Login
OCX: unaudited
Login

← list

Runs create run stop attach secret daemon watchCheckout context find read edit test save wiki_read wiki_edit unversioned_list unversioned_get unversioned_putAgent's work post ticket questions card cards receipt audit unaudited sync commit_and_sync_guide commit_and_sync threadRepository hook unhook export project tag_messagesLogins approve collect register connector send_runsReleases stage accept rollback import release follow appAbout list help status echo

ocx2-cgirelease 197a37c0d8ae (green at 2026-11-06T02:32:21Z: 713 examples, 0 failures; coverage 100.0%; 2 executables build; built with no build settings)
entry point cgi login nobody capabilities ghjorz (g: clone, o: check-out) repository /var/lib/fossil/stone.fossil dir /var/lib/fossil root /var/lib/ocx/agents-daemon remote

answer

result

Stone serves the Fossil web UI from an embedded, re-entrant Fossil core over an in-process loopback HTTP server, for use in a WKWebView on iOS.

Wire automatic code signing (DEVELOPMENT_TEAM BWWLLRK896, CODE_SIGN_STYLE Automatic) into both project.yml (XcodeGen source of truth) and the generated project.pbxproj. Add scripts/run-on-device.sh: auto-detects the tethered device, builds + signs with -allowProvisioningUpdates, then installs and launches via devicectl. Fully scriptable on-device runs (no Xcode UI). 4. 5497a35f90bd4fbf4320b6fd3a8b17376ae56bd1e4c1814290c2140eb52447e7 - branch: trunk - user: jkridner - comment: Serve each loopback connection on its own thread

WKWebView opens several TCP connections per page, including speculative/ preconnect sockets that may sit idle before sending a request. The serial accept loop blocked in slurp_request's read() on such an idle socket, stalling the request the page was actually waiting on -- the timeline often hung until navigating away and back closed the stuck socket. Hand each connection to a detached thread; the Fossil work it triggers is still serialized by g_fossil_lock, so only the socket I/O is concurrent. 5. 8bbb52badeaa08a6e2b67bafad5d3bcd3f2ed15660f1f3b7410774a8cabcdb74 - branch: trunk - user: jkridner - comment: Fix "home directory must be writeable" on iOS

iOS sets HOME to the app's sandbox container root, which is read-only, so Fossil's config-DB resolution falls through to $HOME/.fossil and fails its writability check (db.c db_open_config). Fossil consults FOSSIL_HOME first, so add a stone_fossil_set_home() bridge call (setenv FOSSIL_HOME) and point it at the writable Application Support directory at launch -- the same base RepoStore uses for the .fossil files. Fossil's global config now lives at .../Application Support/.fossil. 6. 9e7e9a185dcb02b9e91a912257afbb0d93d27aa14e4719965c2339a04b0fd006 - branch: trunk - user: jkridner - comment: Enable https clone/sync via vendored LibreSSL

Fossil's TLS layer (src/http_ssl.c) uses the OpenSSL API; without it https transport silently returns 0 bytes. We now build it with -DFOSSIL_ENABLE_SSL backed by LibreSSL 4.1.0, cross-compiled static for the iOS device and simulator arm64 slices and merged into libfossil.a so the app still links one artifact.

Builds and launches clean on the iPhone 17 simulator. Runtime clone verification pending. 7. af504a66c810fc9fdb8625e62c966a687d642edd107be0383b7d979e59fe39a2 - branch: trunk - user: jkridner - comment: Fix SQLITE_MISUSE(21) on repeated fossil_main() calls

sqlite3_config() is only valid before SQLite initializes; upstream Fossil exits after each request so it is always pristine there. In Stone's in-process server fossil_main() runs many times in one process, so the two sqlite3_config calls returned SQLITE_MISUSE(21) on every call after the first. Guard them with a static once-flag in src/main.c (process-scoped one-time init, made idempotent) -- added as a new hunk to fossil-inprocess.patch alongside the existing request-scoped reset_state changes. Harmless before (return values ignored, log handler persists), but it polluted the log on every request. 8. e00b463e739f45dca619dddfb6063e0b75a6fccc18e51afb40727479fe89e3e6 - branch: trunk - user: jkridner - comment: Add Settings sheet for commit author (USER) override

Gear button on the repo list opens Settings with a Commit Author field (persisted via @AppStorage, default "stone"). Applied at launch and on change through a new stone_fossil_set_user() bridge call, which overrides the built-in default identity. Registered SettingsView.swift in the Xcode project (manual pbxproj edit; project.yml is folder-based and needs none). 9. facd3418f853ad423568b81a3adcc0524a9afdb176fa8bafc1a723f3538e478e - branch: trunk - user: jkridner - comment: Add rename action for repositories

Swipe a repo row from the leading edge to Rename; an alert with a text field edits the display name. The .fossil file keeps its UUID-suffixed name, so RepoStore.rename only updates metadata -- nothing on disk moves. Fixes the inability to correct a typo in a repo name after adding it. 10. 0f29cdfaa4b1fb43e24694639cb922c54b8a6d9a3c33fe8000d5685895bf63ea - branch: trunk - user: jkridner - comment: Require confirmation before deleting a repository

