nordisk/dwarves
Commits
6ddce5b87de6Merge htool/step-user into main (lane HEIM-TOOLING): a forge pipeline names its step user; tunnr-drift as container root in its own targete144f03adb98GREEN: pipeline user = "uid:gid" (step user over DWARVES_RUNA_USER, carried as DWARVES_RUNA_STEP_USER); tunnr-drift runs as container root in /backup/ci-target/tunnr-drift; forge_ci_files 16/16, forge_ci 27/27ecc7e9f4c13dRED: a forge pipeline names its step user (user = "uid:gid", refused otherwise); tunnr-drift runs as container root in its own target (the aya row's tunnr-cni writes /run/tunnr-cni)9a956f31c236Merge htool/ui into main (lane HTOOL-UI, Heimdall tooling plan step 4): the review in the Build Thing UI5ed3628842f4GREEN: dwarves tune show + TuneDoc.review (dwarves::tune::review), run_request, artifacts_under, dwarves::tune::jobs (jera ChainQueue, feature tune-jobs); dwarves-gui Syscall profiles tab (tune_pane), a thin layer on the verbs; README Review in the UI; tune 24/24, robot_tune_pane 2/2, roster 4/4, robot_scene 16/1681b0ac312b31RED: dwarves tune show (the review: calls, near-misses, approval, kernel join), queued tune jobs, and the Syscall profiles pane reviewing tunnr rusternetes-node-aya and approving through the tune approve verbaaf9d890ee18Merge htool/tune into main (lane HTOOL-TUNE): dwarves tune probe|gen|check|approve <artifact> [--workload <driver>] over edda measure (heimdall as an external process), --json document dwarves.tune/1, ServedRunner hook for served drivers; tune 16/16; real run on tunnr rusternetes-node (heimdall 0.2.0, pin OK) reproduced the committed profile byte for byte6f17c8003d18Merge remote-tracking branch 'local/main' into htool/tune2f1f2745b3faMerge htool/gate into main (lane HEIM-TOOLING, Heimdall tooling plan step 6): tools = [...] on forge pipelines + the tunnr-drift pipeline (the syscall-profile drift gate); forge_ci_files 16/16, forge_ci 26/269ca8e5675aa9dwarves tune: GREEN — probe|gen|check|approve <artifact> [--workload <driver>] over edda measure (external heimdall process), <repo>:<row> resolution, one-line refusals with the fix, --json document dwarves.tune/1, ServedRunner hook for served drivers (refused by name until tune_app); README + guide1de75fedc2ecGREEN: tools = [...] on a forge pipeline (read-only at /opt/ci-tools, refused by name when missing) + the tunnr-drift pipeline (cargo bt measure gate --build, row-pinned heimdall); setup.sh places the tool; forge_ci_files 16/16, forge_ci 26/26ab02d3976951RED: the tunnr drift gate on the forge — a pipeline sees its named tools read-only at /opt/ci-tools, a missing tool is refused by name; tunnr-drift runs cargo bt measure gate --build against the row-pinned heimdallb87594fba0f8dwarves tune: RED tests for probe|gen|check|approve <artifact> [--workload], artifact resolution, the --json document, served driversfcc42f1610b9Merge hol311korp/holger-310 into main (lane HOL-311-KORP): the lock follows Holger 3.1.0 (ten holger-* entries, server-lib libc), entries only. Gate (oden ci4, sibling mains: holger 29c8242f, edda 82bbc28, tunnr 2fc7d74): cargo metadata --locked on every lock of gunnar, gunnar-ui, holger-ui, dwarves and holger (29/29)4cd398f1efa2Lock follows holger main 3.1.0: the ten holger-* entries move 3.0.0 -> 3.1.0 and holger-server-lib gains libc; those entries only (lane HOL-311-KORP)3d7f69230620Merge hol311korp/korp-0211 into main (lane HOL-311-KORP, plan row HOL-CDS-6): the lock follows korp-installer 0.2.11 (tunnr main 2fc7d74), the korp-installer entry only (cargo update -p korp-installer gave this block). The root lock still needs the holger 3.1.0 follow (holger-* 3.0.0 -> 3.1.0 and server-lib libc), a separate follow0f1c6dce6330Lock follows korp-installer 0.2.11 (tunnr main 2fc7d74): the korp-installer entry only (lane HOL-311-KORP)472a1eb7014fMerge readmebench/forge-bench-2026-10-31 into main (lane README-BENCH): the weekly bench on oden regenerates Gunnar's and Holger's README speed tables80a4b227dbb2GREEN: README-BENCH the weekly bench on oden regenerates Gunnar's and Holger's README speed tables8953ab6c2036RED: README-BENCH forge bench/ proposals merged --no-ff, ci-verbs bench-readme, the weekly bench rowsd64c0b53d445Merge guestrel/workspace-example into main (lane guestrel): dwarves-slsa [[workspace_example]] release step (cargo run --example in a sealed network-off container, CARGO_NET_OFFLINE, exactly the declared outputs as subjects); the guest lock as a second lock. Gates on dwarf: dwarves-slsa tests 117/117, build --release --locked -p dwarves --features sign-step green, build:holger (embed-holger,rehearse,sign-step) green; release heimdall-guests-0.2.1 built with it9c32e113560dMerge remote-tracking branch 'origin/main' into guestrel/workspace-examplef25861c55704Merge t2next/korp-0.2.10-2026-10-31 into main (lane TEST2-NEXT): the lock follows korp-installer 0.2.10 (seccomp filter). Gate (oden ci4): metadata --locked, check -p dwarves --features sign-step,web-app and -p xtask green96fbac573defLock follows korp-installer 