Skip to content

feat(shim): #260 S4 — finalise pins.js for v0.1.0 (partial), bump shim 0.1.1 - #291

Merged
hyperpolymath merged 1 commit into
mainfrom
int10-282-pins-finalize
May 20, 2026
Merged

feat(shim): #260 S4 — finalise pins.js for v0.1.0 (partial), bump shim 0.1.1#291
hyperpolymath merged 1 commit into
mainfrom
int10-282-pins-finalize

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Summary

  • Fills packages/affinescript-cli/pins.js with the real sha256 for the two v0.1.0 binaries that the Release workflow actually produced (linux-x64, macos-arm64); macos-x64 stays fail-closed (empty sha256 ⇒ resolveCompiler refuses), per the rule at the top of pins.js. SHAs were computed directly from the published binaries because the canonical SHA256SUMS manifest isn't on the Release yet — release.yml's checksums job needs all three matrix legs to succeed, and macos-13 has been queued in the runner pool since 2026-05-19T22:25Z (estate CI concurrency-pool exhaustion).
  • Bumps @hyperpolymath/affinescript 0.1.0 → 0.1.1 in lockstep (pins.js header rule), and tracks it on the LSP side via SHIM_SPEC = "jsr:@hyperpolymath/affinescript@0.1.1". This finally activates the INT-10 wiring merged in INT-10: affinescript-lsp resolves compiler via the ADR-019 shim (#260 S4) #287 (which was code-complete but inert — the LSP could not actually exec a shim-fetched binary while every sha256 in pins was "").
  • Not Closes #282 — owner explicitly reopened INT-10: affinescript-lsp distribution (consume the ADR-019 compiler shim) #282 gating it on the v0.1.0 Release producing assets, and macos-x64 is still owed. A follow-up release fills the last pin.

Verification

  • deno test --allow-read --allow-write --allow-env --allow-run mod_test.js in packages/affinescript-cli: 6/6 green (network-free fake-binary tests still pass after the pins change).
  • cargo test in tools/affinescript-lsp: 26/26 green (including compiler::tests::* after the SHIM_SPEC bump).
  • Real end-to-end smoke on this host (linux-x64) against the live v0.1.0 Release:
    resolved: /tmp/affs-cache/affinescript/v0.1.0/affinescript-linux-x64
    exit: 0
    stdout: 0.1.0
    
    i.e. resolveCompiler() downloaded affinescript-linux-x64, SHA256-verified it against the new pin, cached, execed --version. macOS arm64 not smoked from this host but the same pin path is exercised by the shim tests.

Test plan

  • deno test (packages/affinescript-cli) green
  • cargo test (tools/affinescript-lsp) green
  • Real fetch+verify+exec smoke against the v0.1.0 Release (linux-x64)
  • Reviewer to optionally repeat the smoke on a darwin/arm64 host
  • After macos-x64 build clears CI: cut a follow-up tag, let release.yml write the full SHA256SUMS, fill the macos-x64 pin, bump shim 0.1.1 → 0.1.2, close INT-10: affinescript-lsp distribution (consume the ADR-019 compiler shim) #282

Refs #282, #260, #181. ADR-019 in docs/specs/SETTLED-DECISIONS.adoc.

🤖 Generated with Claude Code

…m 0.1.1

Closes the INT-10 wiring gap on #282: the LSP code path that resolves
the compiler via `jsr:@hyperpolymath/affinescript@<pin>` (#287) was
inert until pins.js had real sha256 values.  Fills the two binaries
that the v0.1.0 Release workflow (run 26124042846) produced before the
macos-13 leg stalled in the runner queue:

- linux-x64:    c1ce65308bace96669d2a178732cd5ee180845d85a5775e119a221b98fe2a5da
- macos-arm64:  2cac3ba54ae7778d31d1bd780d11b56a5cf78b5d5ee6c1d33edd3f8e753943d5

`macos-x64` stays fail-closed (empty sha256 ⇒ `resolveCompiler` refuses)
per the rule documented at the top of pins.js — an unpinned binary is
never executed.  A follow-up release will fill it once the macos-13
build clears CI.  SHAs were computed from binaries downloaded directly
off the v0.1.0 Release (the canonical SHA256SUMS manifest only gets
written by release.yml's `checksums` job after all three matrix legs
succeed, so it does not yet exist on this Release).

Bumps `@hyperpolymath/affinescript` 0.1.0 → 0.1.1 in lockstep
(pins.js header rule), and tracks it in the LSP via
`SHIM_SPEC = "jsr:@hyperpolymath/affinescript@0.1.1"`.

