The memory-core ratchet (lint-memory-core) failed on the publication
fence commit: it added six raw free() calls, each releasing a block that
existing code allocates with raw calloc, malloc or strdup. cbm_free cannot
release such a block without the core class counters drifting, so every
new exit now reuses an existing release point instead:
- index_supervisor.c: worker_artifacts_create() creates the response, log
and publish fence files and names the one that failed, so all three
failures share the single artifact_create_failed exit.
- pipeline.c: a refused publication gate takes the existing source-changed
abort exit (same CBM_PIPELINE_ABORT_PRESERVE_DB result and cleanup).
- mcp.c: index_request_names_free() is the one release point for the
request name strings, used by index_worker_json_result() and
index_args_serving_index_servable().
Raw-site counts return to the origin/main values (index_supervisor.c 8,
pipeline.c 129, mcp.c 765) with no baseline change. No behaviour change.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Second maintainer refresh of #1561 (truthful index_status freshness),
onto main 9c19b5dd, after the fix-up that keeps the indexed checkout in
its own index_checkout table (a0d0521f). The first refresh is b44a22ca.
Five files conflicted; each is resolved as main plus the branch change:
- src/pipeline/pipeline.c and src/pipeline/pipeline_incremental.c (two
sites): main added .unresolved_calls_complete to the coverage-meta
initializers where the branch added .indexed_checkout_sha. Both fields
are kept, main first.
- src/store/store.h cbm_coverage_meta_t: main added
unresolved_calls_complete where the branch added indexed_checkout_sha.
Both fields are kept, main first.
- src/store/store.c init_schema: main added the unresolved_calls_complete
column where the branch closed index_coverage_meta and created
index_checkout. index_coverage_meta keeps main DDL exactly, and the
index_checkout table follows it.
- src/store/store.c coverage replace: main moved the coverage-meta write
out of cbm_store_coverage_replace_ex into coverage_write_metadata,
whose caller owns the transaction and rolls it back on failure. The
branch wrote or cleared the index_checkout row right after that
write, so its two calls move into the helper: the upsert path returns
index_checkout_write(s, project, meta->indexed_checkout_sha), the
delete path returns index_checkout_write(s, project, NULL).
index_checkout_write stays where the branch defined it, ahead of the
new helpers.
- tests/test_store_nodes.c: main added
store_coverage_shadow_excludes_unresolved_calls and its helper where
the branch added store_coverage_meta_indexed_checkout_sha_roundtrip_and_rollback.
Both tests are kept and registered, main first.
src/pipeline/pipeline_internal.h merged without a conflict: main raised
CBM_SEMANTIC_INDEX_VERSION to 13 for Next.js App Router routes, in a
separate hunk from the branch's cbm_pipeline_indexed_checkout_sha
declaration.
No semantic conflicts:
- The branch bumps no version. index_checkout is created by init_schema
with IF NOT EXISTS and read only when present, so main's semantic
index version 13 applies unchanged.
- The branch changes no existing function signature, and main changes
none that the branch calls.
- Every main caller of cbm_store_coverage_meta_get added since the
merge base, including the new Next.js upgrade test in test_pipeline.c,
releases the result with cbm_store_coverage_meta_clear exactly once,
which frees the checkout string. That test passes a shallow copy of
the result to cbm_store_coverage_replace_ex and never frees the copy
on its own.
No test call site needed adapting.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Removing the only Hermes pre_llm_call hook empties the hooks mapping, and
the mapping editor writes an emptied section as hooks: {} - the same
convention it uses for mcp_servers: {}. The hook sequence editor then
refused that file for both upsert and removal, because it required every
parent on the sequence path to be a block mapping header. On a config
where our hook was the only entry under hooks, install -> uninstall ->
install exited 1, and a repeated uninstall did too.