0.2.10 (tunnr main 2936047: the seccomp filter, seccompiler 0.5 + syscalls 0.8.1, the reboot handoff) (lane TEST2-NEXT)1ef346b3cf26GREEN: dwarves-slsa [[workspace_example]] (lane guestrel): workspace_example_container (cargo run --release --locked --offline --manifest-path /src/<manifest> --example <name> --target-dir /target/example-<i> -- args, {out} = /example-out = example-out/<i>, CARGO_NET_OFFLINE=true, workdir the manifest's directory, isolation checked), the forge action slsa.collect-example (exactly the declared outputs into out/, a missing, undeclared, linked or twice-collected file is red), stages workspace-example-<i>-<name> and -out after the vendor check, the run checks every declared output is a subject and cleans example-out/ with target/. README: the step and the guest's second lock. dwarves-slsa tests 117/117 (workspace_example 11/11)dacb90d96da8RED: dwarves-slsa [[workspace_example]] (lane guestrel): a release step that runs an example of a workspace from the sources (cargo run --release --locked --offline --example) in a sealed network-off container, with CARGO_NET_OFFLINE for the example's own cargo, and takes exactly its declared outputs as subjects (the forge collects them from example-out/<i>, refusing a missing, undeclared or linked file). For Heimdall's verify-bundle guests: dist builds the three wasm components; the guest's own lock is a second lock. The spec type and refusals are in; the container, the collect action and the pipeline stages are not (6 of 11 red)dd0e4a68ca4dMerge ossfsilver/lockfollow-sign-step into main (lane OSSF-SILVER-CODE): dwarves builds --locked against the sibling mains, on gix 0.900c10ef2e8dfalock follow + gix 0.90: dwarves builds --locked against the sibling mains again (lane OSSF-SILVER-CODE)e72404d7e426Merge dwhol/holger-3-2026-10-31 into main (lane DW-HOLGER-BUILD): dwarves is built with holger in it on every dwarves head and every six hours against holger main8a9e4749684aMerge remote-tracking branch 'origin/main' into dwhol/holger-3-2026-10-3192752393b1e2Merge heimci/heim-ci-wasi into main (lane heimci): heimdall-ci pins heim-ci with wasi-libcb0a847804a19heimdall-ci: heim-ci rebuilt from heimdall main's ci/ci.Containerfile (wasi-libc headers for the openzl guest, heimdall 03fc5a6), pinned by its new digest 5470ba85 (lane heimci)bfccd182a1deDW-HOLGER-BUILD: build:holger builds against holger's head as it is, not --locked526f0d759261lock follow: edda main 01f6d63 (nornir-git 0.2.4, russh 0.65), znippy master 99500ab (znippy-common 0.10.5) (lane DW-HOLGER-BUILD)b679975f2884Merge remote-tracking branch 'origin/main' into dwhol/holger-3-2026-10-31db4847c28ed7Merge ossfsilver/coverage-gunnar-all into main (lane OSSF-SILVER-CODE): the nightly coverage measures every crate of Gunnar's workspace7141e8d431a5GREEN: coverage-gunnar measures every crate of Gunnar's workspace (lane OSSF-SILVER-CODE)e23728ac964aRED: coverage-gunnar measures every crate of Gunnar's workspace, lean, with the container-only tests skipped (lane OSSF-SILVER-CODE)1a3e86ee0f66Merge ossfsilver/russh-065 (lane OSSF-SILVER-CODE): locks follow nornir-git 0.2.4 on russh 0.65 (the 2026-10-30 russh advisories)7706cd0e13a8lock follow: edda main 01f6d63, nornir-git 0.2.4 on russh 0.65 (lane OSSF-SILVER-CODE; GHSA-fw5c-8223-6h42, GHSA-4p9f-7p9m-5vfg, GHSA-9wfm-jcj8-jfv9, GHSA-vp5q-ff62-jwqv)22d4e22e43aadwarves-web-client: its unit test compiles again (RunReport.release_json, RELBUILD-RUNA 95d9700)cb4bc6372087DW-HOLGER-BUILD GREEN: dwarves is built with holger in it on every dwarves head and every six hours against holger mainb951104c6c3fMerge remote-tracking branch 'origin/main' into dwhol/holger-3-2026-10-31f46f5b305aabMerge t2next/holger-3-2026-10-31 into main (lane TEST2-NEXT): dwarves asks holger-server-lib 3.0 (Holger 3.0.0, d2dbf078); the lock follows. Gate (ci4, oden): cargo check --locked green63a114165dd3DW-HOLGER-BUILD RED: the quick set builds dwarves with holger in it, and the forge builds it against holger main8364d02ce996dwarves follows Holger 3.0.0 (lane TEST2-NEXT): holger-server-lib = "3.0"; the lock follows40aae9377c8fMerge ossfsilver/lockfollow-gix-090 into main (lane OSSF-SILVER-CODE, row GIX-090): locks follow edda main fa656be (gix 0.90, GHSA-q54r-jf2p-rfr2); gate on the branch: cargo check --locked --workspace --all-targets per lock, then cargo metadata --locked after merging maind3d030febcb7Merge remote-tracking branch 'origin/main' into ossfsilver/lockfollow-gix-0901d84ad00627clock follow: edda main fa656be, nornir-git 0.2.3 on gix 0.90 (lane OSSF-SILVER-CODE, row GIX-090, GHSA-q54r-jf2p-rfr2)b741f420c2cfMerge mon-ossf/forge-2026-10-31 into main (lane MON-OSSF): the forge fuzzes monetize (fuzz-monetize; fuzz-monetize-impl private, verdict-only, ci-verbs fuzz --private), measures it (coverage-monetize after build-guests), scores it (scorecard-monetize, no badge) and proposes its weekly update (deps-monetize). Gate: forge_ci_files 13/0, ci/verbs tests green + clippy -D warnings, on the merged tree