Verification
- `deno test` (packages/affinescript-cli): 6/6 green
- `cargo test` (tools/affinescript-lsp): 26/26 green
- Real end-to-end smoke (off the v0.1.0 Release, host = linux-x64):
  `resolveCompiler()` downloaded `affinescript-linux-x64`,
  checksum-verified against the new pin, cached, and execed
  `--version` → `0.1.0` (exit 0).

Refs #282, #260, #181.  ADR-019 in docs/specs/SETTLED-DECISIONS.adoc.
Not `Closes #282` — owner-gated on the macos-x64 leg landing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

🔍 Hypatia Security Scan

Findings: 47 issues detected

Severity Count
🔴 Critical 12
🟠 High 21
🟡 Medium 14

⚠️ Action Required: Critical security issues found!

View findings
[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

@hyperpolymath

Copy link
Copy Markdown
Owner Author

Uploaded a partial SHA256SUMS (linux-x64 + macos-arm64) to the v0.1.0 Release — built with sha256sum … | sort -k2 exactly per release.yml's checksums job, so it's wire-compatible with what that job will eventually emit. Round-trip verified by re-downloading the binaries and running sha256sum -c against the uploaded manifest (both OK).

This preserves the ADR-019 contract that every Release ships a SHA256SUMS alongside the binaries — the file just doesn't yet list macos-x64. When the macos-13 leg clears CI, release.yml's checksums job runs with gh release upload … --clobber and replaces this partial manifest with the full one in one shot, no manual cleanup needed.

@hyperpolymath
hyperpolymath merged commit 06621a8 into main May 20, 2026
15 of 16 checks passed
@hyperpolymath
hyperpolymath deleted the int10-282-pins-finalize branch May 20, 2026 06:16
@hyperpolymath

Copy link
Copy Markdown
Owner Author

Triage on the one red check (governance / Language / package anti-pattern policy): baseline rot, not a PR defect. It flags 4 pre-existing .res files (affinescriptiser/examples/SafeDOMExample.res, examples/SafeDOMExample.res, packages/affine-res/src/AffineScript.res, packages/affine-res/src/AffineScriptValue.res) that are tracked on main and untouched here. Same workflow is red on main's latest run (26126744276) for the same reason. build + lint both green; all other governance/Hypatia/Semgrep/CodeQL green. Per the estate "cross-check red checks vs main" policy this one is not a merge blocker for #291.

@hyperpolymath

Copy link
Copy Markdown
Owner Author

Correction on the framing in this PR's commit message and description: the root cause of the queued macos-x64 leg isn't estate CI concurrency-pool exhaustion — it's that the macos-13 GitHub-hosted runner image was fully retired on 2025-12-04 (actions/runner-images#13046, #13402, #13634). The job was queued against a runner that no longer exists; it was never going to run. I cancelled the v0.1.0 release run (26124042846).

The release.yml fix is in #292 (macos-13macos-15-intel). Once that lands and a follow-up tag is cut, release.yml will produce the missing macos-x64 binary + a complete SHA256SUMS, and the next shim release can fill the last pin and close #282 for real.

This PR's content (filled pins for linux-x64 + macos-arm64, shim 0.1.1 bump) is unaffected — those two pins are correct and the partial SHA256SUMS I uploaded to v0.1.0 will be clobbered by the next release.yml run.

hyperpolymath added a commit that referenced this pull request May 20, 2026
The macos-13 GitHub-hosted image was deprecated 2025-09-22 and **fully
unsupported from 2025-12-04** (actions/runner-images#13046, #13402,
#13634). Any matrix entry pinning `os: macos-13` now queues forever
against a runner that does not exist — observed on the v0.1.0 release
run (26124042846): linux-x64 + macos-arm64 finished in minutes; the
macos-x64 leg sat queued ~10 h before I cancelled it. The
`checksums` job (`needs: build`) never ran, so no SHA256SUMS landed
on the Release, leaving INT-10 (#282) stuck.

`macos-15-intel` is the current Intel macOS x64 standard runner
(per actions/runner-images README, alongside `macos-15-large`,
`macos-latest-large`, `macos-26-intel`). macOS 15 is the safer of the
two: stable GA image, in contrast to macos-26 which only graduated
out of public beta in 2026-02 and had an arm-label regression as
recently as actions/runner-images#14112 (closed 2026-05-19).

