J251: repair Nix vendoring collision for GotaTun

kayg commented

2026-11-05 16:41:51 +00:00

Owner

Request: unblock deploy builds by eliminating crates.io/Git gotatun 0.10.2 vendor collision (#305 comment 80130). Start: branch nix-vendor-gotatun-j251, base origin/dev 19737d86d. Plan: reproduce clean compute01 build; use pinned fork on both platforms under D352 after Mac compilation; add cheap vendoring regression row; fresh Nix build and SHA256SUMS; verify quick then fast; commit and push own branch, never merge. Estimate 60 minutes execution plus shared build queues. Evidence: ~/j251-evidence on compute01. Both Linux VMs currently busy.

Request: unblock deploy builds by eliminating crates.io/Git gotatun 0.10.2 vendor collision (#305 comment 80130). Start: branch nix-vendor-gotatun-j251, base origin/dev 19737d86d. Plan: reproduce clean compute01 build; use pinned fork on both platforms under D352 after Mac compilation; add cheap vendoring regression row; fresh Nix build and SHA256SUMS; verify quick then fast; commit and push own branch, never merge. Estimate 60 minutes execution plus shared build queues. Evidence: ~/j251-evidence on compute01. Both Linux VMs currently busy.

kayg commented

2026-11-05 16:44:06 +00:00

Author

Owner

Finding: clean origin/dev 19737d86d fails derivation evaluation with No hash was found while vendoring the git dependency gotatun-0.10.2. Evidence: compute01 ~/j251-evidence/repro-eval.log. Regression check also fails on the duplicate vendor directory: ~/j251-evidence/regression-red.log. Fix uses the pinned fork on both platforms (D352), pins its Nix source hash, and preserves importCargoLock Git source replacements. Full reproduction still queued.

Finding: clean origin/dev 19737d86d fails derivation evaluation with `No hash was found while vendoring the git dependency gotatun-0.10.2.` Evidence: compute01 ~/j251-evidence/repro-eval.log. Regression check also fails on the duplicate vendor directory: ~/j251-evidence/regression-red.log. Fix uses the pinned fork on both platforms (D352), pins its Nix source hash, and preserves importCargoLock Git source replacements. Full reproduction still queued.

kayg commented

2026-11-05 16:45:15 +00:00

Author

Owner

Checkpoint: pushed WIP head 379d00f69 on nix-vendor-gotatun-j251. Regression red: ~/j251-evidence/regression-red.log on compute01 rejects duplicate gotatun-0.10.2 sources. Green: ~/j251-evidence/regression-green.log reports unique vendor names and successfully evaluates cargoDeps.drvPath. Nix full build and clean-base reproduction are in compute01 queue; quick then fast queued on dev-02 using ~/worktrees/j251/target. Mac compilation is waiting in the foreground under lockf -k /tmp/mac-bench.lock. Fix retains ring and exact fork revision; no foundation choice or numbered decision changed.

Checkpoint: pushed WIP head 379d00f69 on nix-vendor-gotatun-j251. Regression red: ~/j251-evidence/regression-red.log on compute01 rejects duplicate gotatun-0.10.2 sources. Green: ~/j251-evidence/regression-green.log reports unique vendor names and successfully evaluates cargoDeps.drvPath. Nix full build and clean-base reproduction are in compute01 queue; quick then fast queued on dev-02 using ~/worktrees/j251/target. Mac compilation is waiting in the foreground under lockf -k /tmp/mac-bench.lock. Fix retains ring and exact fork revision; no foundation choice or numbered decision changed.

kayg commented

2026-11-05 16:52:35 +00:00

Author

Owner

Mac evidence: lockf -k /tmp/mac-bench.lock ... nix develop -c cargo check --locked -p infraternal-plugin-mesh --no-default-features --features agent completed MAC_CHECK_EXIT=0. It compiled gotatun from the pinned Git revision and the macOS mesh node. One dead-code warning: DEFAULT_DNS_SUFFIX in dns_suffix.rs:161. Artifact: lume@infraternal-macos-01-std.vpn.kayg.org:~/j251-evidence/mac-check.log; control-host copy ~/.cache/codex-scratch/j251/evidence/mac-check.log. Nix reproduction/build and Linux gates remain queued; no full-build success claim yet.

