8.6 KiB
Windows contextual prerelease preparation — 2026-09-11
Owner: Codex-9e8r6t /root/release_audit. Root reserved v0.2.0-preview.contextual.20260911 in Gitea issue 2 comment 383; preparation ownership is comment 386. Root owns clean GUI/server acceptance and release/tag/assets. Linux remains user-paused. This report distinguishes source preparation, package integrity and later runtime acceptance.
Frozen source and artifacts
The new isolated worktree is .local/contextual-prerelease-20260911/source, branch codex/contextual-prerelease-source-20260911, reconstruction commit d5650309a93f3d590a41f8a8f0322c6500568f69. It derives from verified checkpoint b2c3e54001fc19a05423bcd5808ceea78d13ff59. It records exact input bytes; it is not claimed as the historical compiler invocation's original commit.
Eleven newline-only inputs were copied byte-for-byte from the verified GUI5657 freeze, with exact-path -text rules added only inside this worktree. creation.rs has mixed newlines; no uniform conversion was substituted. The other ten restorations are scenario/workspace.rs, topology/contextual.rs, guide.rs, six semantic_review files and docs/openapi.json, as enumerated in preparation.json. The main source and .gitattributes were untouched.
Preparation passed at 16:12:24 UTC: all 238 GUI inputs, 120 core/server files, both complete crate file sets, and five shared non-Cargo inputs matched; committed Git bytes and a separate fresh checkout-index matched the same union. Original main HEAD, index hash and tracked status were unchanged at preparation completion. Root subsequently released main-source work; later main edits do not change this frozen package input snapshot.
Private bin/ input |
Bytes | SHA256 |
|---|---|---|
arcadia-studio.exe |
112,239,104 | 5657bab5c841939b66f901efe6c0ffb2d7cbbe8cc5f111a0ca3de8073d3846ce |
arcadia-server.exe |
39,743,488 | efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665 |
libunwind.dll |
190,976 | f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4 |
Copies were verified against immutable originals before and after copying. GUI5657's original build/input records and later full 679/679 result are retained separately from EFEE's September 7 build/hash/source records. Reusing EFEE is supported by the preceding read-only input audit: unchanged core/server/shared inputs, only the separate local CLI workspace/lock addition, and matching dependency bytes. No new server build or runtime test was performed by this producer. Both binaries retain their documented development profile; no optimized or reproducible-build claim is made.
Exact preparation evidence
The following paths are under .local/contextual-prerelease-20260911/:
| Record | SHA256 |
|---|---|
preparation.json |
01076682a763fca6c6941422b54fed02f1b7f2483c550c51a936b5bdfdbac594 |
committed-roundtrip.json |
2f687aa82fa066594dfc6ec82aa2aaafdbea01912305c1a052ef11fb8ba6eb3e |
build-evidence.json |
16d1ab0df520cd7bb80e2bad89a066b47d4de366929b96a828405a1971d957ec |
evidence-manifest.json |
4d9e047a3f23664421db0404cd25ccad870067b5021b617ef4137cacdef4bdab |
prepare.py, prepare.log and prepare-result.json preserve the executed procedure/result. evidence/ contains exact whitelist copies of original GUI build/inputs/gates, the full-test result, original server gates/hash/source tar, prior source comparisons/notices and the update audit. The manifest maps original paths and hashes. Build-evidence per-binary references explicitly refer to this separately retained preparation evidence, not nonexistent files inside the ZIP. The packager checks target and binary hashes; its provenance prose remains a caller assertion backed by these records.
Packaging execution history
The first package.ps1 timing wrapper failed at 16:13:58 UTC before invoking Cargo: the nested production script could not see the wrapper's script-scoped metadata counter. Original package.log and package-result.json record success: false, metadata_calls: 0. No package directory, output claim, download or compiler operation existed from that attempt. This was an isolated orchestration error, not a strict-notice or application failure.