No other change. Target name (`macos-x64`) and asset-name contract
(`affinescript-macos-x64`, ADR-019) are unchanged — only the build
host is swapped. Effect: the next `v*` tag push (or a `workflow_dispatch`
escape hatch if added later) will produce the missing macos-x64 binary
+ a complete SHA256SUMS, which the follow-up shim release can pin.

Refs #282, #260. Unblocks #291.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request May 20, 2026
…age (#293)

Removes the ReScript baseline rot that's been failing the
governance / Language / package anti-pattern policy check on every PR:

- packages/affine-res/{README.adoc,rescript.json,src/AffineScript.res,
  AffineScript.resi,AffineScriptValue.res} — orphan ReScript bindings
  package. The whole directory goes because the .res sources are the
  only thing it contains; the README + rescript.json + .resi cannot
  function without them.  Same precedent as packages/affine-ts/
  (removed 2026-05-11, issue #66 closed won't-do): non-AffineScript
  consumer-binding packages aren't first-class in the AffineScript
  repo — TS callers were told to use @hyperpolymath/affine-js
  directly, ReScript callers should do likewise.
- affinescriptiser/examples/SafeDOMExample.res and
  examples/SafeDOMExample.res — duplicate ReScript example.  No
  ReScript-equivalent in the AffineScript stdlib examples bench was
  rebuilt; the equivalent live .affine examples (e.g.
  examples/effects.affine, ownership.affine) cover the same ground.

No other tracked code references `affine-res`, `AffineRes`, or these
example paths (verified via repo-wide grep across .yml/.adoc/.json/
.toml/.affine/.ml/.mli/.rs/.sh/Justfile).  The historical roadmap
status doc docs/reports/AFFINESCRIPT-ROADMAP-STATUS-2026-04-13.md
mentions affine-res as a 2026-04-13 snapshot checkbox; left intact as
history.

Effect: `find . -name '*.res' | grep -v node_modules` returns empty,
which is exactly what the governance script asserts.  No regressions
in the build (these files were never linked into dune / Cargo / the
CLI).

Refs the cross-PR triage on #291, #292 where the same failing check
was diagnosed as baseline rot.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath added a commit that referenced this pull request May 20, 2026
…JSR publish (#303)

INT-04 and INT-10 were both marked DONE in TECH-DEBT, but the wording
predated the actual JSR publish:

  - INT-04 line said "JSR publish authorised + dispatched (owner go
    2026-05-19)" — speculative; the real first-time publish landed
    2026-05-20 (six dispatched runs through the scope/package/trusted-
    publisher/SPDX-licence/.d.ts/cross-runtime gates).
  - INT-10 said DONE but didn't note the LSP's shim-resolution path
    only became *executable* after today's publish (code was correct
    but inert against a 404 JSR URL).

Updates
- docs/TECH-DEBT.adoc — INT-04 + INT-10 lines reflect the live publish,
  with explicit note that @hyperpolymath/affine-js + affinescript-tea
  remain dry-run-OK / not-yet-dispatched.
- docs/PACKAGING.adoc — JSR-publishable table now has 3 rows with a
  Status column; @hyperpolymath/affinescript row records the LIVE
  0.1.2 (2026-05-20) state, cross-runtime carve-out, MPL-2.0 licence
  pointer.  New "First-time JSR publish gotchas" subsection captures
  the five gates that fail one at a time (scope claim, package create,
  trusted GH repo link, SPDX licence, sibling .d.ts + triple-slash
  reference) — dry-run misses gates 2 + 3 so they cost a round-trip.
- .machine_readable/6a2/STATE.a2ml — new session-note-2026-05-20
  following the existing `session-note-YYYY-MM-DD = "…"` convention,
  capturing every landed PR (#291/#292/#293/#294/#295/#298/#299) and
  the estate macos-13 sweep (casket-ssg#8, proven#29, repos-monorepo#9),
  plus the open follow-up tickets (#297/#300, #301, #302).  This file
  is the STATE.a2ml mirror, not the lead; TECH-DEBT.adoc is the spine.

No code change.  TECH-DEBT update protocol calls for ledger + STATE
mirror in lockstep; PACKAGING is the human-facing companion.  Memory
entries (`reference_macos_13_runner_retired`,
`reference_estate_gitbot_auto_closes_on_refs`,
`reference_estate_mirror_state_2026_05_20`,
`reference_jsr_publish_recipe`) live in `~/.claude/projects/.../memory/`
and are out of repo scope.

Refs #282 (closed), #301, #302, #297, #300.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant