The aarch64 stage pattern: the stage pattern for an aarch64 builder, differing only in the architecture its build names. A session sends it the same way, with this file's own content-addressed raw URL: ocx2 create "stage CHECKIN" --pattern URL --login LOGIN --clone CODE --to POST --of CHECKIN, LOGIN and CODE naming the aarch64 builder's acting login and its clone's server-code, and --of the check-in's full hash.

The run clones the server anonymously, opens CHECKIN and runs crystal run ci.cr -- build $$workspace$$/release aarch64 there, niced. That build is linked --static, so its ocx2 depends on no host's libc: one binary runs on the musl builder and on a glibc host such as a BeagleBadge's Debian. The builder needs Crystal as shard.yml pins it and the static libraries ocx-node/Dockerfile installs. OCX sends ocx2, release.txt and gate.txt as unversioned files under releases/$$run$$/, as the stage pattern does, and the builder's ended records each one's SHA-256, while its started names the check-in in full.

That record is the mapping from source to binary. Import takes only the server's own architecture, since it smokes ocx2 in the server's root, so an aarch64 run is not imported into an x86_64 server. A host that runs the build fetches its files by name and checks them against the ended hashes, keeping the build it runs for rollback. A person then removes the shared files, so builds do not pile up in the repository; once a build is lost, it is lost, and its source can still be found from the record.

{
  "workspace": [
    {
      "step": "directory",
      "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$",
      "remove_on": "saved"
    }
  ],
  "sandbox": {
    "uid": 1000,
    "gid": 1000,
    "linux_capabilities": [],
    "network": true,
    "isolate_terminal": true,
    "ends_with_parent": true,
    "read_only": [
      "/usr", "/bin", "/sbin", "/lib", "/lib64",
      "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs"
    ],
    "read_write": ["$$workspace$$"],
    "homes": [],
    "created_files": [
      {
        "at": "/etc/passwd",
        "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n"
      }
    ],
    "proc": "/proc",
    "dev": "/dev",
    "tmp": "/tmp"
  },
  "limits": {
    "wall": "2h",
    "cpu": 3600,
    "processes": 512,
    "file_size": "256M"
  },
  "process": {
    "user": "stage-task",
    "command": [
      "/bin/sh", "-c",
      "fossil clone $$server_url$$ $$workspace$$/clone.fossil && mkdir $$workspace$$/tree && fossil open $$workspace$$/clone.fossil $$checkin$$ --chdir $$workspace$$/tree --nosync && cd $$workspace$$/tree && nice -n 19 ionice -c3 crystal run ci.cr -- build $$workspace$$/release aarch64"
    ],
    "cwd": "$$workspace$$",
    "keep": {"stderr": "4K", "stdout": "4K", "stdout_when": "always"},
    "unversioned_files": [
      {"at": "$$workspace$$/release/ocx2", "as": "releases/$$run$$/ocx2"},
      {"at": "$$workspace$$/release/release.txt", "as": "releases/$$run$$/release.txt"},
      {"at": "$$workspace$$/release/gate.txt", "as": "releases/$$run$$/gate.txt"}
    ],
    "env": {"HOME": "$$workspace$$", "USER": "$$process_user$$", "PATH": "/usr/local/bin:/usr/bin:/bin"}
  }
}