The default .onDelete put delete on a trailing full-swipe that auto-fired with no confirmation, so swiping a row left silently deleted the repo (and erased its .fossil file from disk). Replace it with an explicit trailing Delete button using allowsFullSwipe: false, gated behind a confirmation dialog that names the repo and warns the deletion is permanent. Rename stays on the same trailing action group. 11. 45a8cf3e5f807f83d697f66eb0697fc86bfee04e0ed5dff118c7d529f7833d53 - branch: trunk - user: jkridner - comment: docs: design for Option B caching Fossil-aware browser

Documents the router/handler architecture for review before implementation: two viewing modes (working copy vs remote cached), the in-process router replacing the g_server.repo_path retarget hack, per-URL-class caching policy, the CGI/hook verdict (popen2/fork-exec forbidden on iOS -> in-process hook analogue), phased rollout, and the two open questions (remote-browse auth scope, mobile skin approach). 12. 3380d0bb5709bac3f0f85d62eda5589e212d2017b8e95c72c3d55389b47a5836 - branch: trunk - user: jkridner - comment: docs: fold ticket #552b1261 into design + scope agent-client gaps

option-b-caching-browser.md: add section 10 (agent-aware optimized client) describing the ollama.openbeagle.org agent layer (/ext/agent, session JSON endpoints, :8443 SSE, /forume2 cookie-forward posting) and the local-clone-read / remote-server-agent split; resolve section 9 Q1 toward carry-credential (login cookie from Keychain) and add the native-vs-WKWebView question.

agent-client-scoping.md (new): break the ticket's three gaps into reviewable units against the current services (Repo/CredentialStore/ FossilEngine/RepoStore) -- login+cookie-forward (Gap 1), native Sessions/SSE/composer (Gap 2), native-vs-WKWebView decision (Gap 3) -- with a build order and the open decisions (D1-D4) needed before coding. 13. 8990dcb9c0e4aafe703cfe0e8b47a6bd0573d4350db1a14cd52a7d4ef7333c4c - branch: trunk - user: jkridner - comment: docs: fold expanded gateway vision + tighten agent posting contract

Ticket #552b1261 gained a maintainer note (2026-06-18) expanding Stone from a Fossil browser into a multi-plane GATEWAY, plus concrete client contracts.

vision-gateway.md (new): the four planes -- cached read (foundation), embedded offline-first JOURNALING (the nearer/lower-risk pillar via technotes/wiki/forum + sync-outbox), remote live control (anywhere coding), and logging incl. geolocation into Fossil -- with the note->ticket->session bridge, the shared auth/sync/substrate foundation, suggested sequencing, and open questions (V1-V4).

agent-client-scoping.md: tighten Gap 2 with known JSON contracts (session_posts/session_live_url shapes), the SSE turn_finished event, and the real forum-reply flow (forumedit -> scrape csrf -> forume2 with Referer; ref ollama-codex src/forum_writer.cr) requiring forum caps and surfacing the "no csrf token" cap-failure distinctly; cross-link the vision doc. 14. c116c977b3517d39db46e93e151f53af414fbb9309bf78de125a1b886b3d5e1e - branch: trunk - user: jkridner - comment: docs: Chronicle readiness contracts + verified technote-id gap (C1)

New chronicle-readiness.md captures the forward-compat contract for the journaling plane: the four freeze-now contracts (technote-id == EventKit UUID; /health + /location wiki append; embedding table schema; /ext as the only server-intelligence interface), the artifacts-vs-tables sync boundary (content syncs, embedding vectors do not), remote-search plan of record with graceful offline degradation, and the iOS prep (offline-first + BGTaskScheduler, repo-growth/media discipline, SQLite WAL/file-protection/locking hygiene).

Verified C1 against vendored Fossil: caller-chosen technote-id is NOT reachable via stock paths -- event_cmd_commit (src/event.c:583) always generates zId via randomblob(20); event_commit_common accepts a zId one layer down but nothing exposes it. Honoring contract 1 needs a small --technote-id patch or a direct-artifact bridge path (plus an id-format decision, hex vs EventKit UUID).

vision-gateway.md: cross-link chronicle-readiness from the journaling and logging planes. 15. 4fbb936416e0d09d5cf4c944f15dba60d47278059c7dde03f37a992166bc9226 - branch: trunk - user: jkridner - comment: Gap 1: RemoteSession auth client (login cookie for remote Fossil)

Adds the shared auth foundation for the agent-client / remote-cached planes: an actor that POSTs u/p to <repo>/login over URLSession and carries the resulting fossil-<projcode> cookie on subsequent GETs.

Grounded in vendored Fossil login.c: named-user login needs no CSRF token and no captcha (that path is anonymous-only), success sets a fossil-* cookie + redirects, failure is HTTP 401. Username is derived from the remoteURL userinfo (no Repo model change; resolves D1); password comes from CredentialStore. Cookie lives in an ephemeral in-memory jar and is not persisted -- re-login on 401 instead of widening the Keychain surface (resolves D2). Uses the system trust store, so unlike the Fossil C core it needs no bundled cacert.pem. Auth failures surface distinctly (RemoteError.notAuthenticated) per the ticket's cap-failure requirement.

