3 Commits

Include renames

Author	SHA1	Message	Date
Claude	03027f9769	pki: the StarshipOS CA, made on the CI box; capsules signed in CI ... Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid StarshipOS rather than snake oil intermediate." - ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI box) and the StarshipOS Capsule Signing intermediate it issues, and stores the signing key as the secret CAPSULE_SIGN_KEY. - The kernel finds the signing certificate by one name, CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The certificate itself lands once make-ca.sh has run; until then the snakeoil intermediate is in the tree under its old name and the capsules check as "no root key" (a warning, as "missing" was). - mkcapsule refuses a signing key that is not that certificate's. - SIGN_KEY has no default; acceptance, build, nightly and release set it from the secret. FABRIC-3.md XLVI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2	2026-11-07 04:15:29 +00:00
Claude	fb24d3f482	ci: run the jobs in the runner image (#120) ... The workflows' containers are now lithosananke-runner:72b6cf370db1, built and published by runner-image.yml, with everything init installs and Maven already in it; the install steps are gone, except the documents' packages in nightly-docs.yml and release.yml. The registry refuses anonymous pulls, so each job pulls with PACKAGES_TOKEN. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2	2026-11-07 00:57:35 +00:00
rajamesandClaude Opus 5.5	0fd7648a77	ci: acceptance.yml gates every PR into master; master only through an accepted PR ... Captain Bob, 2026-11-06: what a developer runs, what CI runs and what the nightly runs are one process, and "failures should not be allowed to be merged to master". acceptance.yml runs on every PR into master (opened, pushed to, reopened): .claude/CLAUDE.md's acceptance protocol through the same scripts/nightly.sh stages -- amd64, aarch64, riscv64 to [zuse@Hera] ok>, the PC stick loaded high (and the three agree on dict_hash), then make -C v4 test-32 -- one QEMU at a time, in one job. Its logs and DoE CSVs are kept, pass or fail. master's branch protection requires it. acceptance, nightly and release share the concurrency group qemu, so the runner never runs two of them at once: CLAUDE.md's one-QEMU rule holds in CI too. build.yml becomes the quick check on pushes only. .claude/CLAUDE.md's Hard Rules: commit and push directly on the working branch; master only through a PR that passed acceptance, no direct pushes; no approval required while there is one developer. Named: the Captain Bob method. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2	2026-11-06 16:24:22 +00:00