Repository navigation
test: separate maintenance crash preparation from sweep deadline #363
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Disposable Windows context recovery | |
| on: | |
| push: | |
| branches: | |
| - acceptance/context-recovery/** | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| source-gates: | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Require unified source gates | |
| env: | |
| HPM_COVERAGE_IO: ${{ github.sha }} | |
| HPM_COVERAGE_IO_STAGE: proxy | |
| HPM_COVERAGE_IO_VERIFY_PROXY_ONLY: '1' | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| $verificationFailed = $false | |
| try { | |
| npm run verify | |
| if ($LASTEXITCODE -ne 0) { throw 'Unified verification failed.' } | |
| } catch { | |
| $verificationFailed = $true | |
| throw | |
| } finally { | |
| node scripts/check-coverage-io-receipt.cjs | |
| if ($LASTEXITCODE -ne 0) { | |
| if ($verificationFailed) { | |
| [Console]::Error.WriteLine('Source-gate I/O receipt failed; original verification remains failed.') | |
| } else { | |
| throw 'Source-gate I/O receipt failed.' | |
| } | |
| } | |
| } | |
| npm audit --audit-level=high | |
| if ($LASTEXITCODE -ne 0) { throw 'Dependency audit failed.' } | |
| context-recovery: | |
| needs: source-gates | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| scenario: [n08, n09, n09-sending-ack, n09-finished-ack, n09-withdrawn-ack, n09-uncertain-ack, n09-sending-commit, n09-finished-commit, n09-withdrawn-commit, n09-uncertain-commit] | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Build runner-local payload and fixed review plan | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| node scripts/prepare-context-hosted-run.js $env:SCENARIO | |
| if ($LASTEXITCODE -ne 0) { throw 'Fixed payload preparation failed.' } | |
| - name: Run fixed scenario under original bounded Job | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| ./scripts/qualify-context-hosted.ps1 -Case $env:SCENARIO | |
| - name: Record bounded outcome | |
| if: always() | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| JOB_STATUS: ${{ job.status }} | |
| run: | | |
| @( | |
| 'Context scenario: ' + $env:SCENARIO + '; job result: ' + $env:JOB_STATUS | |
| 'Exact source checkout: ' + $env:GITHUB_SHA | |
| 'When their preparation stages run, payload, synthetic credentials, original evidence, DPAPI keys and certificates are generated only on this disposable runner.' | |
| 'No private local acceptance directory or old installer artifact is an input. No payload, key, database or request body is uploaded.' | |
| if ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09') { | |
| 'Passed scope: 10 cases: committed metadata, clear ACK, save ACK, revoke ACK, same-format backup rollback after revoke, interruption with the upstream public final held, prepared SQLite COMMIT pending forced-kill/positive-release controls, and prepared durable-store-before-host-ACK forced-kill/positive-release controls; forced kill and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-sending-ack') { | |
| 'Passed scope: 2 cases: sending durable-store-before-host-ACK forced-kill/positive-release controls after the exact prepared predecessor; fixed budget, expiry and two-version durable advance, zero public bytes at kill and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-finished-ack') { | |
| 'Passed scope: 2 cases: transport-finished durable-store-before-host-ACK forced-kill/positive-release controls after exact prepared and sending predecessor ACKs; complete public wire observed separately from final publication completion, exact three-version durable advance and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-withdrawn-ack') { | |
| 'Passed scope: 2 cases: withdrawn durable-store-before-host-ACK forced-kill/cleanup-release controls after exact prepared predecessor ACK and actual client transport closure; zero public bytes, exact two-version advance, fixed budget/expiry and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-uncertain-ack') { | |
| 'Passed scope: 2 cases: uncertain durable-store-before-host-ACK forced-kill/cleanup-release controls after exact prepared and sending predecessor ACKs and actual client transport closure; zero public bytes, exact three-version advance, fixed budget/expiry and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-sending-commit') { | |
| 'Passed scope: 2 cases: sending COMMIT pending forced-kill/release controls after real predecessor ACKs and a held reader; exact pending target, original budget/expiry, public transport or cancellation witness as applicable, cleanup and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-finished-commit') { | |
| 'Passed scope: 2 cases: transport-finished COMMIT pending forced-kill/release controls after real predecessor ACKs and a held reader; exact pending target, original budget/expiry, public transport or cancellation witness as applicable, cleanup and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-withdrawn-commit') { | |
| 'Passed scope: 2 cases: withdrawn COMMIT pending forced-kill/release controls after real predecessor ACKs and a held reader; exact pending target, original budget/expiry, public transport or cancellation witness as applicable, cleanup and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-uncertain-commit') { | |
| 'Passed scope: 2 cases: uncertain COMMIT pending forced-kill/release controls after real predecessor ACKs and a held reader; exact pending target, original budget/expiry, public transport or cancellation witness as applicable, cleanup and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n08') { | |
| 'Passed scope: six mutation/hold cases with business-output and authenticated committed-state checks under the original bounded Job.' | |
| } | |
| if ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09') { | |
| 'Not qualified: other publication COMMIT interiors (sending, transport-finished, uncertain, withdrawn), other daemon durable-ACK interiors (sending, transport-finished, uncertain, withdrawn), historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-sending-ack') { | |
| 'Not qualified: publication COMMIT interiors, other daemon durable-ACK interiors (prepared, transport-finished, uncertain, withdrawn), historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09-finished-ack') { | |
| 'Not qualified: publication COMMIT interiors, other daemon durable-ACK interiors (prepared, sending, uncertain, withdrawn), historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -cin @('n09-withdrawn-ack', 'n09-uncertain-ack')) { | |
| 'Not qualified: publication COMMIT interiors, other daemon durable-ACK interiors, historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -cin @('n09-sending-commit', 'n09-finished-commit', 'n09-withdrawn-commit', 'n09-uncertain-commit')) { | |
| 'Not qualified: other publication COMMIT interiors, independent native OS-anchor interiors, five-second stability, historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } else { | |
| 'Not qualified: commit/publication in progress, historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| } | |
| ) >> $env:GITHUB_STEP_SUMMARY | |
| egress-diagnostic: | |
| runs-on: windows-latest | |
| timeout-minutes: 5 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| - name: Diagnose fixed egress rule expressions without launching payload | |
| run: ./scripts/context-hosted/shared/egress-rule-diagnostic.ps1 |