Registers the new source in the Xcode project; the fileRef id had collided with the pre-existing Resources build phase id (5E771500A11A5EAA00000006), which xcodebuild reported as a bogus "project is damaged / PBXResourcesBuildPhase group" parse error -- moved the RemoteSession fileRef to ...00000007. Verified: device build (sdk iphoneos, generic/platform=iOS) SUCCEEDS. 16. ab40e982feeca1984a3046633cd65ecd5da32ade3f688e9690df27249ed858c8 - branch: trunk - user: jkridner - comment: docs: amend Chronicle contract 1 (SHA1 of UUID) + resolve C1a/C1b

Maintainer correction: technote-id == EventKit UUID verbatim is unimplementable -- the enduring Fossil file format requires E-card ids to be 40-char lowercase hex, so a 36-char hyphenated uppercase UUID is illegal regardless of CLI. Amend contract 1 to technote-id = lowercase SHA1(EventKit UUID) (pure function -> idempotent addressing survives, no lookup table), plus record the raw UUID as a T card (tags are artifacts, they sync) for reverse linkage.

C1a resolved by the standard (no hex-vs-UUID decision). C1b: choose the ~10-line --technote-id patch to event_cmd_commit (event_commit_common already takes zId) with explicit upstream submission; reject the artifact-injection bridge for the production path (injection needs unstable test cmds or the xfer protocol = high debt). 17. 84fcfe066c8085a255de93c84268dad160440c04f34e99135fd7384a1ae0d773 - branch: trunk - user: jkridner - comment: docs: concrete --technote-id patch scope (C1 implementation)

Names the real call chain (wiki_cmd -> event_cmd_commit event.c:583 -> event_commit_common, which already takes zId) and the ~10-line change: add find_option("technote-id") in wiki.c, thread a zGivenId param into event_cmd_commit used when rid==0 instead of randomblob(20), with 40-char-lowercase-hex validation to enforce the E-card format; raw UUID via a T card (reuse --technote-tags). Carry as a hunk in fossil-inprocess.patch, submit upstream as an explicit goal. 18. 568b010a79944e441694f6bed5a9981defe1678e94e02803e872d7923ef3fe33 - branch: trunk - user: jkridner - comment: docs: fix contract 3 (fx_embedding), harden contract 1 tag/SHA1, expand C2

Contract 3 defect (confirmed against source): a stock fossil rebuild DROPs every repository table outside Fossil's whitelist except GLOB 'fx_*' (src/rebuild.c:407). The frozen table must therefore be fx_embedding, not embedding, or the first server-side rebuild silently destroys the vectors; final name matches whatever fx_-name Ollama-Codex lands on. Zero Stone code impact via contract 4 (Stone only calls /ext/search). Updated the schema-name references throughout.

Contract 1: cite the format standard (www/fileformat.wiki:499 -- E-card id must be a 40-char lowercase-hex string, discharging the owed verification); pre-empt the SHA1-deprecation objection (deterministic name derivation from trusted inputs, not collision resistance); switch the reverse-linkage tag from uuid:<raw> hybrid to a hyphenated tag NAME uuid-<raw> (indexed tagxref exact-name lookup). Mirrored in the --technote-id patch scope.

C2: note NSFileProtectionComplete makes the repo unreadable while locked -- exactly when BGTask sync fires -- so CompleteUntilFirstUserAuthentication is the offline-first-safe class; a future Share-extension forces an app-group container where Fossil POSIX locking needs a spike. 19. 91a5d904656825c1a1f1de0843666205466449b5634573aa323886dda5116a2a - branch: trunk - user: jkridner - comment: docs: unify Chronicle into Stone's journaling plane; add per-repo role proposal

Chronicle names the journal repository, not a separate app — Stone is the single app. Retire the 'plugs in later' forward-compat framing in vision-gateway.md, fix stale contract refs (SHA1 technote-id, fx_embedding), fold the build-now/know-now split into the journaling plane, and add the per-repository Role (.code/.journal) design proposal with its gated capabilities. Flag the plane-2/plane-4 collapse as an open conflict rather than resolving it silently. In chronicle-readiness.md, add the unfreeze trigger for the media-as-unversioned-files deferral. 20. 977c5a65579c88c7d21b2c0accb6db494026498cac2a9384059706ac5a65f6dc - branch: trunk - user: jkridner - comment: docs: adjudicate plane collapse — 3 planes, Chronicle authored/captured write modes

Renumber to three planes: former plane 4 (logging/geolocation) folds into the Chronicle plane as the 'captured' write mode (authored = human via contract-1 SHA1 ids; captured = machine streams via contract-2 high-water idempotency). Keep one .journal role gating the capability class, with per-source live state within the role (each iOS permission is independently grantable). Role decodes-with-default (.code) so existing index.json needs no migration. Contract-2: add the HealthKit identical-timestamp edge case — records at the high-water timestamp dedupe by sample UUID, strictly-newer applies beyond it. 21. 28b0f5e70428edcc8d4d4db2bb915579a6d57c5b461fef993157eb01b0712808 - branch: trunk - user: jkridner - comment: docs: trim plane-2 contract restatement to names+link (single-source discipline)

vision-gateway.md restated the four Chronicle contracts in summary form, which went stale when contract 2's tie edge case was amended in chronicle-readiness.md only. Adopt single-source-of-truth: chronicle-readiness.md owns the contract definitions; vision-gateway lists the four names + links to the owner and never re-explains a contract. Also softened the write-mode and know-now references to name-and-point (contract N) rather than glossing the mechanism. 22. a20b77a9eeecbe32965d6123f26454d2c5ff00312b50cbc0bbd2f5db703b946b - branch: trunk - user: developer - comment: docs/design: Ollama-Codex remote-development client (plane 3) [authored by agent-claude on owner request]

New design doc instantiating plane 3 (remote agent-client control) from vision-gateway.md for the Ollama-Codex workbench at ollama.openbeagle.org. Extends agent-client-scoping.md (the 3 gaps) and reuses the option-b hook/router model. Captures the owner's locked decisions (hybrid transport; native DB + HTTP sync primary + JSON management + SSE status; WASM mobile agent built from a local OC clone via /hook, minimal OC code copied into Stone; remote-execution-only v1; Apple STT/TTS; stale-until-connected caching) and open contracts to freeze (login bridge, queue idempotency, agent artifact publish, search-data copy, session addressing). 23. 521a0bf4753b4e398a7ee1a2b920f2b1194372059ce19be44830a0c043765497 - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: add Linux iOS cross-compilation build scripts

Four new scripts let a Linux machine validate the Stone iOS app builds cleanly without touching a Mac:

scripts/linux-preflight.sh — checks for clang, llvm-ar, make/curl/tar/patch, and IOS_SDK_PATH; prints the exact Mac commands needed to extract and scp the iOS SDK.

scripts/linux-build-libressl.sh — adapted from build-libressl-ios.sh; replaces xcrun with $CC/$IOS_SDK_PATH, sysctl with nproc. Builds ios-arm64 slice only.

scripts/linux-build-fossil.sh — adapted from build-fossil-xcframework.sh; same xcrun/sysctl substitutions, plus replaces `libtool -static` with ar-based .a merging (extracts objects into separate tmp dirs to avoid name collisions between libssl.a and libcrypto.a). Writes the ios-arm64 xcframework slice; the Mac script adds simulator and rewrites Info.plist.

scripts/linux-swift-check.sh — runs `swiftc -typecheck` (full type-check) when IOS_SDK_PATH is set, or `swiftc -parse` (syntax only) as a fallback when it is not.

The existing fetch-*, gen-fossil-sources.sh scripts are unchanged and already work on Linux (Fossil's autosetup bundles jimsh0.c so tclsh is not required). The iOS SDK sysroot itself must come from a Mac with Xcode — the preflight script prints the exact extraction commands.

Environment verified: Alpine clang 21.1.2 + llvm-ar already present on this host; only IOS_SDK_PATH is needed to unblock the full build. 24. b7281c7c985394fedda352d6ba5660556f1576150aae4fc2e2a88d68739e5b2e - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: fix Mac-side iOS SDK extraction command in linux-preflight.sh

Reproduced the reported failure exactly: xcrun's --show-sdk-path is a symlink (iPhoneOS.sdk -> iPhoneOSNN.N.sdk on recent Xcode), so tarring the basename archived the symlink itself, not the SDK contents. Resolve via 'cd ... && pwd -P' before archiving so the real versioned directory gets packed. Also pass --no-mac-metadata --no-fflags --no-acls --no-xattrs to bsdtar so it stops writing the SCHILY.fflags/xattr/acl extended headers that GNU tar on Linux doesn't recognize (harmless warning, but now silenced at the source). Updated both copies of the instructions (header comment and the printed fail() message). 25. b69be2c03e7f79223a7c3f5414bcfdc6c719e4064a2d5c4ed9c6d1f9310ac016 - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: Linux iOS build: default to /opt SDK, fix linker + DNS compile break; first clean device-slice build

Default IOS_SDK_PATH to /opt/iPhoneOS.sdk when present (now bind-mounted read-only into this sandbox) in all four linux-*.sh scripts, so no manual export is needed. linux-preflight.sh's SDK-version detection now reads SDKSettings.json (falls back to XML SDKSettings.plist) since this SDK ships the settings file as a binary plist that grep can't parse.

Two real build breaks found and fixed by actually running the compile against the real SDK for the first time:

Verified end-to-end from a clean build/ + ios/Frameworks/: preflight passes automatically, LibreSSL builds real arm64 static archives, Fossil's full 642-member libfossil.a is a genuine Mach-O 64-bit arm64 archive with 'fossil_cli_main' resolvable via llvm-nm. This is the first time the iOS-arm64 device slice has actually compiled clean end to end in this build environment. 26. 777b1ca65aaf96e3e37c337d49f18819e96e96e8d60a915dd7ba2ae87845a82d - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: document that Swift type-checking is not viable on Alpine/musl hosts

Record the dead end so nobody re-walks it: downloaded the real swift-6.3.3-RELEASE-amazonlinux2 toolchain and ran it under gcompat on an Alpine host — swift-frontend aborts on a bare -version with std::system_error/SIGABRT (C++ ABI mismatch gcompat can't shim). Building the compiler from source as a musl host also isn't the supported path (that's what the Static Linux SDK cross-compiles *to*, from a glibc host, not a musl-hosted compiler) and stalls on missing deps beyond libuuid. Decision: skip native Swift type-checking on Linux for now; point at an official Swift container (swift:*-amazonlinux2) as the fallback if it's ever needed. The Fossil/LibreSSL C build remains fully validated natively on this host. 27. 5e3ceacba962ab1021e9523509cfcdcafcc005a61ef1f1021b56a6ff8c482277 - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: add mac-acceptance-test.sh — end-to-end pass/fail build acceptance test