The corrected, separately retained package2.ps1 uses an explicitly named process-local state object. It admits exactly the unchanged packager's single cargo metadata --locked --offline --manifest-path <isolated-source>/Cargo.toml --filter-platform x86_64-pc-windows-gnullvm --format-version 1 call and preserves its original JSON stdout. metadata2-result.json records exit 0, 16:15:17.599–16:15:39.194 UTC. The Cargo lease was explicitly released at that terminal boundary; subsequent notice hashing, read-only compiler/sysroot inventory and ZIP work use the frozen source. No Cargo compilation or download was authorized or executed.
The production scripts/package-windows.ps1, shared helpers, notice collector and supplement policy are unchanged. Invocation uses explicit gnullvm target, version 0.2.0-preview.contextual.20260911, private bin/, verified LLVM-MinGW distribution, new build evidence and the bundled Python executable. Output is fresh under packages/; prior authoring/CLI releases and their evidence are preserved.
Terminal package and producer readback
Package PASS, 16:18:45.622 UTC, 219.970 seconds; package2-result.json records success: true and exactly one actual metadata call. The packager retained its NativeAcceptance: Pending result. No output was overwritten.
| Fresh deliverable / record | Bytes | SHA256 |
|---|---|---|
packages/ArcadiaStudio-0.2.0-preview.contextual.20260911-x86_64-pc-windows-gnullvm.zip |
32,775,691 | 9186d4fc9a7b52fb195c183c4847c8e3419ea6da8b3f907e0c06f9ceec58dee0 |
Companion .zip.sha256 |
144 | 21455af55f6330235a72f43f09bd155acaea0d647bd3f68f09a64d06a21fdbcc |
package-readback.json |
99,379 | af8fcc11f1ad863df0861ac248a48391f635bdeef484978b0b9c4732a6593268 |
Staged dependency-notices.json |
1,619,822 | f318f87e6a23dcfac16ef7b1cfe51ecb804e98e1ff6a97271180319d5922fc0e |
Staged SHA256SUMS.txt |
66,376 | 04e4be3f6a081e11ccad8609643031d91fed82cd08e7c7821002ff9b9a04e454 |
The archive has 559 files with unique case-insensitive names, deterministic 2000-01-01 timestamps and exactly matching stage bytes. SHA256SUMS.txt covers the other 558 entries. Fresh strict notices cover 266 packages, rooted only in desktop/server, and package-local documentation checks 17 local links. readback.py/readback.log additionally verify the complete ZIP/stage/checksum-map identity, recorded ordinary PE imports, and unchanged 238 GUI / 120 server / five shared source inputs after packaging; the isolated worktree remains clean. This is producer integrity evidence, not a runtime launch.
delivery-manifest.json maps the 26 exact execution, provenance, package and status paths, SHA256 9b48aa787d0cc2026b411c5c8a7a1ef97cb84eda06c3e06cc0dd3cd0cf373867. It includes the initial wrapper failure as well as the terminal successful attempt. Original records and the zero-byte output claim are retained. No binaries were copied into harness by this preparation.
Source publication and handoff
After package success, root separately authorized publishing only the exact reconstruction branch. The new push-source.py adapted the existing authenticated helper without changing it. It verified the local branch/commit and remote endpoint, required ancestry if a remote branch existed, and used a nonforce single-ref push. The branch was previously absent. Remote readback at 16:19:51.525 UTC is exactly d5650309a93f3d590a41f8a8f0322c6500568f69 on codex/contextual-prerelease-source-20260911. source-push-result.json SHA256 is b98699bac76974d644179565163049259c195c9ca7c4c7fadd92c27f2ada4bea.
Existing MCP credentials were used only in process memory/environment under the user's prior authorization; no token was printed, persisted or placed in a URL. No other branch, tag, release or asset was published by this worker.
Independent reviewer received the frozen ZIP/source/evidence and owns its fresh extraction/server checks; root owns GUI acceptance and final release notes/assets. Reviewer reported its separate artifact gate passed at 16:21:22 UTC, 5,231 checks; that is attributed to the reviewer, not rerun here. Its packaged-server/runtime results remain separate. No producer application launch, WSL action, compilation, download or release/tag/asset operation occurred. All owned preparation/package/readback/push processes are terminal and the metadata lease is released.