Mac evidence: `lockf -k /tmp/mac-bench.lock ... nix develop -c cargo check --locked -p infraternal-plugin-mesh --no-default-features --features agent` completed MAC_CHECK_EXIT=0. It compiled gotatun from the pinned Git revision and the macOS mesh node. One dead-code warning: DEFAULT_DNS_SUFFIX in dns_suffix.rs:161. Artifact: lume@infraternal-macos-01-std.vpn.kayg.org:~/j251-evidence/mac-check.log; control-host copy ~/.cache/codex-scratch/j251/evidence/mac-check.log. Nix reproduction/build and Linux gates remain queued; no full-build success claim yet.

kayg commented

2026-11-05 16:52:57 +00:00

Author

Owner

Queue update: the clean-base error occurs during evaluation, so nix build .#packages.x86_64-linux.default --dry-run reproduces it without compiling. Stopped the redundant queued full-base build to free its queue entry; real fixed build remains queued through build-slot. Artifacts: compute01 ~/j251-evidence/repro-dry-run.log and repro-status.txt (clean checkout). Correction to Mac warning path: crates/plugins/mesh/src/dataplane.rs:161, DEFAULT_DNS_SUFFIX.

Queue update: the clean-base error occurs during evaluation, so `nix build .#packages.x86_64-linux.default --dry-run` reproduces it without compiling. Stopped the redundant queued full-base build to free its queue entry; real fixed build remains queued through build-slot. Artifacts: compute01 ~/j251-evidence/repro-dry-run.log and repro-status.txt (clean checkout). Correction to Mac warning path: crates/plugins/mesh/src/dataplane.rs:161, DEFAULT_DNS_SUFFIX.

kayg commented

2026-11-05 16:53:46 +00:00

Author

Owner

Regression gate compatibility: .forgejo/workflows/ci.yml runs native Rust in node:22-bookworm without Nix. The new row therefore always enforces unique vendor directory names, and evaluates cargoDeps.drvPath when nix is present; native CI prints an explicit evaluation SKIP. This preserves native CI while checking Git output hashes on the Nix build hosts. Exact requested base command also reproduced the evaluation failure with REPRO_EXIT=1, retained at compute01 ~/j251-evidence/repro-exact.log; no build work occurred because evaluation failed.

kayg commented

2026-11-05 17:01:05 +00:00

Author

Owner

J251 evidence checkpoint, branch nix-vendor-gotatun-j251, head 54a1bf648f. Attached: clean-base evaluation failure, failing vendor collision regression, passing Nix derivation evaluation, and passing macOS mesh compilation with pinned fork. Full Nix build and quick/fast gates remain queued. Choice: one pinned fork source under D352, preserving ring (D289), instead of changing package versions or maintaining custom source-separated vendoring.

J251 evidence checkpoint, branch nix-vendor-gotatun-j251, head 54a1bf648fea41b94741acc41d773c81d5aecc4a. Attached: clean-base evaluation failure, failing vendor collision regression, passing Nix derivation evaluation, and passing macOS mesh compilation with pinned fork. Full Nix build and quick/fast gates remain queued. Choice: one pinned fork source under D352, preserving ring (D289), instead of changing package versions or maintaining custom source-separated vendoring.

repro-eval.log

1.1 KiB

regression-red.log

220 B

regression-green.log

205 B

mac-check.log

6.5 KiB

kayg commented

2026-11-05 17:07:06 +00:00

Author

Owner

Build started on compute01 from clean tracked checkpoint 54a1bf648f. Nix vendoring completed successfully and the sandboxed static release is compiling offline. Artifact: ~/j251-evidence/build.log. Direct Git checkout hash also matches the pinned source hash: ~/j251-evidence/fork-git-hash.txt. quick/fast remain queued on dev-02. No full-build or checksum success claimed yet.

Build started on compute01 from clean tracked checkpoint 54a1bf648fea41b94741acc41d773c81d5aecc4a. Nix vendoring completed successfully and the sandboxed static release is compiling offline. Artifact: ~/j251-evidence/build.log. Direct Git checkout hash also matches the pinned source hash: ~/j251-evidence/fork-git-hash.txt. quick/fast remain queued on dev-02. No full-build or checksum success claimed yet.

kayg commented

2026-11-05 17:16:14 +00:00

Author

Owner

Capacity wait: quick/fast have been queued on dev-02 for about 30 minutes; both slots remain occupied. Snapshot: dev-02 ~/j251-evidence/queue-snapshot.log. compute01 Nix release build is active and has compiled the application/mesh dependency graph; no error yet, final linking/bundle still pending in ~/j251-evidence/build.log. Checkpoint remains pushed at 54a1bf648f. Required gates and checksums are not yet complete.