One command to run on the Mac before merging this session branch: scripts/mac-acceptance-test.sh. Chains the existing pipeline (fetch -> generate -> build LibreSSL -> build FossilCore.xcframework) and adds two things no prior script checked in one place:

Fail-fast: each step's full output goes to build/acceptance-logs/, and the first failure prints its tail and stops immediately, since every later step depends on the previous one's artifacts. Verified the harness itself (step/require numbering, log capture, fail-fast exit path) by running it here against both the real 'not macOS' guard and a stubbed run through the tool-check gate -- both produced clean FAIL banners with exit 1, as intended. The xcodebuild-dependent steps themselves cannot be exercised outside macOS. 28. 82c75dfd3a88be9b00ce0b58d0fb59f4cb066df7ff0972714072b7f0c87156e8 - branch: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3 - user: agent-claude - comment: fix real macOS LibreSSL build failure; make the whole pipeline idempotent

Two independent things, both driven by ec2-user's first mac-acceptance-test.sh run: it correctly built the Fossil sources (35s) but then build-libressl-ios.sh FAILED with cascading "conftest.er1"/"libtoolT.tmp" errors and "no rule to make target .../libcrypto.la".

  1. Real bug, macOS-specific: build_arch's cp -R "$SRC" "$bdir" does not preserve source mtimes, and per-file copy timing can leave aclocal.m4 looking newer than the generated configure/Makefile.in purely by copy-order luck. That trips automake's maintainer-mode auto-remake under make, which reruns the system's (different) autoconf/automake and can produce a libtool script that fails to substitute its extended shell functions -- exactly the failure mode in the log (device slice, copied first, built clean; simulator slice, copied moments later, hit the race and failed). Fixed by stamping every file in the fresh copy to an identical mtime right after cp -R, so nothing ever looks newer than anything else and the auto-remake rules never fire. Applied to both build-libressl-ios.sh (the one that actually failed) and linux-build-libressl.sh (same cp -R pattern, same latent race, even though it hadn't manifested there yet).

  2. ec2-user also asked whether Fossil source generation could be "verified up to date" instead of always redone. It couldn't, because fetch-fossil.sh/fetch-libressl.sh unconditionally wiped and re-extracted on every run, discarding gen-fossil-sources.sh's prior output before it even got a chance to skip anything. Made every stage of the pipeline independently idempotent (skip if already up to date; FORCE=1 overrides): fetch-libressl.sh, fetch-fossil.sh, gen-fossil-sources.sh, build-libressl-ios.sh (per-arch), linux-build-libressl.sh (per-arch), build-fossil-xcframework.sh, linux-build-fossil.sh. mac-acceptance-test.sh gets a --clean flag (sets FORCE=1 and adds a clean step to the xcodebuild action) for the genuine from-scratch run worth doing right before merging; the default is now fast on reruns.

Found and fixed a real bug while adding this: gen-fossil-sources.sh's new skip-check globbed bld/*_.c before checking whether bld/ even exists -- on a truly fresh checkout that glob doesn't match, ls exits non-zero, and pipefail+errexit killed the whole script silently (zero output, exit 1). Caught by actually running a cold end-to-end pipeline from a wiped vendor/+build/ here, not just unit-testing the skip path in isolation.

Verified on this Linux host: full cold pipeline (fetch through linux-build-fossil.sh) completes in 3m48s from nothing; an immediate rerun completes in 0.016s with every stage reporting "already ... skipping". FORCE=1 correctly forces a real rebuild again. The libtool mtime race itself can only be confirmed fixed on macOS, where it was reported -- that's on ec2-user's next run.

29. **fd5db7b0aad406246b97cc71b6487a5e532a63e44e2095419fec17e146f62588**
    - <span class="ocx-k">branch</span>: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3
    - <span class="ocx-k">user</span>: agent-claude
    - <span class="ocx-k">comment</span>: fix simulator link failure: pin ARCHS=arm64 in mac-acceptance-test.sh

ec2-user's simulator build failed with undefined stone_fossil_* symbols for architecture x86_64. Root cause: -destination 'generic/platform=iOS Simulator' isn't tied to a concrete booted simulator, so Xcode can't detect one "active" architecture and instead builds the project's whole ARCHS list for the simulator SDK -- arm64 and x86_64, via the project's $(ARCHS_STANDARD) default. FossilCore.xcframework only ships arm64 slices (device and simulator), so the x86_64 link fails.

Fixed by pinning ARCHS=arm64 (and ONLY_ACTIVE_ARCH=NO, redundant with a single-entry ARCHS list but explicit) on both the simulator and device xcodebuild invocations. Device is unaffected in practice (iOS device has no x86_64 architecture to fall back to), but pinned for symmetry and to make the intent explicit at each call site.

Verified: script still syntax-checks and fails cleanly at the "not macOS" gate here, as before -- the xcodebuild-dependent path itself can only be confirmed fixed on ec2-user's Mac, where it was reported.

