Repository navigation
Publish prebuilt Linux and macOS CLIs on release, and fix explain on Macs through the gateway - #53
Merged
Merged
Conversation
![adaptcom[bot]](https://avatars.githubusercontent.com/in/1609964?s=60&v=4){kind=small}
There was a problem hiding this comment.
Confidence Score: 2/5
Summary
Score reconciled from 3/5 because the review includes a blocking finding.
Adds the repo's first workflow: tag-triggered Linux release build and GitHub release upload. PR run is green; risk is supply-chain hygiene (unpinned third-party action with write token) and an already-deprecated runner label.
Important Files Changed
| File | Overview |
|---|---|
| .github/workflows/release.yml | New tag-triggered release workflow; unpinned third-party action, deprecated ubuntu-22.04 runner |
Reviewed 8a2e896...bf93dfd · ↻ Re-run review · View in Adapt
shanebarakat
force-pushed
the
ci/linux-release
branch
from
October 23, 2026 20:51
bf93dfd to
6844bb9
Compare
On a v* tag: run the lib tests and authority_boundaries, build kinbase for x86_64-unknown-linux-gnu (ubuntu-24.04, for Wanda's sandbox) and aarch64-apple-darwin (for engineers' Macs), check each binary's version matches the tag, and attach tarballs + sha256 to the release from a separate tag-only job that alone holds contents: write. hook_install_and_ledger is left out of the gate: it fails on main today. Pull requests that touch the workflow build and test without publishing.
shanebarakat
force-pushed
the
ci/linux-release
branch
from
October 23, 2026 20:54
6844bb9 to
0e69133
Compare
A second Launcher::load in the same process re-ran the attestation and counted descriptors the process had opened itself. On macOS, loading the native TLS roots for an https Company URL leaves two open, so explain through the gateway refused with CONFIG_INVARIANT.
shanebarakat
changed the title
alexu8007
self-requested a review
October 23, 2026 23:55
alexu8007
approved these changes
Oct 23, 2026
MrJoy
added a commit
to MrJoy/kinbase
that referenced
this pull request
Nov 3, 2026
Brings in wandercom#36, wandercom#37, wandercom#46-wandercom#48, wandercom#50-wandercom#53, wandercom#55, wandercom#56 and wandercom#58. The only conflict was the std::os imports in paths.rs: main's lock_file needs AsRawFd and this branch needs DirBuilderExt, so both are kept. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01USKFuHYy89wotDxF6TANSC
MrJoy
added a commit
to MrJoy/kinbase
that referenced
this pull request
Nov 3, 2026
Brings in wandercom#36, wandercom#37, wandercom#46-wandercom#48, wandercom#50-wandercom#53, wandercom#55, wandercom#56 and wandercom#58. Main added OIDC, a gateway API key and a configurable snapshot timeout to the inline [company] reader; this branch had moved that reader into company_section, shared with [companies.<name>]. The new keys and checks now live in company_section, so a named Company accepts them too and its messages name its own section. The OIDC session was one oidc.json beside the user config, which two named Companies signed in through different issuers would overwrite in turn. CompanyConfig now carries oidc_session_file in the Company's key directory: companies/<name>/oidc.json under the named form, and the config's own directory, so the same path as before, under [company]. The SessionStart login notice checks the selected Company's session file. `company usage` reads only its own --config, so it returns before the launcher loads with `init` and `serve`. `auth login` runs after selection and signs in to the Company the invocation selected. issue_certificate validates the --company URL with main's gateway rule only under the single form; a named Company's URL was validated when the config was read. Codex hook detection takes main's grouped-only reading. Also: named_company_tests was missing #[cfg(test)], so its helper compiled into the binary as dead code, and the branch had no changelog entry. hook_host_protocol::a_stranded_prompt_is_classified_by_the_next_stop fails here as it does on main; every other suite passes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01USKFuHYy89wotDxF6TANSC
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release binaries (
.github/workflows/release.yml): on av*tag, buildskinbasefor Linux x86_64 (Wanda's Ubuntu 24.04 sandbox has no Rust or nix) and macOS arm64, runs the lib andauthority_boundariestests, and attaches each tarball + sha256 to the release. PRs touching the workflow build without publishing.Fix:
explainrefused on Macs through the gateway (launcher.rs).explain(kindex's call) loads the launcher a second time, which re-ran the startup descriptor check after macOS's TLS roots had opened two descriptors, so it refused its own files. Now the first load attests and later loads reuse it; inherited descriptors are fixed at launch.Verified on a Mac through the staging gateway: main refuses, this branch works, a real inherited fd is still refused. New test fails without the fix; 225 lib tests pass.
Need help on this PR? Tag
@codesmith-botwith what you need.