An exact empty flow mapping on a parent of the sequence path is now read
as that empty mapping, mirroring how the mapping-entry editor already
treats section: {}. Removal is a byte-identical no-op, and upsert expands
the header in place, keeping its comment, the line endings and every
other byte, so a reinstall lands back on the first install byte for
byte. The sequence key itself holding a mapping, any other flow value,
and content nested under the inline mapping stay refused. Hooks written
by the user and every foreign key are left untouched.
Found while finishing #1862: its persisted hook opt-out runs this remover
on every later install, so every Hermes user whose only hook was ours
would have hit the refusal on each install after the first.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The composition gate asserts the glibc 2.35 floor on the built bytes,
but nothing ran those bytes on a 22.04 userland before a release.
- scripts/ci/check-glibc-floor-runtime.sh (new canonical entry): runs a
linux binary in a plain container of a digest-pinned image with
nothing installed and requires --version, cli index_repository on a
tiny C and Python fixture (status indexed) and cli list_projects
(lists the fixture) to succeed. A binary built on a newer userland
fails at --version, with the loader errors in the log.
- _smoke.yml smoke-unix: a gating step runs it on every Linux leg
(amd64 and arm64, each on its own artifact) with the same
ubuntu:22.04 digest that build-linux builds in.
- test_venue_parity_contract.sh: the step must exist once on
smoke-unix, run for every Linux leg, gate (no continue-on-error) and
pin the same digest as build-linux and the PR glibc-floor leg; the
core smoke-unix matrix must hold linux amd64 and arm64; the new entry
joins the --help and strict-flag interface probes.
- scripts/ci/README.md lists the new entry.
Refs #2486
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The glibc-floor job builds the production binary in the pinned
ubuntu:22.04 release container and holds it to the release glibc floor
(2.35 / GLIBCXX 3.4.30). It ran report-only; it now gates like every
other lane.
- select-lanes.sh: new lane glibc-floor, part of the full set and
selected whenever smoke-ubuntu is (a FOLLOWS rule), i.e. whenever the
production Linux binary can change. Docs-only and tests-only changes
do not select it.
- pr.yml: the glibc-floor job runs when its own lane is selected, and
ci-ok needs it.
- require-all-green.sh: maps the glibc-floor job to its lane, so a
selected glibc-floor that fails, is skipped or cancelled, or never
runs fails ci-ok; when it is not selected it may skip.
- Contracts: the selector table and the FULL set carry the lane, and
every selector case asserts glibc-floor is selected exactly when
smoke-ubuntu is; the lane-gate contract adds green, failed, skipped,
cancelled, missing and unselected cases; the lane-wiring contract
requires the job to serve the lane, ci-ok to need it, and no
continue-on-error on it.
- scripts/ci/README.md notes the rule.
Refs #2486
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to main 9c19b5dd.
Two same-spot insertion conflicts, each resolved as the main version
of the file plus the own diff of this branch:
- src/daemon/application.c: the job struct gained watch_owners on main
and request_started_ms plus the request facts here; both kept.
- tests/test_daemon_application.c: main added the #1818
autoindex-skipped helpers where this branch added the worker resource
failure test; both kept, the test placed after the doc_candidates
test.
Everything else merged cleanly. src/main.c changed on both sides: main
(#2838) lowers the worker CPU priority inside the worker role block,
and this branch strips the publication fence flag before that block
and installs the fence after the worker role options; the hunks are
disjoint and both are kept. tests/test_pipeline.c gained the Next.js
route tests (#2747) on main and the publication gate test here, also
disjoint. No call site needed adapting: no new main code calls a
function this branch re-signed, and main re-signed none that this
branch calls.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
index_coverage_meta is one of the tables the graph digest pins column
by column, so the new indexed_checkout_sha column made the digest
reject every live store with a schema error: the live-schema
compatibility test failed, and test-impact, which digests the graph it
builds for HEAD, fell back to running every test for every change.