30. **3b4cc3ea0259ac54418f21b9332e5df49ec999ea7047fc546acc7c907f9cbc00**
    - <span class="ocx-k">branch</span>: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3
    - <span class="ocx-k">user</span>: agent-claude
    - <span class="ocx-k">comment</span>: fix verify\_app\_binary false negative: disable Xcode's debug dylib split

The simulator xcodebuild step now succeeds (ARCHS=arm64 fix landed), but verify_app_binary failed: "stone_fossil_run not found in binary". Not a link failure this time -- Xcode 15+ Debug builds split the app into a thin Stone loader executable plus the actual linked code in a separate Stone.debug.dylib (visible in the earlier build log as "Ld .../Stone.debug.dylib"), for faster incremental debugging. The nm check was looking at the loader, which never contains stone_fossil_run.

Fixed by adding ENABLE_DEBUG_DYLIB=NO to both xcodebuild invocations, which reverts Debug builds to linking one self-contained executable -- matching how a real Release/Archive build links anyway, so this is actually the more representative thing to verify, not just a workaround.

Verified: script still syntax-checks and fails cleanly at the "not macOS" gate here. The xcodebuild-dependent path can only be confirmed fixed on ec2-user's Mac, where it was reported.

31. **823041144633486af759f68a82bd602a9ac43cbb77eebe63e8fe6a3cd2023007**
    - <span class="ocx-k">branch</span>: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3
    - <span class="ocx-k">user</span>: agent-claude
    - <span class="ocx-k">comment</span>: verify\_app\_binary: search the whole bundle, dump diagnostics on failure

ENABLE_DEBUG_DYLIB=NO did not fix the reported failure -- same "stone_ fossil_run not found in binary" result, same spot, after the merge. That means my last diagnosis (guessed from the build log alone, without a Mac to actually check) was wrong or incomplete, and guessing a third fix blind isn't a good use of another round-trip.

Changed verify_app_binary to:

Verified the search-and-diagnose logic standalone against a throwaway test bundle (both the found-it and not-found-anywhere paths), and that the script still syntax-checks and fails cleanly at the "not macOS" gate here. The actual Stone.app packaging can only be inspected on ec2-user's Mac.

32. **072a2b251716b416ac4f52b1577d677b8f32fda66c7bb4800495247b114dbe42**
    - <span class="ocx-k">branch</span>: session/111ca25859dfabb726c31d9cc58b1fc6d0c5c350271e82f4268e6b1d0ae998c3
    - <span class="ocx-k">user</span>: agent-claude
    - <span class="ocx-k">comment</span>: fix real cause of the false negative: grep -q + pipefail SIGPIPE race

ec2-user's diagnostic dump from the last round proved the fix: it showed "_stone_fossil_run" sitting plainly in the nm output of the plain Stone executable, while the pass/fail check one function up said "not found in any Mach-O file". Same file, same symbol, contradictory results -- so the bug was never about where Xcode puts the linked code (ENABLE_DEBUG_ DYLIB was a wrong diagnosis last round). It was in how the check itself read nm's output.

Root cause, reproduced and confirmed here: this script runs under `set -o pipefail`. `nm` on a multi-megabyte Swift binary streams thousands of symbol lines. `grep -q PATTERN` exits the instant it finds a match and closes its end of the pipe -- while `nm` is often still mid-write -- so `nm` gets killed by SIGPIPE (exit 141). Under pipefail that makes the WHOLE pipeline report failure (nm's signal death, not grep's result), even though grep genuinely found the match. Verified with a standalone repro here: a `producer | grep -q MATCH` pipeline where MATCH appears early in a long stream reports pipeline exit 141; the same pipeline with non-quiet `grep MATCH >/dev/null` reports 0, as it should, since a non-quiet grep reads to EOF and lets the producer exit normally.

Replaced every subprocess-fed `grep -q` in this script with non-quiet `grep PATTERN >/dev/null` (lipo -info arch checks, file Mach-O checks, and the nm symbol search in verify_app_binary's bundle-wide loop and diagnostic dump). Also corrected the comment above build_simulator/ build_device that had blamed ENABLE_DEBUG_DYLIB for the earlier failure -- kept that setting since it's still the more representative thing to build against, but it was never the actual cause.

33. **8d052ddcae8f381f22ec95e3cdd4e174515d0e0d20c4b55f8d644c1474264353**
    - <span class="ocx-k">branch</span>: trunk
    - <span class="ocx-k">user</span>: jkridner
    - <span class="ocx-k">comment</span>: Add Linux build tests and Mac acceptance test

``` jkridner@lego stone % scripts/mac-acceptance-test.sh --clean
=== Stone iOS build — Mac acceptance test === (--clean: every step forced to redo its work from scratch)

==> [1] macOS host OK: macOS 26.4 ==> [2] Xcode command-line tools OK: Xcode 26.6 ==> [3] fetch LibreSSL source OK (1s) ==> [4] fetch Fossil source OK (0s) ==> [5] generate Fossil sources OK (35s) ==> [6] build LibreSSL (device+sim) OK (48s) ==> [7] build FossilCore.xcframework OK (57s) ==> [8] xcframework slices OK: device + simulator arm64 slices present (20 MB device slice) ==> [9] xcodebuild: iOS Simulator (unsigned) OK (8s) ==> [10] simulator app binary OK: /Users/jkridner/workspace/ollama-codex/stone/ios/build/acceptance-sim/Build/Products/Debug-iphonesimulator/Stone.app/Stone -- Mach-O arm64, 7 MB, Fossil core linked (symbol found in Stone) ==> [11] xcodebuild: iOS device (unsigned) OK (8s) ==> [12] device app binary OK: /Users/jkridner/workspace/ollama-codex/stone/ios/build/acceptance-device/Build/Products/Debug-iphoneos/Stone.app/Stone -- Mach-O arm64, 7 MB, Fossil core linked (symbol found in Stone)

ACCEPTANCE: PASS Simulator app: ios/build/acceptance-sim/Build/Products/Debug-iphonesimulator/Stone.app Device app: ios/build/acceptance-device/Build/Products/Debug-iphoneos/Stone.app (unsigned)

Not covered here -- sign + install on a device via:

scripts/run-on-device.sh

