Repository navigation
feat(native): guide first-use runtime setup - #794
Conversation
Expose verified resumable setup through the frontend, choose a private home by default, and share read-only installation admission between preflight and native up. Preserve explicit consent and managed upgrade quiescence. Fixes HACK-2193.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Answer the read-only setup inspection before mocked project startup, and expect the earlier closed refusal when the executor is unavailable. Preserve metadata, fingerprint, and no-effects assertions.
|
@codex review Head: |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Ready for lead: Persistent Opus review is CLEAN; Codex code and security receipts are clean on this head, with zero unresolved bot threads. All selected Linux gates passed in run 43504573143: unit shards 4–8, Candidate core, both config compiler hosts, test focus, process lifetime, state models and secret scan. Local evidence is in the PR description. Hosted jobs still pending: macOS unit shards 1/8 and 2/8. macOS Candidate core/config compiler and Docker checks have passed. Known separate macOS failure: shard 3/8, The review checker reports Lead Mac acceptance: fresh selected home → |
|
Merged next 7f9548c normally into this branch; new head cf72083 (parents 031e154 and 7f9548c). The sole conflict was the native reference setup paragraph. It keeps #792's shorter start-page structure. The new v5 native start and linked setup/recovery page now use the same frontend's Merge-tree validation: 311 focused Bun passes/16 existing skips/0 failures across 17 setup/frontend/installer/preflight and compatibility files; build, all eight compiled CLI plan checks, privacy, full docs link/anchor/navigation/export checks, normal commit hooks and reachable-head Gitleaks passed. Local root typecheck/lint scripts and dependency postinstall were blocked by a host toolchain trust setting; that guard was preserved, so exact-head hosted CI must cover those gates. Rust implementation is unchanged from the previously qualified head. Known separate failures remain the local-network-hint assertion from #791 (fix #796) and HACK-2184's compose-foreground-signal flake, per the lead. Exact-head CI and bot re-review are pending; a fresh Ready for lead note will follow those checks. @codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Fixed the rendered docs anchor failure in 2ee4a95 (two docs only). The start page's new home-selection link had mapped to the published pinned installer snapshot, which lacks the new root-guide heading. The guidance now lives in the versioned setup page under Verified with the full production docs build and actual loopback HTTP smoke: 97 docs pages, 82 served diagram SVGs, and all 215 recipe links/anchors pass. The same persistent reviewer checked the rendered-source mapping and is clean. Docs check, privacy, normal commit hooks and reachable-head Gitleaks pass. The task-owned smoke server is stopped. The normal merge of next is retained, and first-use code is unchanged from the merge's 311 passing focused tests. Exact-head CI/re-review are pending before a fresh Ready for lead note. @codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Merged Merged-tree local evidence: 327 focused Bun passes, 16 existing skips, zero failures; Rust default 1,204 passes/39 ignored and all features 1,508 passes/49 ignored; rustfmt, both Clippy configurations, typecheck, check/privacy, build, all eight compiled native-plan checks, docs checks, production docs build and rendered HTTP smoke passed. The smoke checked 97 pages and 215 local links/anchors. Reachable-head Gitleaks passed. Exact-head hosted checks and bot review are pending. No final full local Bun-suite pass is claimed. Linux PR shards do not qualify the macOS-specific #796 regression, and real Mac setup → detached project start remains the lead's acceptance gate. @codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Fixed the lead's macOS installed-manager regression in The fixture always supplied The same persistent Opus reviewer cleared both the fixture correction and incoming merge. Local checks: 173 passes/one macOS-only skip across ten focused files; typecheck, lint/privacy, build, all eight compiled CLI checks and reachable-head Gitleaks passed. The skipped installed-manager test is not local proof. Dispatched full CI once on this exact head: 43535090333. It includes the macOS shards and every installer/launcher/native-home file found using @codex review |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Final acceptance-fixture head: The persistent reviewer accepted the activity-journal correction and requested one more precision fix: the missing-executor case must identify its actual setup-inspection refusal. It now requires both Same persistent reviewer re-reviewed the merge and all fixture deltas: CLEAN, nothing left to fix. The full eight-script compiled gate passed at the preceding fixture head; only this strengthened assertion/comment changed afterward. Root typecheck, lint/privacy and wiring checks passed. No new Mac acceptance is claimed. Waiting on exact-head hosted checks before Ready. @codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
