloud-browser provider/path.
- [ ] Complete a live Context.dev smoke with a verified account/key. No verified
key was available at this checkpoint; the 22-test automated contract is not
provider evidence.
- [ ] Complete the physical-iPhone five-check loop with a signed test app. The
unsigned Release guard and preflight passed, but the direct smoke returned
`signing_unavailable` / `setup_gate`; no app was installed and no pass artifact
exists. This is a remediable account/provisioning gate.
unsigned Release guard and earlier preflight passed, but the latest authorized
target cannot expose the required CoreDevice service on iOS 16.7.10. Provide
a CoreDevice-compatible iPhone without broadening the locked backend. No app
was installed and no pass artifact exists.
- [ ] Verify in one real cancellation run that no subprocess, listener,
credential, browser, or device-session remains after interruption. Existing
component tests cover each cleanup contract separately but not this aggregate
@@ -157,10 +161,10 @@ status.
| Installed-host adversarial | [eval overview](../../evals/host-adversarial/README.md), [immutable v2 artifact](../../evals/host-adversarial/runs/2026-07-17T04-09-01-809Z-3d23a270.json) | V1 failed; immutable V2 failed; V3 offline 18/111 green, live V3 not run; no passing live run |
| Structured scenarios | [SCENARIOS.md](./SCENARIOS.md) | 25/25 structured routing fixtures green |
| Backlog traceability | [BACKLOG-MAP.json](./BACKLOG-MAP.json) | 755 unique items mapped |
| Context integration | [CONTEXT-DEV.md](./CONTEXT-DEV.md) | Automated contract 22/139 green; live smoke blocked on verified key |
| Context integration | [CONTEXT-DEV.md](./CONTEXT-DEV.md) | Automated contract 22/139 green; verified-key official-endpoint live smoke passed |
| Host matrix | [HOST-COMPATIBILITY.md](./HOST-COMPATIBILITY.md) | 470/470 checks; six hosts Verified at installer layer; live v3/UI launch pending |
| Privacy boundary | [PRIVACY.md](./PRIVACY.md) | Implemented contract; full retained-tool egress audit pending |
| Physical iOS | [IOS-PHYSICAL-DEVICE.md](./IOS-PHYSICAL-DEVICE.md) | Preflight 9 pass / 1 deploy skip / 29 assertions; signing blocked; no app/pass artifact |
| Physical iOS | [IOS-PHYSICAL-DEVICE.md](./IOS-PHYSICAL-DEVICE.md) | Earlier preflight 9 pass / 1 deploy skip / 29 assertions; latest selected target lacks a supported CoreDevice service; no app/pass artifact |
| Upgrade/recovery | [UPGRADE-AND-ROLLBACK.md](./UPGRADE-AND-ROLLBACK.md) | Runtime installer 24 pass / 336 assertions; deterministic clean macOS arm64 bundle audit recorded |
## Interpretation rules
docs/gstack-2/TEST-EVIDENCE.md
+3 -3
View File
@@ -22,10 +22,10 @@ pass from deterministic, offline, or filesystem-only evidence.