Capacity wait: quick/fast have been queued on dev-02 for about 30 minutes; both slots remain occupied. Snapshot: dev-02 ~/j251-evidence/queue-snapshot.log. compute01 Nix release build is active and has compiled the application/mesh dependency graph; no error yet, final linking/bundle still pending in ~/j251-evidence/build.log. Checkpoint remains pushed at 54a1bf648fea41b94741acc41d773c81d5aecc4a. Required gates and checksums are not yet complete.

kayg commented

2026-11-05 17:42:59 +00:00

Author

Owner

Real release proof succeeded from clean worktree ~/worktrees/j251, head 54a1bf648f on compute01: nix build .#packages.x86_64-linux.default -L --cores 4 --max-jobs 1 returned FIX_BUILD_EXIT=0. Output /nix/store/z8k7ijsqiw2cs9vdkx5j88m4c17rzzk5-infraternal-0.1.0, SOURCE matches the tested head. cd result/share/infraternal && sha256sum -c SHA256SUMS verified all 539 entries, CHECKSUM_EXIT=0. Vendor output contains one gotatun-0.10.2 plus generated Git replacement configuration. Evidence: compute01 ~/j251-evidence/build.log, checksums.log, SHA256SUMS, output-provenance.log, vendor-output.log, binary-sizes.log; copies under control-host ~/.cache/codex-scratch/j251/evidence/. Server (desktop-enabled bundle) is 25,281,776 B; host payloads x86_64 11,237,792 B and aarch64 10,466,104 B; session payloads 2,175,536 B / 1,909,152 B. quick/fast remain queued on dev-02; no gate success claimed.

Real release proof succeeded from clean worktree ~/worktrees/j251, head 54a1bf648fea41b94741acc41d773c81d5aecc4a on compute01: `nix build .#packages.x86_64-linux.default -L --cores 4 --max-jobs 1` returned FIX_BUILD_EXIT=0. Output /nix/store/z8k7ijsqiw2cs9vdkx5j88m4c17rzzk5-infraternal-0.1.0, SOURCE matches the tested head. `cd result/share/infraternal && sha256sum -c SHA256SUMS` verified all 539 entries, CHECKSUM_EXIT=0. Vendor output contains one gotatun-0.10.2 plus generated Git replacement configuration. Evidence: compute01 ~/j251-evidence/build.log, checksums.log, SHA256SUMS, output-provenance.log, vendor-output.log, binary-sizes.log; copies under control-host ~/.cache/codex-scratch/j251/evidence/. Server (desktop-enabled bundle) is 25,281,776 B; host payloads x86_64 11,237,792 B and aarch64 10,466,104 B; session payloads 2,175,536 B / 1,909,152 B. quick/fast remain queued on dev-02; no gate success claimed.

kayg commented

2026-11-05 17:43:41 +00:00

Author

Owner

J251 clean Nix release receipts, tested head 54a1bf648f. Exact clean-base failure attached too.

FIX_BUILD_EXIT=0
CHECKSUM_EXIT=0
539 SHA256SUMS

Output: /nix/store/z8k7ijsqiw2cs9vdkx5j88m4c17rzzk5-infraternal-0.1.0. All 539 checksum entries verified. quick/fast remain queued; this is release proof, not a final gate claim.