All jobs passed at At settlement, Root typecheck, all 40 upgrade-check tests, and docs checks passed on the refreshed merge. The same persistent reviewer is checking the merge; hosted checks must settle at this new head before the Ready note. The macOS evidence above applies to @codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Resolved the new Both branches had independently fixed the same acceptance-fixture assumptions. The six plan scripts retain the reviewed helper, which covers upstream's exact journal-only/no-state checks and additionally checks failed record counts and privacy. The download fixture uses upstream's bounded wait and cancellation assertions, with the existing archive-on-disk equality check retained. No product policy changes were added. Validation passed: root typecheck; 56 upgrade/download tests; 15 cleanup/action-classification tests; all eight compiled-bundle CLI checks; root lint/privacy, targeted lint and docs checks. CLI reference regeneration produced no extra diff. The same persistent reviewer is checking merge provenance. Exact-head CI and bot reviews must settle before Ready. @codex review |
|
Codex Review: Didn't find any major issues. Nice work! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Resolved the next conflict with a normal merge at Adopted #836's tested shared plan-home helper and removed this branch's duplicate. Retained the privacy assertions and the explicit setup-unavailable reason in the env acceptance case. Upstream's newline/torn-journal checks and negative controls remain; an additional sentinel regression verifies the retained privacy check. No product changes were added. Root typecheck, 57 home/upgrade tests, all eight compiled CLI checks, lint/privacy and docs checks pass. Same persistent reviewer is checking this merge. Hosted CI and bot reviews are pending before the final Ready note; no push will follow that note. @codex review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Ready for lead: Normal merges include Both Mac installer-fixture failures are fixed: successful native launches use the receipt-owned home, and the quiescence fake reads its private HOME status file because those children intentionally receive only system variables. Rejection, signature, exit-code and signal assertions remain intact; no product refusal was relaxed. Exact-head CI passed on attempt 1: all eight test shards, all four Docker shards, macOS/Linux candidate core, all three compiler platforms, runtime models/images, process-lifetime, docs and secret scan. The macOS installed-manager test explicitly passed: 1 test, 61 assertions, 0 failures (job). No known-flake reruns were needed. Local root typecheck, 57 focused tests, all eight compiled CLI gates, lint/privacy and docs checks passed. Same persistent Opus reviewer: CLEAN through the final merge. Codex code and security reviews are clean at this head. Ready for the lead's Mac acceptance and planned merge after publication. #795 can follow. No push will follow this Ready note; no merge was performed here. |
|
Lead note: verified on the Mac batch tree at this head ( 🤖 Generated with Claude Code |
…ey-source refusal With first-use setup guidance (#794), native start also runs 'runtime setup inspect --json' before refusing. The test now accepts only 'project plan' and that read-only inspection after start, and still fails on any other runtime call such as a pool, file-delivery or start request. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflicts: - src/commands/env.ts: keep this branch's aliased migration import and next's ProjectEnvKeyState (#848). - scripts/check-native-*-plan-cli.ts: keep this branch's HOME fingerprint and refusal-activity gates; the env plan script also keeps next's setup-unavailable detached refusal (#794). The shared refusal helper now forwards the private inputs to next's assertNativePlanHome check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`native setup --json` (from #794) passes the runtime result through as a bare `{status, files, probe}` object. Record that shape so the inventory matches the command definitions; it does not follow the envelope rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Native preflight hid the offending service and field behind generic graph refusals, and counted missing shared-source consent as a configuration blocker. This adds fixed, value-free reasons and remedies from the existing runtime admission checks. | Before | After | | --- | --- | | One graph subset or route requirements sentence | Separate service/field findings for each unmet requirement | | “The reviewed graph contains blocking diagnostics” | The underlying field diagnostics, without the duplicate generic finding | | Opaque dependency-cache or foreign-platform refusal | Named services and offending cache labels or platform field | | Consent mixed into blockers | Report v2 separates `consent_needed`; text and JSON keep all discovered blockers regardless of consent | Admission predicates and first-error precedence are preserved. No native feature is enabled. Malformed detail batches fall back to a closed refusal; repeated findings are deduplicated. All structured runtime failures have a 1 MiB bound, including authored `up` planning; startup errors rise from 256 KiB