| Six-skill catalog measurement after regeneration | Six names/descriptions total 982 characters, about 246 four-character token-equivalents; baseline correctly parsed catalog was about 1,100. | 77.6% reduction, above the 75% gate. Re-measure if frontmatter changes. The buggy 4,214 baseline estimate is not used. |
| `bun test ios-qa/daemon/test` | **95 pass / 0 fail**, 229 assertions. | Covers daemon regressions including malformed device JSON, hardware-UDID/CoreDevice selection, bounded proxy timeout, and expected-bundle mutation header. It is not a signed-app live pass. |
| Focused DebugBridge/template build tests | **33 pass / 0 fail** in the candidate run, including Swift debug compilation/XCTest and Release symbol absence. | Static/build evidence for debug-only bridge wiring; still not an installed physical-app journey. |
| Physical-iOS E2E preflight | **9 pass / 0 fail / 1 deploy check skipped**, 29 assertions. | The connected-device/setup and unsigned Release checks pass. The deploy skip leaves the signed-device P0 gate open. |
| Direct physical-device smoke | **Typed failure:** code `signing_unavailable`, category `setup_gate`. | Automatic signing/provisioning is the remediable blocker. No app was installed or launched and no pass artifact was written. This is neither a product failure nor a pass. |
| Physical-iOS E2E preflight | **9 pass / 0 fail / 1 deploy check skipped**, 29 assertions. | The earlier connected-device/setup and unsigned Release checks pass. The deploy skip leaves the signed-device P0 gate open. |
| Direct physical-device smoke | **Typed setup-gate failures, no product failure:** the earlier target returned `signing_unavailable`; the latest explicitly selected target returned `device_not_wired`, and CoreDevice pairing returned error 1011. | The latest target is an iPhone10,6 on iOS 16.7.10: legacy USB pairing validates, but Xcode reports CoreDevice pairing unsupported and exposes no wired CoreDevice service. The other connected phone was not used. No app was installed or launched and no pass artifact was written. |
| Context.dev contract (`gstack2-runtime-context.test.ts`) | **22 pass / 0 fail**, 139 assertions. | Persists explicit host/local-browser/none choices without consent, rejects private/credential URLs and request material plus private DNS, proves zero lookup/fetch before mode+consent, validates documented endpoint paths and exact failure taxonomy, and makes search typed unsupported without network. |
| `gstack context smoke` | **Not run:** `CONTEXT_DEV_API_KEY` is not configured and no verified account key was available. | Live provider behavior, account verification, and actual credit metadata remain unverified. |
| `gstack context smoke --url https://www.context.dev --json` | **PASS:** the official `/web/scrape/markdown` endpoint returned `ok: true` and credit metadata. | The verified key entered through protected stdin/environment worked. The temporary secrets file was mode `0600`, the isolated home was removed, and the safe output did not contain the key. Committed redacted artifact: [`evals/context-dev/live-smoke-2026-07-17.json`](../../evals/context-dev/live-smoke-2026-07-17.json). |
| Standard installer matrix | **PASS: 470/470 checks**, 16 install cases, two removal cases, `skills` CLI 1.5.19. | Project/global installs pass for six hosts, selected-skill and opt-in compatibility-alias cases, copies, and hashes. This remains installer/filesystem evidence. Committed artifact: [`evals/installation/install-matrix.json`](../../evals/installation/install-matrix.json). |
| `bun test test/gstack2-runtime-install.test.ts` | **Exit 0: 24 pass / 0 fail**, 336 assertions. | Managed allowlist, hashes, spaces, source/internal-link rejection, production-only frozen dependencies, deterministic exact Sharp/ngrok platform closure, native-load rollback smoke, rollback/recovery, stable launchers, wrapper neutrality, and state-preserving uninstall pass. |
| Deterministic clean macOS arm64 managed runtime bundle audit | **110 components, 1,829 files, 450,044,315 bytes, 50 capability launchers.** | This is a platform-specific bundle measurement, not a universal byte count; platform-native package payloads differ. Setup includes the Sharp/ngrok closure and excludes the development-only Claude Agent SDK. The Hugging Face sidecar is outside the bundle and its package is development-only, so production setup installs neither its inference runtime nor model weights; the L4 capability reports unavailable. The standard skill installer remains Markdown-only. Committed artifact: [`evals/runtime-bundle/darwin-arm64.json`](../../evals/runtime-bundle/darwin-arm64.json); reproduce with `bun run scripts/gstack2/audit-runtime-bundle.ts --output evals/runtime-bundle/darwin-arm64.json`. |
evals/context-dev/live-smoke-2026-07-17.json
+14
View File
@@ -0,0 +1,14 @@
{
"schemaVersion": 1,
"capturedAt": "2026-07-17T19:36:40Z",
"sourceGitCommit": "8b7c31d8a448bf56adf17d5968eaae8aebd4be4e",
"ok": true,
"endpoint": "/web/scrape/markdown",
"url": "https://www.context.dev",
"creditMetadataReturned": true,
"keyIngress": "protected-stdin-to-environment",
"temporarySecretsMode": "0600",
"permanentSecretPersisted": false,
"temporaryHomeRemoved": true,
"safeOutputSha256": "ed2eea7831acd8e73505103246b5faa6134079650df55eb701053c48ad06bda7"
}