J251 clean Nix release receipts, tested head 54a1bf648fea41b94741acc41d773c81d5aecc4a. Exact clean-base failure attached too. ```text FIX_BUILD_EXIT=0 CHECKSUM_EXIT=0 539 SHA256SUMS ``` Output: /nix/store/z8k7ijsqiw2cs9vdkx5j88m4c17rzzk5-infraternal-0.1.0. All 539 checksum entries verified. quick/fast remain queued; this is release proof, not a final gate claim.

repro-exact.log

1.1 KiB

build.log

89 KiB

checksums.log

16 KiB

SHA256SUMS.txt

48 KiB

output-provenance.log

150 B

vendor-output.log

455 B

binary-sizes.log

199 B

kayg commented

2026-11-05 17:47:39 +00:00

Author

Owner

Capacity routing update: stopped J251’s queued dev-02 gate before it ran (J251_QUEUED_GATE_CANCELLED). It had waited almost an hour without a slot release; compute01 has been releasing slots continuously. Queued quick then fast there, through build-slot, one target at ~/worktrees/j251/target, CARGO_BUILD_JOBS=4. Runner stops on a failed quick pre-check. Evidence logs now compute01 ~/j251-evidence/{gates-launch,quick,fast}.log. No duplicate gate is running or queued on dev-02. Nix build and all 539 checksums already passed; attached receipts in comment 80249.

kayg commented

2026-11-05 18:12:06 +00:00

Author

Owner

Gate finally acquired compute01 slot 2/4 and verify quick is running at pushed head 54a1bf648f, base 19737d86d9. Early policy rows passed; workspace clippy is active. Target: compute01 ~/worktrees/j251/target (the only J251 Rust target). Logs ~/j251-evidence/quick.log then fast.log, runner gates-launch.log. Nix/539-checksum/Mac proof remains attached in comments 80209 and 80249.

Gate finally acquired compute01 slot 2/4 and verify quick is running at pushed head 54a1bf648fea41b94741acc41d773c81d5aecc4a, base 19737d86d9eac6d556d769ee6e4bb7457a4353a9. Early policy rows passed; workspace clippy is active. Target: compute01 ~/worktrees/j251/target (the only J251 Rust target). Logs ~/j251-evidence/quick.log then fast.log, runner gates-launch.log. Nix/539-checksum/Mac proof remains attached in comments 80209 and 80249.

kayg commented

2026-11-05 18:40:29 +00:00

Author

Owner

Initial-base quick passed: QUICK_EXIT=0, all pre-check rows PASS (clippy 504 s; vendoring evaluation 3 s). While it ran, origin/dev advanced from 19737d86d to f9f8ced338 with launch/mesh SSH changes and its D351 lint repair. Per the common brief, rebased J251 onto that base: pushed head 39658c9dee. J251 diff remains the same seven-file vendoring/source fix. Stopped only J251’s old-base fast run early; its interrupted output and the passing quick receipt are retained at compute01 ~/j251-evidence/initial-base/. Re-running quick then fast on the updated branch, with the same target directory, and refreshing the real Nix/Mac proof for this pinned base. The earlier successful Nix/539-checksum/Mac receipts remain valid for tested checkpoint 54a1bf648 and are attached, not relabeled as current-head results.

Initial-base quick passed: QUICK_EXIT=0, all pre-check rows PASS (clippy 504 s; vendoring evaluation 3 s). While it ran, origin/dev advanced from 19737d86d to f9f8ced338278d924803a691f9636a9519babcb2 with launch/mesh SSH changes and its D351 lint repair. Per the common brief, rebased J251 onto that base: pushed head 39658c9deeed9ec19a2fa9dbbe395b0c5dcc2034. J251 diff remains the same seven-file vendoring/source fix. Stopped only J251’s old-base fast run early; its interrupted output and the passing quick receipt are retained at compute01 ~/j251-evidence/initial-base/. Re-running quick then fast on the updated branch, with the same target directory, and refreshing the real Nix/Mac proof for this pinned base. The earlier successful Nix/539-checksum/Mac receipts remain valid for tested checkpoint 54a1bf648 and are attached, not relabeled as current-head results.

kayg commented

2026-11-05 18:50:56 +00:00

Author

Owner

Refreshed native Mac check passed on rebased head 39658c9dee: MAC_CHECK_EXIT=0, under lockf -k /tmp/mac-bench.lock. Artifact: lume@infraternal-macos-01-std.vpn.kayg.org:~/j251-evidence/mac-check-current.log (control-host copy ~/.cache/codex-scratch/j251/evidence/mac-check-current.log). Same DEFAULT_DNS_SUFFIX dead-code warning, now dataplane.rs:198. Linux current-head quick is running; clippy passed in 1m41s using the same target. The runner then runs fast and refreshes the Nix release/checksums in that single slot, pinned to base f9f8ced33.