to 1 MiB while startup-log schema bounds and the explicit log-decoding gate remain unchanged. Authored startup preserves validated service/field findings, and per-service resource-budget refusals identify the service. Structurally invalid input may still stop review early. Tracks [HACK-2192](https://linear.app/hackdance/issue/HACK-2192), diagnostics-only first unit. Release intent: `fix`. JSON consumers must accept report version 2 and use `ready` for the verdict. The frozen `next` integration preserves both configuration-refusal and interactive-session diagnostics, plus the extracted file-only preflight collector. `hack upgrade check` now counts missing consent separately and requires both zero blockers and zero consent items before describing a project as native-ready. Its finding remains informational, so Compose is unaffected. Validation includes the real CLI consent projection, focused refusal/transport/startup tests, default and all-feature Rust gates, native guest compilation, compiled CLI/compiler acceptance, typecheck, lint, privacy and docs checks. Exact-head outcomes and hosted/bot status are recorded in the integration comment. Linux results do not qualify deferred macOS fixtures; no additional Mac jobs are requested by this integration. This PR follows #794. Final Ready waits for the lead's #794 merge confirmation, any required normal merge and resolution review, and the resulting head's checks. The next.17 freeze and lead merge authority remain in force. <!-- codesmith:footer --> --- <a href="https://backend.blacksmith.sh/track/run-proof?expires=1797196625&installation_model_id=17053&pr_number=795&ref=codesmith_pr_footer&repository=hack-dance%2Fhack&return_to=https%3A%2F%2Fgithub.com%2Fhack-dance%2Fhack%2Fpull%2F795&variant=proof_this_pr&signature=d5db7302585bce257be5cba5e16b510fa6e2ea79a278300fb586760bf92d338f"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-light.svg"><img alt="Proof this PR" src="https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-dark-3x.png" width="121" height="28"></picture></a> <sup><a href="https://app.blacksmith.sh/hack-dance/codesmith/hack/pr/795?autoLogin=true&ref=codesmith_pr_footer">Open in [code]smith</a> · Need help on this PR? Tag <code>@codesmith-bot</code> with what you need.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer --> --------- Co-authored-by: Kit <344842+roodboi@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
![https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-dark.svg"><source](https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-dark.svg"><source){kind=link}
![https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-light.svg"><img](https://pr-comments-assets.blacksmith.sh/codesmith/proof-proof-this-pr-light.svg"><img){kind=link}
A fresh native home now stops
hack upbefore launching a detached owner and explains how to prepare the runtime.hack native setupexposes the existing verified, resumable installer through the same frontend, without a second binary or home argument.--accept-downloads;--jsonpasses through the runtime result unchanged. No project environment or credentials reach setup.runtime_setupin native preflight text and JSON. Project readiness also requires a ready installation. Missing or resumable homes getE_NATIVE_SETUP_REQUIRED; incompatible, unsafe and unavailable homes retain distinct diagnostics.up, recheck it once, and continue only after success. Interruptions propagate without starting anything and retain resumable inputs.$HACK_HOME/native-runtimeor~/.hack/native-runtime. ExplicitHACK_NATIVE_HOMEwins for manual bundles. Managedhack-nextkeeps its receipt-owned home and clearly refuses a differing launch override; administration remains independent of ambient overrides. Explicitnative setupselects that same home even from a Compose shell.Diagram source.
Validation: 299 focused Bun tests passed across 17 files, with 16 existing skips; local-server setup transition, actual installed-binary absent-home checks, private-PTY consent/interruption, JSON byte parity, launcher/home parity, and downstream CLI compatibility. Default Rust: 1,199 passed / 39 ignored; all features: 1,500 passed / 49 ignored. Typecheck, lint/privacy, Clippy, current CLI build and all eight compiled native-plan checks passed. Persistent Opus review is clean. Full hosted Linux checks remain the exact-head suite gate.
Mac acceptance remains with the lead: on a fresh selected home, run
hack native setup, thenhack doctor --native-preflight --jsonandhack up -don a preflight-ready project, using the same installed candidate frontend throughout.Compatibility: older executors cannot prove setup-only quiescence. Before upgrading an old version that was set up but never started, finish its setup and use its selected frontend to start a project and then stop it until runtime status is
stopped. Unknown state still refuses; no receipts are deleted. Direct HTTPS is required by frontend setup because proxy variables are not inherited; the complete offline input form remains available. Improvingps/down/logsdiagnostics on a wholly absent home is outside this change.Fixes HACK-2193. The shared versioned installation inspection is available to HACK-2189.
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.