``` 34. e2826f1d0c04a67aa82f1c3d68f3d18cc20b143a3cd1eaea7bdc5462077216dc - branch: agent/20260825T145651Z-build-identity-about-page-know-at-a-glan - user: agent - comment: feat: add build identity stamping and About page 35. 3e43b266dcc6d514f395d619f4c83a37bd4890b4775cf8e38a04398a2ac62b2b - branch: agent/20260825T145651Z-speech-editing-slice-1-dictate-a-phrase - user: agent-claude - comment: Speech editing slice 1: dictate a phrase, send to gp-crystal /edit, show the result

Adds a gpcr-edit screen (mic button via SFSpeechRecognizer, contextualStrings seeded from the closed grammar's fixed words/numbers, plus a typed-input fallback) reachable from a repo's detail screen. Send POSTs the phrase as a plain form field to the repo's `edit` route via RemoteSession (reusing the existing per-remote login cookie), and the returned page's result text (applied-op JSON or rejection hint) is extracted and shown, with a link to view the served page for the visual. RemoteSession gains a `post()` alongside its existing `get()`. Rendering blocks natively is left to a later slice. 36. bb77736ad1cd1c65bf440596311146ae3512484a35b1ed454804aaaa97c3075d - branch: agent/20260825T145651Z-sync-all-repos-in-one-action - user: agent-claude - comment: Add Sync All action at the repo list level

Adds RepoStore.syncAll(), which sequentially runs the same per-repo sync(_:) used by RepoDetailView across every repo with a configured remote, tracking per-repo status (syncing/success/failure) and a completion summary. RepoListView wires this up via a toolbar button and pull-to-refresh, with a compact checkmark/error icon per row and a summary alert once the run finishes. 37. 7bbec8636aa0fbe641ad289874e5fcb34ecb8ad89c0c8a2b9c4f7627f43deb54 - branch: agent/20260825T180439Z-remote-ollama-codex-sessions-slice-1-vie - user: agent - comment: feat: implement remote forum reply flow for session threads 38. 4a3e4a807a70e99fa866e2d3711c564f0e42041740801b377f1a803a78120bcd - branch: agent/20260825T180439Z-over-the-air-update-path-testflight-xcod - user: agent-claude - comment: docs: TestFlight/Xcode Cloud OTA update guide + one-command upload script

Adds docs/ota-updates.md (App Store Connect app record, bundle id/signing, TestFlight internal testing group, and the Xcode Cloud option with its compute-hour costs and the Fossil-vs-git-host source-control limit) and scripts/testflight-upload.sh, which archives/signs/uploads a Release build to App Store Connect in one command using the same automatic-signing convention as run-on-device.sh. Every step needing the user's Apple account is marked [APPLE ACCOUNT] in the doc. 39. 07c9c06f6356bc75411c01d112bceabb7b2bada37c7de0d039bdf94230999604 - branch: session/ea0299d54f24b9c17510d38f02b0039c1e65b7c94dc3307f333a36fff815eb0f - user: agent-terra - comment: merge: stage reviewed Sync All feature for Mac/iPhone testing 40. 570a86cfedf61f5f8cb025112ffe23ec7cef5c2bebf0dab4165cd17d297da27b - branch: agent/20260825T145651Z-build-identity-about-page-know-at-a-glan - user: agent-trunk-ops - comment: fix(build-identity): add omitted AboutView.swift and BuildIdentityOverlay.swift

Task e01943ba referenced these two views from StoneApp.swift and SettingsView.swift but never fossil-added them, leaving the branch tip with undefined symbols. The files existed as untracked extras in the task checkout; recovering them here so the branch builds. Compile gate remains the user's Mac Xcode build. 41. e2d1ba1888c18460da672f5c3092b2a9f8b48c48691fd9690782762c11b46f5f - branch: trunk - user: agent-trunk-ops - comment: Merge build-identity + About page to trunk (ticket e01943ba)

Build-id stamping in run-on-device.sh, About page (version/commit/date/remotes), and launch build-id overlay. Includes recovery of two views the task branch referenced but failed to fossil-add. Device/compile verification: user's Mac Xcode build. 42. 7a0b5acd4e32ca6f23f07ed33fd5859c96a8fbc455a98a7bef3a4bbe4c00c72e - branch: agent/20260826T022125Z-run-on-device-sh-does-not-actually-deplo - user: agent-claude - comment: fix run-on-device.sh: hard gate on macOS, verify build freshness, honest confirmation

The script already built+installed+launched via real device targeting (xcodebuild -destination id=<UDID>, devicectl install/launch with the matching CoreDevice id), but nothing forced xcodebuild's "success" to mean "the device now runs new code":

Also pulled in the sibling build-identity-stamping branch's Info.plist-stamping change (kept) but reverted its StoneApp.swift/SettingsView.swift edits: that commit only touched 3 files yet references BuildIdentityOverlay() and AboutView() types that were never added anywhere in the repo -- merging it as-is would have broken the Xcode build outright. Left that UI work for its own ticket to finish; this branch stays buildable.