Record the checkout in a table of its own instead: index_checkout
(project primary key referencing projects ON DELETE CASCADE,
indexed_checkout_sha NOT NULL). A checkout is source identity, which
the graph digest deliberately does not bind, and the store already
keeps other per-project data (doc_link_*, observed_*) outside the
digested tables. index_coverage_meta keeps exactly the shape the digest
expects, so the digest needs no change and no version bump, and a new
table needs no migration of existing databases.
The row is written and cleared in the same coverage transaction, so a
failed replace keeps the previous identity, and it is removed with its
project. The store API is unchanged: cbm_coverage_meta_t carries
indexed_checkout_sha as before. Read-only opens of databases without
the table report no identity, as before.
store_graph_digest_indexed_checkout_identity_is_not_bound writes a
store through the real coverage API with and without a checkout SHA
and asserts that it still digests and that the SHA leaves the digest
unchanged.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
A worker resource limit is enforced by the supervisor, but only the worker
replaces the serving database, and it does so before the persistence
artifact export. A limit observed in that window stopped a worker that had
already published, and the response still said serving_index_preserved=true
while the previous index had been replaced.
Publication and resource termination now coordinate through a per-attempt
publication fence: a never-created path next to a reserved unique file in
the private worker directory, which both sides claim by creating it
exclusively (cbm_fopen "wbx": O_EXCL on POSIX, CREATE_NEW on Windows), so
exactly one of them can win.
- The worker claims it through a new pipeline publication gate that
cbm_pipeline_run calls once, after the last pre-publication check and
before the serving database is touched. Losing means the supervisor
already stopped the attempt for a limit: the run aborts before
publication and the previous generation stays in place.
- The supervisor claims it before it terminates the worker for a limit or
a failed RSS probe. Losing means the worker already committed to
publishing: the limit is no longer enforced for that attempt, which runs
to completion, and index.supervisor.resource_limit_after_publication is
logged instead. A claim that can be neither won nor lost is retried on
the next poll rather than risk stopping a committed worker.
- At terminal the supervisor settles the fence into
result.publication_committed. An unquiesced tree keeps the fence, so a
surviving member can never publish after the report.
serving_index_preserved now describes the request, not only its last
attempt: a servable index existed when the request began, no attempt of
the request committed to publishing (an earlier attempt can publish and
then crash into recovery), and that index is still servable. The direct
path and the daemon job both fold every attempt into these request facts;
cbm_mcp_index_worker_resource_response takes them as a third argument, and
NULL claims nothing.
The fence path travels as an optional last pair of the exact worker grammar
(--index-worker-publish-fence), accepted by the worker argv parser and by
the daemon bootstrap role check, stripped by the CLI and installed by both
worker entries.
Limits stay opt-in: without index_max_rss_mb or index_max_duration_seconds
there is no fence, no extra argv, no claim and no extra database read.
Graph content is unchanged either way.
RED (c78c077a plus only the new end-to-end test): a FIFO at the artifact
temp path holds the real worker after the rename, and the duration clock
crosses its limit only once the serving database has been replaced. The
supervisor stops the worker there and answers resource_limit_exceeded with
serving_index_preserved=true over a replaced database. GREEN: the worker
claimed first, the supervisor logs the limit as not enforced, and the
released worker finishes and reports the published index.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Built in the pinned ubuntu:22.04 container, the standard Linux binary
requires at most glibc 2.35 and GLIBCXX_3.4.30. Update the comments
that said 2.38+: install.sh, the npm and PyPI wrappers, cli.c, the
Homebrew formula, smoke-test.sh, _smoke.yml, check-glibc-compat.sh and
the local glibc-floor venue. The installers keep choosing the -portable
archive, since a 2.35 floor still excludes Debian 11, RHEL 8 and Ubuntu
20.04.
The local smoke-glibc-floor lane keeps its assertion and now says what
it proves: a binary built in the noble test image refusing to start
there shows the venue is older than the build image.