Refreshed native Mac check passed on rebased head 39658c9deeed9ec19a2fa9dbbe395b0c5dcc2034: MAC_CHECK_EXIT=0, under lockf -k /tmp/mac-bench.lock. Artifact: lume@infraternal-macos-01-std.vpn.kayg.org:~/j251-evidence/mac-check-current.log (control-host copy ~/.cache/codex-scratch/j251/evidence/mac-check-current.log). Same DEFAULT_DNS_SUFFIX dead-code warning, now dataplane.rs:198. Linux current-head quick is running; clippy passed in 1m41s using the same target. The runner then runs fast and refreshes the Nix release/checksums in that single slot, pinned to base f9f8ced33.

kayg commented

2026-11-05 18:53:18 +00:00

Author

Owner

current-head quick failed on restart::recovery_tests::oversized_debug_image_does_not_limit_restart_fixtures (207 passed, 1 failed, 14 ignored in the CLI test binary). the pinned base f9f8ced33 already has the same mismatch: restart_binary.rs sets RUNNING_IMAGE_LIMIT to 768 MiB, while restart_recovery_tests.rs pads to 512 MiB + 1 and expects refusal. neither file changes in J251. vendoring, fmt, doc checks and workspace clippy passed. running the full fast gate and refreshed Nix release proof independently; preserving the failure receipt rather than changing unrelated restart code.

current-head quick failed on restart::recovery_tests::oversized_debug_image_does_not_limit_restart_fixtures (207 passed, 1 failed, 14 ignored in the CLI test binary). the pinned base f9f8ced33 already has the same mismatch: restart_binary.rs sets RUNNING_IMAGE_LIMIT to 768 MiB, while restart_recovery_tests.rs pads to 512 MiB + 1 and expects refusal. neither file changes in J251. vendoring, fmt, doc checks and workspace clippy passed. running the full fast gate and refreshed Nix release proof independently; preserving the failure receipt rather than changing unrelated restart code.

kayg commented

2026-11-05 19:17:29 +00:00

Author

Owner

final commit message is now recorded at 55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174 on nix-vendor-gotatun-j251. its tree 8cd3528d3ced8bf251821e93d441123cf3154447 is identical to 39658c9de, which received the refreshed mac check and quick run. no code changed in the amendment.

attached: full quick failure receipt and pinned-base source evidence for the 512 MiB fixture versus 768 MiB running-image limit. fast is now running on the final head under compute01 build slot 4, followed by the fresh Nix release proof. no merge or deploy performed.

final commit message is now recorded at `55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174` on `nix-vendor-gotatun-j251`. its tree `8cd3528d3ced8bf251821e93d441123cf3154447` is identical to `39658c9de`, which received the refreshed mac check and quick run. no code changed in the amendment. attached: full quick failure receipt and pinned-base source evidence for the 512 MiB fixture versus 768 MiB running-image limit. fast is now running on the final head under compute01 build slot 4, followed by the fresh Nix release proof. no merge or deploy performed.

current-quick.log

35 KiB

baseline-restart-mismatch.txt

1.6 KiB

kayg commented

2026-11-05 19:24:41 +00:00

Author

Owner

fast privileged integration also fails before execution: relay_fixture.rs:300 initializes PeerPolicy without its new access_ssh field (rustc E0063). recovered the compiler diagnostic from Cargo fingerprint output; the runner had captured JSON stdout. both the example and PeerPolicy definition are unchanged by J251, present at pinned base f9f8ced33. preserving this baseline failure and continuing the remaining gate and Nix proof.

fast privileged integration also fails before execution: relay_fixture.rs:300 initializes PeerPolicy without its new access_ssh field (rustc E0063). recovered the compiler diagnostic from Cargo fingerprint output; the runner had captured JSON stdout. both the example and PeerPolicy definition are unchanged by J251, present at pinned base f9f8ced33. preserving this baseline failure and continuing the remaining gate and Nix proof.

kayg commented

2026-11-05 19:59:00 +00:00

Author

Owner

final-head scripts/verify fast completed with exit 1. the three failed rows are the two pinned-base problems documented above: oversized restart fixture fails in CLI compile-out and workspace tests; privileged integration cannot compile the relay fixture missing PeerPolicy.access_ssh. all other rows passed, including Nix vendoring, clippy, shim, policy checks and both static builds. no unrelated code changed.