Verified without a Mac (none available in this checkout): bash -n and an actual run confirm the new macOS gate fires correctly and exits 1 with a clear message on Linux; the device-selection branching (0/1/2+ devices) and the fossil-changes-based dirty-flag logic were each exercised standalone against synthetic fixtures. The xcodebuild/devicectl/plutil-dependent path itself can only be confirmed on a Mac with a tethered device, which this environment does not have. 43. 846c07179151e4ad147fa84d4b118cfc1223c5f32d338a528b024217eabbd995 - branch: trunk - user: agent-trunk-ops - comment: Merge Sync All action to trunk (ticket f5406351)

Repo-list-level Sync All (toolbar button + pull-to-refresh) iterating configured remotes sequentially, per-row status icons, and a summary alert. Compile/device verification: user's Mac Xcode build. 44. 80512b466bb44b9681b7712634d4c75932b51ab3db717abc6abb7f43813cda81 - branch: session/ea0299d54f24b9c17510d38f02b0039c1e65b7c94dc3307f333a36fff815eb0f - user: agent-terra - comment: merge: stage completed Stone device-test branches 45. 4313f515e61b406842e54f83a6ba909821911a9d6c798b20113f0f932c7ab1d4 - branch: trunk - user: agent-trunk-ops - comment: Merge speech-editing slice 1 (gpcr /edit) to trunk (ticket 622f2c2d)

New gpcr-edit screen: SFSpeechRecognizer mic (contextualStrings from the closed grammar) + typed input, POST of field 'phrase' to the remote /edit endpoint as the logged-in user (RemoteSession.post), result page shown. Adds mic/speech Info.plist usage keys and RemoteSession POST support. Compile/device verification: user's Mac Xcode build. 46. 64fffb23402a8ffa534faf452059c8db836313145019ec8efc63c4707562aa0c - branch: session/ea0299d54f24b9c17510d38f02b0039c1e65b7c94dc3307f333a36fff815eb0f - user: agent-terra - comment: fix: escape CSRF regex quote in staged remote session 47. 1f16cd6de4147ad1fc0e4086bf2285557669c0fda8a6e2ca6d56f9f14e8668f4 - branch: trunk - user: agent-trunk-ops - comment: Merge OTA update path docs + TestFlight hook to trunk (ticket 5b145bc5)

Adds docs/ota-updates.md (App Store Connect setup, signing, TestFlight internal testing, Xcode Cloud option) and scripts/testflight-upload.sh (one-command archive+ sign+upload). Docs/script only; no app code changes. Steps needing the user's Apple account are marked in the doc. 48. c58f209c0895cb7c936aed55f3de29193f25bfd9e258f1f0439b81aee52167ef - branch: session/ea0299d54f24b9c17510d38f02b0039c1e65b7c94dc3307f333a36fff815eb0f - user: agent-terra - comment: fix: add missing build identity and About views 49. dae1bb10bcf30c837c98d020c1a0fde2813577066645afd6d6a2026349f56127 - branch: trunk - user: agent-trunk-ops - comment: Merge run-on-device.sh deploy fix to trunk (ticket fc996aee)

Takes fc996aee's rewritten scripts/run-on-device.sh: hard macOS/Xcode gate, refuses to guess among multiple tethered devices, build-freshness verification (reads back the stamped BuildCommit from the built .app and aborts on mismatch), honest final summary, and fixes the always-'-dirty' label bug in the build-identity stamping now on trunk (BUILD_DIRTY held the non-empty string 'false'; replaced with a fossil-changes check).

Conflict resolution: kept trunk's StoneApp.swift + SettingsView.swift (build-identity overlay + About link). fc996aee had reverted those only because its snapshot lacked AboutView/BuildIdentityOverlay; trunk now has them (recovered), so keeping the UI is buildable AND complete. Compile/device verification: user's Mac Xcode build. 50. 2541980c834a380f6bbed8f57e219496b9193f4aaeff1780bd6b95796d5c7e3b - branch: session/ea0299d54f24b9c17510d38f02b0039c1e65b7c94dc3307f333a36fff815eb0f - user: agent-terra - comment: merge: refresh staging from trunk and repair remote replies

log

  1. check read_unaudited read the check-ins that change files, and every verdict's tag change with who sent it, by the served repository's receipts; keep the check-ins no verdict that counts has judged, in the order it received them · repository /var/lib/fossil/stone.fossil

unaudited

List the check-ins that change files and that no verdict that counts has judged (docs/protocol-v2-verdicts.md): on one branch or every branch, oldest first in the order the server received them, at most 50, with how many there are. From a clone's checkout it asks the server. It writes nothing.

capabilities needed: (none)

optional · the branch whose check-ins are listed; every branch when absent