Commit Graph
4 Commits
Author SHA1 Message Date
github-actions[bot]andgarrytan 4a98e407e6 v1.91.181.0 Promote qualified CSO runtime catalog (#3343)
* Promote qualified CSO runtime catalog

* changelog: qualified CSO runtime catalog

* test(cso): stop pinning the committed runtime catalog to empty

* v1.91.181.0 Promote qualified CSO runtime catalog

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: garrytan <garrytan@gmail.com>
2026-10-23 00:26:19 +00:00
Garry Tan 9e9e674b1e v1.91.62.0 fix(cso): Rails verification fits two arm64 offline preparations (#3086)
* fix(cso): Rails verification fits two arm64 offline preparations

Offline Rails preparation compiles native gems in 6.8-8.5 min on 4-vCPU arm64 (3.3-3.5 min on amd64),
so a two-phase attempt outran the 900 s bound and its watchdogs' scheduled cleanup surfaced as
ISOLATION_FAILED. MAX_VERIFICATION_ATTEMPT_MS is now 1800 s, the longest comprehensive run budget;
attempts stay cut to the run's reporting deadline.

v1.91.58.0

* Take v1.91.62.0 (1.91.60.0 and 1.91.61.0 are claimed)
2026-10-08 15:55:54 +00:00
Garry Tan 1d1ce39b4e v1.91.36.0 fix(cso): Python and Rails repairs replay, Rails verification fits its budget, killed attempts leave no scratch (#3074)
* fix(cso): Python and Rails repairs verify and replay; killed attempts leave no scratch

- Python offline preparation sets SOURCE_DATE_EPOCH so .pyc bytecode is reproducible.
- Prepared identity hashes skip RubyGems/mini_portile build diagnostics that name random build dirs.
- Rails verification attempts and replays get 900 s; the attempt watchdog, Docker
  verification executor and assertion witness share MAX_VERIFICATION_ATTEMPT_MS.
- resume and finish reclaim a killed attempt's scratch once its watchdog recorded cleanup.

v1.91.34.0

* Format lib/cso with prettier

* Take v1.91.36.0 (1.91.35.0 is claimed by #3073)
2026-10-08 06:06:43 +00:00
Garry TanandOpenAI Codex 4a3c6a8a3c v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)
* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>
2026-09-14 15:14:58 -07:00