Refs #2486
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The standard (dynamic) Linux release binaries were built on the hosted
runners Ubuntu 24.04 userland, so they required GLIBC_2.38 and
GLIBCXX_3.4.32 and refused to start on Ubuntu 22.04 (#2486).
A new build-linux job in _build.yml builds linux-amd64 and linux-arm64
inside ubuntu:22.04 pinned by the digest of its multi-arch index
(sha256:076e7bf8..., resolved 2026-11-02 from Docker Hub, one pin for
both arches) with the distro toolchain (GCC 11.4 against glibc 2.35),
and declares CBM_GLIBC_FLOOR=2.35 / CBM_GLIBCXX_FLOOR=3.4.30 (what the
image provides) for the composition gate, so every release candidate is
checked. The hosted runner only hosts the container, so a runner image
retirement no longer moves the floor. build-unix keeps the two macOS
legs, the portable legs are unchanged, select-package needs the new job
and the artifact names stay the same.
pr.yml gains a report-only glibc-floor leg: the production binary built
in the same image and checked by the composition gate with the same
floor whenever the selection holds smoke-ubuntu. It is not in ci-ok
needs and has no lane, so it never blocks or passes a merge.
The venue parity contract asserts the digest pin, one shared digest for
the release and PR legs, both arches, the declared floors and that no
standard Linux leg returns to a runner userland; the assertion follows
the shape of the contract test in #2573. The release gate chain
contract lists build-linux among the native candidate producers.
Refs #2573#2486
Co-authored-by: lorenzozanee <wyz0707@proton.me>
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
check-binary-composition.sh gains A6-glibc-floor. When a venue declares
CBM_GLIBC_FLOOR (and optionally CBM_GLIBCXX_FLOOR), no GLIBC_* or
GLIBCXX_* symbol version a dynamic ELF requires may be newer than that
floor. The names come from the dynamic version tables, which the loader
checks at startup and every strip level keeps. Versions compare
numerically (2.4 is older than 2.35); GLIBC_ABI_DT_RELR counts as 2.36.
Other unnumbered names (GLIBC_PRIVATE) and a dynamic binary that
requires no GLIBC_* version at all fail closed. A static ELF passes,
Mach-O and PE report n/a, and with no floor declared A6 reports n/a, so
local builds, the local artifact smoke and contract stubs on newer
distros are unaffected. A malformed floor is a usage error (exit 2).
The release candidate derivation contract proves it on the stripped
stub candidate: floor 1.0 fails and 999.0 passes on glibc Linux, n/a on
Mach-O and PE, fail closed on a non-glibc Linux, exit 2 on a malformed
floor.
Refs #2486
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
cppcheck 2.20 (the CI version) reports shadowFunction: the local
cache_dir in cbm_mcp_ignore_worktrees_runtime_enabled() shadows the
static cache_dir() helper in mcp.c. Rename the local to store_dir; no
behavior change.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Brings the branch up to main a5b248f47. Eight files conflicted, each a
same-spot insertion where main and this branch added lines next to the
same anchor. Each resolves to the main version plus the change of this
branch:
- src/cli/cli.h, src/cli/cli.c: CBM_CONFIG_IGNORE_WORKTREES and its
CONFIG_KEYS row next to the new doc_candidates key.
- src/mcp/mcp.c: the index_worktree schema property next to the new
doc_candidates property.
- README.md, docs/CONFIGURATION.md: the ignore_worktrees line and table
row next to the rewritten auto_watch entries and the new
doc_candidates and watch_non_git rows.
- src/git/git_context.c: the env-isolation comment after the new debug
stage marker, directly above cbm_popen_git.
- src/cli/hook_augment.c: the new SubagentStart cli_hint ahead of the
parent-graph check of this branch.
- tests/test_mcp.c: both RUN_TEST blocks; main already includes
str_util.h.
Per file, the lines changed against main equal the changes of this
branch against the merge-base.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
Martin Vogel
