Artifact ebf7864f387a2153035a92f04d4365f9f650b60f25c04a778865ed59430cd5f0:
- File
patterns/stage.md
— part of check-in
[384b909ae6]
at
2026-11-04 04:07:19
on branch protocol-v2-daemon
— Release work holds no record beside the repositories, and says what import requires
Intent: the maintainer, at aarch64-1's terminal, 2026-11-04: "runs.json and import.json both sound superfluous to a directory full of .fossil databases." Under virtue 4 (Parsimony) and precept C2 (Single Owner), the release root keeps no copy of what the run's record already holds; under virtue 1 (Clarity), a sender is told what import requires before a build is wasted. ocx-arm's review on aarch64-1 (thread abacbc395e, posts bf4905c000 to ce7941874e) found the rest.
Expression: import.json is gone: import no longer writes it, accept no longer carries it, and the release tool's answer is each release's name and its listed files with their SHA-256, without the checkin field that only repeated the name or the record that repeated import.json. patterns/stage.md and USAGE.md say --of must be the check-in's full hash, which import requires; stage.md says import is ocx2 import RUN; USAGE.md says to remove staged/NAME by hand if import stops after copying; ocx-rootfs/README.md names the stage pattern by its SHA3-256; create.cr's comment cites section 2.7. spec/ocx/care_spec.cr's wait for a child to end treats a failed read of its vanished /proc stat as ended, rescuing IO::Error, which aarch64-1 raised, where Codex's version rescued only File::Error; that one word is mine. patterns/stage.md's sha3 is now ebf7864f387a2153035a92f04d4365f9f650b60f25c04a778865ed59430cd5f0. Codex wrote the rest as task 68afc3e8af on x86-1; I reviewed it.
Demonstrates: spec/ocx/release_import_spec.cr and spec/ocx/release_read_spec.cr assert no import.json and the shorter answer. The patch's SHA-256 is 28a6aba4aa27173d7ddce8abeb47c8d5b13d191815b06de907d978d8e46bf592, as the task's ended records. crystal run ci.cr here: green, 686 examples, 0 failures; coverage 100.0%; 2 executables build. The run before it failed once in spec/ocx/message_tags_spec.cr on Fossil's "database is locked" while posting (ticket 00817df826), which this change does not touch.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TUH8KLNdgQ5Qp4fkwUDDWT (user: x86-1-session size: 3382)
A session commits and pushes the check-in to build, then sends this run from its clone as its own user holding `R`: `ocx2 create "stage CHECKIN" --pattern URL --login LOGIN --clone CODE --to POST --of CHECKIN`. LOGIN and CODE name the builder's acting login and its clone's server-code; POST is in the session's thread. URL is this file's content-addressed raw URL after it is published as a tech-note attachment, as for [the Codex task pattern](codex-task.md). `--of` must be the check-in's full hash. Import refuses a run whose `of` is not that full hash. The run clones the server anonymously into its workspace, opens CHECKIN and runs `crystal run ci.cr -- build $$workspace$$/release x86_64` in that checkout, niced. The checks install their pinned shards when needed. Only a successful check and build leaves `ocx2`, `release.txt` and `gate.txt` in the workspace's `release/`; the run exits with the build's status. OCX sends those files as unversioned files under `releases/$$run$$/`, each run's own names. On failure they are absent, and OCX records them as missing in `ended.outputs`. This pattern is for x86_64 builders. Another architecture needs its own pattern: the server will count only a run whose content is a known pattern with only the check-in filled in. The run has no homes or secrets, needs no default Fossil user, writes only in its workspace and ends with its parent. It has two hours of wall time, an hour of CPU per process, 512 processes and files of 256M for the full CI run and build. A person imports the files with `ocx2 import RUN` on the server; [USAGE](../USAGE.md#stage-accept-or-roll-back-a-release) describes import. ```json { "workspace": [ { "step": "directory", "at": "$$root$$/$$process_user$$/projects/$$repository_name$$/$$run$$", "remove_on": "saved" } ], "sandbox": { "uid": 1000, "gid": 1000, "linux_capabilities": [], "network": true, "isolate_terminal": true, "ends_with_parent": true, "read_only": [ "/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc/resolv.conf", "/etc/hosts", "/etc/nsswitch.conf", "/etc/ssl/certs" ], "read_write": ["$$workspace$$"], "homes": [], "created_files": [ { "at": "/etc/passwd", "text": "$$process_user$$:x:1000:1000::$$workspace$$:/bin/sh\n" } ], "proc": "/proc", "dev": "/dev", "tmp": "/tmp" }, "limits": { "wall": "2h", "cpu": 3600, "processes": 512, "file_size": "256M" }, "process": { "user": "stage-task", "command": [ "/bin/sh", "-c", "fossil clone $$server_url$$ $$workspace$$/clone.fossil && mkdir $$workspace$$/tree && fossil open $$workspace$$/clone.fossil $$checkin$$ --chdir $$workspace$$/tree --nosync && cd $$workspace$$/tree && nice -n 19 ionice -c3 crystal run ci.cr -- build $$workspace$$/release x86_64" ], "cwd": "$$workspace$$", "keep": {"stderr": "4K", "stdout": "4K", "stdout_when": "always"}, "unversioned_files": [ {"at": "$$workspace$$/release/ocx2", "as": "releases/$$run$$/ocx2"}, {"at": "$$workspace$$/release/release.txt", "as": "releases/$$run$$/release.txt"}, {"at": "$$workspace$$/release/gate.txt", "as": "releases/$$run$$/gate.txt"} ], "env": {"HOME": "$$workspace$$", "USER": "$$process_user$$", "PATH": "/usr/local/bin:/usr/bin:/bin"} } } ```