Promote main to release - #2666
Open
copse-release-bot[bot] wants to merge 8 commits into
Open
Conversation
test(models): keep intellect sync assertions data-stable
…ification fix(models): tolerate blocked card verification
…edentials (#2652) Copse's profile can be relocated with `COPSE_DIR`, but its current OS-user encryption key and host-installed tools prevent a complete development environment from moving between Macs. This PR documents the proposed implementation and acceptance gates for permanent portability, including offline operation. - Package the application, independent development repositories, toolchains, caches and local models on an external drive, with explicit relocation and host-dependency checks. - Use a per-profile data key wrapped separately by each enrolled Mac's Secure Enclave key, Touch ID/system authentication, and a random recovery key stored in a password manager. Preserve packaged-app and ad-hoc `make run` access to the same profile, subject to the native-helper feasibility gate. - Define complete migration, lock/credential invalidation, recovery and sequential cross-device validation. - Keep initial detached execution narrow: one task/repository container on a trusted host, explicitly delegated short-lived read-only GitHub credentials usable with `gh`, and model inference independent of the desktop. Keep profile and renewal keys local; defer brokers, attestation, confidential computing and automatic renewal. Align the existing cloud-workspace and runtime-security plans with this reduced-guarantee exception. Documentation only; this does not implement encryption, provision workers, or migrate credentials or user data. Validation: - Fetched `origin/main` and rebased the branch before opening the PR (base `f5f1764c2`). - Repository-pinned `oxfmt@0.66.0` check passed for all four changed documents; relative file links and `git diff --cached --check` passed. - 29 existing tests passed with `node --test packages/store-kit/src/keyring-cipher.test.ts packages/store-kit/src/copse-paths.test.ts packages/store-kit/src/user-data-migration.test.ts`. - Required `pnpm run check` was attempted but could not start: `pnpm` is unavailable and this worktree has no installed dependency tree. Full application checks were not run. The passing primitive tests do not validate Touch ID, Secure Enclave, remote isolation or cross-device portability; those remain implementation acceptance gates. Co-authored-by: Jonathan Kingston <KingstonMailBox@gmail.com>
Moving a Copse checkout and profile onto a drive left Electron and gortex caches under the host's `~/.copse`, and absolute cache links retained the old mount point. Both caches now default beneath `COPSE_DIR`, retain their dedicated overrides, and use relative links computed from canonical paths. Electron also handles dangling links and avoids promoting another profile's shared cache. This is an independent implementation slice from the portability investigation around #2652. The companion PATH change and full non-encryption audit are in #2657. This PR changes build/install plumbing and documents cache preparation; it does not change encryption, relocate repositories, bundle toolchains, or claim offline/two-Mac readiness. Moving only the checkout still requires re-establishing its cache links. Validation: - Rebased onto current `origin/main` (`f5f1764c2`) before committing. - All static stages of `pnpm run check` passed: typecheck, full lint, formatting, demo consistency, dead-code, oracle (255 specs / 15 invariants), and e2e syntax. The final package-export import fix also passed focused lint and the full suite's workspace-package invariant. - Four focused cache tests passed: override precedence, blank/relative roots, an Electron directory link surviving a renamed kit root, and repair/execution of a gortex link from a local fixture cache without downloading. - Full unit rerun with pinned Node 24.20.0 outside the tool sandbox: 9,133 passed, 9 failed, 7 skipped (9,149 total). The failures were existing hook tests at their two-second deadlines while two full suites ran concurrently. A subsequent separate rerun of all six affected hook files passed all 42 tests. The initial Node 26 sandboxed test attempt was interrupted after socket permission errors and a Node native assertion; no single uninterrupted full `check` run is claimed green. - No GUI layout changes, drive migration, or two-Mac/offline acceptance test. Co-authored-by: Jonathan Kingston <KingstonMailBox@gmail.com>
Copse's GUI startup prepends host Homebrew/home tools to a supplied PATH, availability probes prepend system paths, and `make run` can activate host nvm. A prepared drive launcher therefore cannot reliably choose its own tools. The supported `COPSE_PRESERVE_PATH=1` opt-in preserves its PATH at all three entry points; ordinary launches retain their current behavior. Includes a launch example and a source-based audit of the non-encryption portability gaps beyond #2652, with proposed follow-up PRs and acceptance gates. This PR is independent of the build-cache changes in #2656 and encryption work. It leaves HOME, credential filtering and sandbox policy intact; it does not isolate shell startup files or host integrations, supply binaries/models, or enforce offline operation. There are no DOM/layout changes. Validation: - Rebased onto current `origin/main` (`f5f1764c2`) before committing. - All static stages of `pnpm run check` passed: typecheck, full lint, formatting, demo consistency, dead-code, oracle (255 specs / 15 invariants), and e2e syntax. - `pnpm run build` passed. All 15 focused launch-PATH and tool-availability tests passed, including an actual `make check-node` invocation proving opt-in skips host nvm while an ordinary invocation still sources it. - Full unit rerun with pinned Node 24.20.0 outside the tool sandbox: 9,133 passed, 10 failed, 7 skipped (9,150 total). The failures were existing hook tests at their two-second deadlines while two full suites ran concurrently. A subsequent separate rerun of the six affected, unchanged hook files on this branch passed all 42 tests. The initial Node 26 sandboxed test attempt was interrupted after socket permission errors and a Node native assertion; no single uninterrupted full `check` run is claimed green. - No two-Mac/offline/native-runtime portability acceptance is claimed. Co-authored-by: Jonathan Kingston <KingstonMailBox@gmail.com>
Auto-generated by [`sync-intellect.yml`](.github/workflows/sync-intellect.yml) from the [Artificial Analysis language-model API](https://artificialanalysis.ai/). Review the diffs in `scripts/data/intellect-scores.json` and `packages/llm/src/model-intellect.generated.ts`. Confirm that each changed score is for the intended model/configuration and that the API index version still matches `canonicalVersion` before merging. Pre-PR validation outcome: `failure`. The normal PR checks are the source of truth; a failed validation keeps this workflow red while still leaving the generated diff available for review and repair. Co-authored-by: jonathanKingston <338988+jonathanKingston@users.noreply.github.com> Co-authored-by: Jonathan Kingston <KingstonMailBox@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily automated promotion of
mainto the release-readyreleasebranch.The repository ruleset requires the full
CI Passedgate. This PR willmerge automatically when that gate is green; failures leave it open
until the underlying issue is fixed on
main.