static receipts: x86_64 27,176,240 bytes (baseline 22,418,256, delta +4,757,984); aarch64 24,501,840 bytes (baseline 20,453,280, delta +4,048,560). both have no PT_INTERP and are stripped/static. x86 key memory reports initialization=1; aarch64 runtime check skips on x86. these are the gate’s all-feature CLI artifacts, not the Nix node artifact sizes.

full gate log and compiler diagnostic attached. summary verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | FAIL (1)     |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | FAIL (1)     |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
FAST_EXIT=1

fresh Nix release build is now running on final head 55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174.

current-fast.log

473 KiB

kayg commented

2026-11-05 20:35:49 +00:00

Author

Owner

j251 implementation finished on branch nix-vendor-gotatun-j251, head 55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174, base f9f8ced338278d924803a691f9636a9519babcb2. no merge, deploy or issue closure.

choice: use the same pinned GotaTun fork on Linux and macOS, as D352 already requires. this removes the duplicate package source without inventing a version or changing the vendor layout. pin the Git source hash and preserve generated Cargo source replacements for offline sandbox builds. quick and fast now check vendor-name collisions and evaluate the actual cargoDeps derivation where Nix is installed. the checker rejected the original lockfile and passes the fixed lockfile.

reproduction from the original clean origin/dev checkout on compute01 failed at the first Nix error, before the reported duplicate-directory collision:

error: No hash was found while vendoring the git dependency gotatun-0.10.2.

final clean-checkout release proof on compute01, through build-slot (nice 10, four build jobs):

nix build .#packages.x86_64-linux.default -L --cores 4 --max-jobs 1
FIX_BUILD_EXIT=0
/nix/store/jsl87xpnhncscm5fkxlvhd13dlr4ay32-infraternal-0.1.0
SOURCE=55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174
CHECKSUM_EXIT=0
539 SHA256SUMS
RELEASE_EXIT=0

all 539 entries verify; checkout status is clean. a copy into an old evidence filename was permission-denied after verification, so the identical manifest was copied directly from the output into a new evidence filename. full build log, manifest, checksum log and provenance attached.

Mac proof on the identical code tree (39658c9de, tree 8cd3528d3ced8bf251821e93d441123cf3154447; final commit changes only the message), on lume@infraternal-macos-01-std.vpn.kayg.org under foreground lockf -k /tmp/mac-bench.lock:

cargo check --locked -p infraternal-plugin-mesh --no-default-features --features agent
Finished ... in 7m 04s
MAC_CHECK_EXIT=0

quick was run before fast. quick exits 1; fast exits 1 on pre-existing pinned-base problems, with evidence in comments 80374 and 80413: (1) restart fixture pads to 512 MiB + 1 while the running-image bound is 768 MiB, causing the CLI compile-out and workspace test rows to fail; (2) relay_fixture.rs:300 omits PeerPolicy.access_ssh, preventing privileged test compilation. no unrelated production or test changes were made. the compiler diagnostic is attached as .txt because Forgejo rejected .jsonl.

fast output verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| Nix Cargo vendoring       | PASS         |
| fmt                       | PASS         |
| migration names           | PASS         |
| migration tooling tests   | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | FAIL (1)     |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| Traefik component manifest | PASS         |
| release component publication | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| doc coverage ratchet      | PASS         |
| shape lints off (D351)    | PASS         |
| doc comments on diff      | PASS         |
| fixed test waits          | PASS         |
| privileged integration    | FAIL (1)     |
| probe release exclusion   | PASS         |
| nightly fuzz reporter     | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
FAST_EXIT=1

Nix release artifact sizes:

infraternal 27691728 bytes
infraternal-aarch64-musl 10612600 bytes
infraternal-aarch64-session-musl 1950416 bytes
infraternal-x86_64-musl 11408864 bytes
infraternal-x86_64-session-musl 2218384 bytes

receipts are retained outside the checkout. own Mac target was removed; own compute target cleanup is being completed after receipts were saved. Nix result root retained.

