From db6d20cfc32a8bdf6a0753f3b629bbf94ab2f8af Mon Sep 17 00:00:00 2001 From: Lucid Programmer Date: Sun, 18 Oct 2026 12:37:18 +0530 Subject: [PATCH] storage, ci: adopt the macOS owner connection fix and resolve temporary paths in checks --- .github/CI.md | 17 +++++++++----- Cargo.lock | 22 +++++++++---------- Cargo.toml | 10 ++++----- README.md | 2 +- crates/cg-cli/Cargo.toml | 4 ++-- crates/cg-cli/tests/cli_acceptance.rs | 12 +++------- .../fixtures/provider_envelopes/agy_plain.txt | 2 +- .../provider_envelopes/claude_success.json | 2 +- .../provider_envelopes/codex_last_message.txt | 2 +- crates/context-graph/Cargo.toml | 4 ++-- .../context-graph/tests/common/ci_stages.rs | 6 ++--- scripts/tests/test_ci_model_seed.py | 2 +- scripts/tests/test_ci_shards.py | 2 +- 13 files changed, 43 insertions(+), 44 deletions(-) diff --git a/.github/CI.md b/.github/CI.md index 48828dbc..e799ee76 100644 --- a/.github/CI.md +++ b/.github/CI.md @@ -306,12 +306,17 @@ The legacy local `shard-union` stage still requires twelve receipts; explicit Li and macOS stages each require exactly six, with no fallback to available platforms. Qualification remains pending: seven macOS test failures remain unresolved. -The default owner-service locator also remains broken: the native user temporary -root plus the full socket key can exceed macOS's 103-byte socket pathname limit. -A writable database open can succeed while the separate owner service fails to start. -A repair and independent native owner/reader proof are still pending; prior reader -authentication results do not prove the default locator. These are open follow-up -items, not passing evidence. Completion requires identifying and fixing each failure in source, verifying +The pinned ContextDB macOS default locator now canonicalizes the fixed system +temporary root `/tmp` and uses a private per-effective-UID directory with the full +socket key. Focused upstream engine coverage consists of five integration cases +actually run on the pinned revision and three unchanged library cases carried +from an older revision, not eight newly executed cases. The only reader +authentication proof is from a separate earlier ContextDB candidate, not the +pinned revision; prior reader authentication results do not prove the pinned +default locator or full Context Graph qualification. Full Context Graph macOS +consumer qualification, including the integrated default owner/reader locator, +remains pending. These are open follow-up items, not passing evidence. +Completion requires identifying and fixing each failure in source, verifying locator behavior, running all five macOS jobs with all six valid receipts on the exact integrated source, and reviewing the resulting evidence before changing qualification. No issue number or hosted green result is claimed. diff --git a/Cargo.lock b/Cargo.lock index 4fcd89e3..68830195 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -912,7 +912,7 @@ dependencies = [ [[package]] name = "contextdb-core" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "bincode 2.0.1", "rand 0.9.4", @@ -926,7 +926,7 @@ dependencies = [ [[package]] name = "contextdb-engine" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "bao-tree", "bincode 2.0.1", @@ -971,7 +971,7 @@ dependencies = [ [[package]] name = "contextdb-graph" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "contextdb-core", "contextdb-tx", @@ -982,7 +982,7 @@ dependencies = [ [[package]] name = "contextdb-hnsw" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "anndists", "anyhow", @@ -1006,7 +1006,7 @@ dependencies = [ [[package]] name = "contextdb-parser" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "contextdb-core", "pest", @@ -1016,7 +1016,7 @@ dependencies = [ [[package]] name = "contextdb-planner" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "contextdb-core", "contextdb-parser", @@ -1025,7 +1025,7 @@ dependencies = [ [[package]] name = "contextdb-redb" version = "4.1.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "libc", ] @@ -1033,7 +1033,7 @@ dependencies = [ [[package]] name = "contextdb-relational" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "contextdb-core", "contextdb-tx", @@ -1044,7 +1044,7 @@ dependencies = [ [[package]] name = "contextdb-server" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "blake3", "clap", @@ -1072,7 +1072,7 @@ dependencies = [ [[package]] name = "contextdb-tx" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "contextdb-core", "parking_lot", @@ -1081,7 +1081,7 @@ dependencies = [ [[package]] name = "contextdb-vector" version = "1.0.0" -source = "git+https://github.com/context-graph-ai/contextdb?rev=bc9cce955eb85fb1488f5304426eedeb6d97e905#bc9cce955eb85fb1488f5304426eedeb6d97e905" +source = "git+https://github.com/context-graph-ai/contextdb?rev=db9d067f291c0add0922713936a63f51f24e9f1c#db9d067f291c0add0922713936a63f51f24e9f1c" dependencies = [ "anndists", "contextdb-core", diff --git a/Cargo.toml b/Cargo.toml index dcb918a9..67f7a358 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -44,11 +44,11 @@ candle-core = { path = "vendor/candle-core", version = "=0.10.2" } candle-nn = { path = "vendor/candle-nn", version = "=0.10.2" } candle-transformers = { path = "vendor/candle-transformers", version = "=0.10.2" } criterion = { version = "0.8", features = ["html_reports"] } -contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" } -contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" } -contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" } -contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" } -contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905" } +contextdb-core = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" } +contextdb-engine = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" } +contextdb-parser = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" } +contextdb-tx = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" } +contextdb-vector = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c" } safetensors = "0.7.0" sha2 = "0.10.9" tempfile = "3.23.0" diff --git a/README.md b/README.md index 519c6b92..2cc49c1d 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ Use the [download guide](docs/download.md) for wget, receipts and provenance ver The pinned toolchain in `rust-toolchain.toml` is Rust **1.94.1**. -ContextDB is pinned to `bc9cce955eb85fb1488f5304426eedeb6d97e905` in the manifests and lockfile. +ContextDB is pinned to `db9d067f291c0add0922713936a63f51f24e9f1c` in the manifests and lockfile. Linux is required by `PR checks`; macOS runs in the separate, nonblocking `macOS advisory` workflow. See the [macOS qualification follow-up](.github/CI.md#macos-qualification-follow-up). diff --git a/crates/cg-cli/Cargo.toml b/crates/cg-cli/Cargo.toml index 00d0068d..d73e97ae 100644 --- a/crates/cg-cli/Cargo.toml +++ b/crates/cg-cli/Cargo.toml @@ -43,7 +43,7 @@ cg-cli-conventions.workspace = true context-graph = { path = "../context-graph", features = ["fabric-sync"] } contextdb-core.workspace = true contextdb-engine.workspace = true -contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"] } +contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"] } fs4.workspace = true serde = { workspace = true, features = ["derive"] } serde_json.workspace = true @@ -63,6 +63,6 @@ context-graph-cli = { path = ".", features = ["status-fault-injection"] } # compiled behind contextdb-engine's `test-seams` feature. This is a test-only activation — the # `cg` binary's own dependency edge on contextdb-engine does not enable it. contextdb-engine = { workspace = true, features = ["test-seams"] } -contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] } +contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] } libc = "0.2" tempfile.workspace = true diff --git a/crates/cg-cli/tests/cli_acceptance.rs b/crates/cg-cli/tests/cli_acceptance.rs index 3f32bad6..e533afde 100644 --- a/crates/cg-cli/tests/cli_acceptance.rs +++ b/crates/cg-cli/tests/cli_acceptance.rs @@ -2690,25 +2690,19 @@ fn reply_extraction_engine_matches_recorded_envelopes() { let claude = extract_reply("claude", "json", CLAUDE_SUCCESS, None); assert_eq!( claude.as_deref(), - Ok( - "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships." - ), + Ok("The logged-in Claude CLI returned this completion."), "claude JSON framing must extract /result" ); let codex = extract_reply("codex", "file", "", Some(&codex_file)); assert_eq!( codex.as_deref(), - Ok( - "Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships.\n" - ), + Ok("The logged-in Codex CLI returned this completion.\n"), "codex file framing must read --output-last-message" ); let agy = extract_reply("agy", "text", AGY_PLAIN, None); assert_eq!( agy.as_deref(), - Ok( - "Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships.\n" - ), + Ok("The local Agy CLI returned this completion.\n"), "text framing returns the whole stdout" ); let missing = extract_reply("claude", "json", "{\"type\":\"result\"}", None); diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt b/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt index 632b64b6..5840b76a 100644 --- a/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt +++ b/crates/cg-cli/tests/fixtures/provider_envelopes/agy_plain.txt @@ -1 +1 @@ -Host session proof received. I can answer through the local Agy CLI; capture remains disabled until ingestion ships. +The local Agy CLI returned this completion. diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json b/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json index b46321f0..33649b1d 100644 --- a/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json +++ b/crates/cg-cli/tests/fixtures/provider_envelopes/claude_success.json @@ -6,7 +6,7 @@ "duration_ms": 2427, "duration_api_ms": 1896, "num_turns": 1, - "result": "Host session proof received. I can answer through the logged-in Claude CLI; turn capture should stay off until ingestion ships.", + "result": "The logged-in Claude CLI returned this completion.", "session_id": "6d8b4cb2-7f16-4c84-9e7f-9a43d7a51c30", "total_cost_usd": 0.000278, "usage": { diff --git a/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt b/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt index 1d1e4d4a..80791f0d 100644 --- a/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt +++ b/crates/cg-cli/tests/fixtures/provider_envelopes/codex_last_message.txt @@ -1 +1 @@ -Host session proof received. I can answer through this logged-in Codex CLI; no turn capture should begin until ingestion ships. +The logged-in Codex CLI returned this completion. diff --git a/crates/context-graph/Cargo.toml b/crates/context-graph/Cargo.toml index b570cfd0..42a51e1e 100644 --- a/crates/context-graph/Cargo.toml +++ b/crates/context-graph/Cargo.toml @@ -44,7 +44,7 @@ chrono = { workspace = true, features = ["serde"] } contextdb-core.workspace = true contextdb-engine.workspace = true contextdb-parser.workspace = true -contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh"], optional = true } +contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh"], optional = true } fs4.workspace = true pollster.workspace = true rayon.workspace = true @@ -71,7 +71,7 @@ candle-nn.workspace = true candle-transformers.workspace = true cg-catalog = { path = "../cg-catalog", features = ["embeddinggemma-test-support"] } cg-connector-claude-code.workspace = true -contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "bc9cce955eb85fb1488f5304426eedeb6d97e905", features = ["iroh", "test-seams"] } +contextdb-server = { git = "https://github.com/context-graph-ai/contextdb", rev = "db9d067f291c0add0922713936a63f51f24e9f1c", features = ["iroh", "test-seams"] } contextdb-engine = { workspace = true, features = ["test-seams"] } contextdb-tx.workspace = true contextdb-vector = { workspace = true, features = ["test-seams"] } diff --git a/crates/context-graph/tests/common/ci_stages.rs b/crates/context-graph/tests/common/ci_stages.rs index e6541693..61870f70 100644 --- a/crates/context-graph/tests/common/ci_stages.rs +++ b/crates/context-graph/tests/common/ci_stages.rs @@ -262,7 +262,7 @@ fn model_contract_matches( && format!("{:x}", Sha256::digest(core.0)) == "9feafef445a5364998c90178048e781f08b9840595a311f9f7bf620b2c0798d9" && format!("{:x}", Sha256::digest(core.1)) - == "125356acd39f98d17aa3806ea4e94d3ae7ad7ba4d00e9399e6a184cf8cd70867" + == "175554cfa8b78e96def6645acce2ef8d6eea899ad3826d2f2355593d5df05c62" } fn shard_contract_is_frozen(script: &str) -> bool { @@ -362,11 +362,11 @@ fn shard_contract_is_frozen(script: &str) -> bool { && format!( "{:x}", Sha256::digest(include_bytes!("../../../../Cargo.toml")) - ) == "ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85" + ) == "120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520" && format!( "{:x}", Sha256::digest(include_bytes!("../../../../Cargo.lock")) - ) == "3d835eba6e63d7839a0eb78ca6715fb805a95509a8dcaf0df7fdc699907a9b84" + ) == "d08e10eb22f8394b21522c2d19b85d1a27b05bc7c3892a072acb8ef1167c02ec" && format!( "{:x}", Sha256::digest(include_bytes!( diff --git a/scripts/tests/test_ci_model_seed.py b/scripts/tests/test_ci_model_seed.py index 99bfd255..322a2e75 100644 --- a/scripts/tests/test_ci_model_seed.py +++ b/scripts/tests/test_ci_model_seed.py @@ -19,7 +19,7 @@ class SeedArtifact(unittest.TestCase): def setUp(self): self.temp = tempfile.TemporaryDirectory() self.addCleanup(self.temp.cleanup) - self.root = Path(self.temp.name) + self.root = Path(self.temp.name).resolve() self.patch = mock.patch.object(seed, 'ROOT', self.root) self.patch.start() self.addCleanup(self.patch.stop) diff --git a/scripts/tests/test_ci_shards.py b/scripts/tests/test_ci_shards.py index 8156fa8a..da607671 100644 --- a/scripts/tests/test_ci_shards.py +++ b/scripts/tests/test_ci_shards.py @@ -542,7 +542,7 @@ def test_isolated_audit_manifest_lock_and_source_boundary(self): lock_digest = 'e6a98ee802ad0f1e9e3696f87daa40c6b7a78c6bb9424f6472f1afd4a798a55f' def valid(body, lock_bytes, root_manifest): return (body == expected and hashlib.sha256(lock_bytes).hexdigest() == lock_digest - and hashlib.sha256(root_manifest).hexdigest() == 'ab995589c0159a218d0fd370a539c2994b6008e7e64b0d3e171062e6e0b11e85') + and hashlib.sha256(root_manifest).hexdigest() == '120776aefc6ae100986f4b51e837a64012df52604c3a2b59b14d3d0021a01520') self.assertTrue(valid(expected, lock.read_bytes(), (ROOT / 'Cargo.toml').read_bytes())) for key, value in [('edition', '2021'), ('autotests', True), ('publish', True)]: changed = copy.deepcopy(expected); changed['package'][key] = value