j251 implementation finished on branch `nix-vendor-gotatun-j251`, head `55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174`, base `f9f8ced338278d924803a691f9636a9519babcb2`. no merge, deploy or issue closure. choice: use the same pinned GotaTun fork on Linux and macOS, as D352 already requires. this removes the duplicate package source without inventing a version or changing the vendor layout. pin the Git source hash and preserve generated Cargo source replacements for offline sandbox builds. quick and fast now check vendor-name collisions and evaluate the actual cargoDeps derivation where Nix is installed. the checker rejected the original lockfile and passes the fixed lockfile. reproduction from the original clean origin/dev checkout on compute01 failed at the first Nix error, before the reported duplicate-directory collision: ```text error: No hash was found while vendoring the git dependency gotatun-0.10.2. ``` final clean-checkout release proof on compute01, through build-slot (nice 10, four build jobs): ```text nix build .#packages.x86_64-linux.default -L --cores 4 --max-jobs 1 FIX_BUILD_EXIT=0 /nix/store/jsl87xpnhncscm5fkxlvhd13dlr4ay32-infraternal-0.1.0 SOURCE=55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174 CHECKSUM_EXIT=0 539 SHA256SUMS RELEASE_EXIT=0 ``` all 539 entries verify; checkout status is clean. a copy into an old evidence filename was permission-denied after verification, so the identical manifest was copied directly from the output into a new evidence filename. full build log, manifest, checksum log and provenance attached. Mac proof on the identical code tree (`39658c9de`, tree `8cd3528d3ced8bf251821e93d441123cf3154447`; final commit changes only the message), on lume@infraternal-macos-01-std.vpn.kayg.org under foreground `lockf -k /tmp/mac-bench.lock`: ```text cargo check --locked -p infraternal-plugin-mesh --no-default-features --features agent Finished ... in 7m 04s MAC_CHECK_EXIT=0 ``` quick was run before fast. quick exits 1; fast exits 1 on pre-existing pinned-base problems, with evidence in comments 80374 and 80413: (1) restart fixture pads to 512 MiB + 1 while the running-image bound is 768 MiB, causing the CLI compile-out and workspace test rows to fail; (2) relay_fixture.rs:300 omits `PeerPolicy.access_ssh`, preventing privileged test compilation. no unrelated production or test changes were made. the compiler diagnostic is attached as .txt because Forgejo rejected .jsonl. fast output verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | Nix Cargo vendoring | PASS | | fmt | PASS | | migration names | PASS | | migration tooling tests | PASS | | VT native fmt | PASS | | CLI plugin compile-out | FAIL (1) | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | Traefik component manifest | PASS | | release component publication | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | doc coverage ratchet | PASS | | shape lints off (D351) | PASS | | doc comments on diff | PASS | | fixed test waits | PASS | | privileged integration | FAIL (1) | | probe release exclusion | PASS | | nightly fuzz reporter | PASS | | static builds | PASS | +---------------------------+--------------+ FAST_EXIT=1 ``` Nix release artifact sizes: ```text infraternal 27691728 bytes infraternal-aarch64-musl 10612600 bytes infraternal-aarch64-session-musl 1950416 bytes infraternal-x86_64-musl 11408864 bytes infraternal-x86_64-session-musl 2218384 bytes ``` receipts are retained outside the checkout. own Mac target was removed; own compute target cleanup is being completed after receipts were saved. Nix result root retained.

current-build.log

88 KiB

current-checksums.log

16 KiB

current-output-provenance.log

150 B

SHA256SUMS.txt

48 KiB

current-binary-sizes.log

199 B

relay-fixture-diagnostic.txt

1.9 KiB

mac-check-current.log

6.5 KiB

kayg commented

2026-11-05 20:36:18 +00:00

Author

Owner

cleanup complete: removed only ~/worktrees/j251/target on compute01 and the Mac. retained evidence and compute01 Nix result root. owned gate/build runner has exited; no J251 work remains running. final receipts are attached to comment 80455. branch head remains 55a955c52d; no merge or deploy.

cleanup complete: removed only ~/worktrees/j251/target on compute01 and the Mac. retained evidence and compute01 Nix result root. owned gate/build runner has exited; no J251 work remains running. final receipts are attached to comment 80455. branch head remains 55a955c52d49e3b0a37e9f30d8ac8fef2f2ee174; no merge or deploy.

Rows
Columns

J251: repair Nix vendoring collision for GotaTun #368