building '/nix/store/hqcviqaakc7fi72c0wssmf4y4mcdamgr-effect-release-packages-env.drv'...
CI-RUN-CONTEXT: branch=main is_main=true
RELEASE-CLONE-START: https://github.com/cameronraysmith/vanixiets.git f41e741270e9a382a9b1de33bbe278568f17e00f
RELEASE-PACKAGES-ACTION: release
packages discovered: [{"name":"docs","path":"packages/docs"},{"name":"evidence-worker","path":"packages/evidence-worker"}]
RELEASE-PACKAGE-ITERATION: packages/docs
running semantic-release in packages/docs...
[5:25:24 AM] [[secure]] › ℹ Running [secure] version 25.0.9
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/changelog"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/changelog"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github"
[5:25:24 AM] [[secure]] › ✔ Loaded plugin "success" from "[secure]-major-tag"
[5:25:27 AM] [[secure]] › ✔ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git
[5:25:28 AM] [[secure]] › ✔ Allowed to push to the Git repository
[5:25:28 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/changelog"
[5:25:28 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/changelog"
[5:25:28 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github"
[5:25:28 AM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication
[5:25:28 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github"
[5:25:28 AM] [[secure]] › ℹ Found git tag @vanixiets/docs-v0.13.0 associated with version 0.13.0 on branch main
[5:25:28 AM] [[secure]] › ℹ Found 6 commits since last release
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Found 1 commits for package @vanixiets/docs since last release
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions
Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a6964
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ The commit should not trigger a release
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Analysis of 1 commits complete: no release
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/release-notes-generator" does not provide step "analyzeCommits"
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/changelog" does not provide step "analyzeCommits"
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "@[secure]/github" does not provide step "analyzeCommits"
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ Plugin "[secure]-major-tag" does not provide step "analyzeCommits"
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] [[Function: [secure]-monorepo]] › ℹ No more plugins
[5:25:28 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "[Function: [secure]-monorepo]"
[5:25:28 AM] [[secure]] › ℹ There are no relevant changes, so no new version is released.
RELEASE-PACKAGE-OK: packages/docs
RELEASE-PACKAGE-ITERATION: packages/evidence-worker
running semantic-release in packages/evidence-worker...
[5:25:29 AM] [[secure]] › ℹ Running [secure] version 25.0.9
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/npm"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "verifyConditions" from "@[secure]/github"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "analyzeCommits" from "@[secure]/commit-analyzer"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "generateNotes" from "@[secure]/release-notes-generator"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "prepare" from "@[secure]/npm"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/npm"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "publish" from "@[secure]/github"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/npm"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "addChannel" from "@[secure]/github"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "success" from "@[secure]/github"
[5:25:30 AM] [[secure]] › ✔ Loaded plugin "fail" from "@[secure]/github"
[5:25:32 AM] [[secure]] › ✔ Run automated release from branch main on repository https://github.com/cameronraysmith/vanixiets.git
[5:25:33 AM] [[secure]] › ✔ Allowed to push to the Git repository
[5:25:33 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/npm"
[5:25:33 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/npm"
[5:25:33 AM] [[secure]] › ℹ Start step "verifyConditions" of plugin "@[secure]/github"
[5:25:33 AM] [[secure]] [@[secure]/github] › ℹ Verify GitHub authentication
[5:25:33 AM] [[secure]] › ✔ Completed step "verifyConditions" of plugin "@[secure]/github"
[5:25:33 AM] [[secure]] › ℹ Found git tag v0.6.3 associated with version 0.6.3 on branch main
[5:25:33 AM] [[secure]] › ℹ Found 2272 commits since last release
[5:25:33 AM] [[secure]] › ℹ Start step "analyzeCommits" of plugin "@[secure]/commit-analyzer"
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(web-verification): record evidence storage, serving and publication decisions
Change-Id: Ia9e34df0d5f987012bb0c6ab7b7abd356a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): publish browser evidence on build_finished and main pushes
Change-Id: Iefc0a86c16780cfc0e3510a99d9844416a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(publish-evidence): publish each distinct report once and comment only on pull requests that change it
Change-Id: I10c6813e147769c60a45d62b4153d7de6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(evidence-worker): serve browser evidence read-only from R2
Change-Id: I74a6a4974b4dd6c81fb45a27267e87786a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(terranix): adopt the sciexp R2 bucket and own its lifecycle rules
Change-Id: I72ccef728d044fca6ac751d3412629636a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): provision R2 evidence credentials for the effects runner
Change-Id: If5d2b9f244dece12246fe7962d4224086a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 1f817ce55e449026c169c51d0db567d1c335fb93 into gitea-mq/batch/57
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(clan): replace per-machine builder modules with a nix-builders service
Change-Id: I190a8bbe177d27389703a5f887d3e86e6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): mark queued pull requests and add a dequeue key
PR tags now show whether a PR is queued to land: an open PR with auto-merge
enabled, or carrying the merge-queue label (a stack's top), renders #N⇡
next to its bookmark. Merged (✓) and closed (✗) still take precedence, and
the reused-branch rule is unchanged. jj-pr-sync fetches the two extra fields
in the same request.
`jj-pr dequeue`, bound to G d in jjui, withdraws the GitHub signal that
authorized landing: auto-merge is disabled, or the merge-queue label is
removed. gitea-mq treats both as a dequeue, including from an in-flight
batch. An unqueued PR is a no-op; a merged PR reports when it merged, since
a landed batch cannot be undone. Each change refreshes the tags at once.
jj-pr-tags-rehearsal gains rows for the queued marker on a single PR and a
labelled stack top, and for every dequeue outcome, judged by the gh
mutations made.
Change-Id: Ic011d2e749a8b10228253cf10ff018376a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix
Change-Id: Ie1ca1c075cb5cc70fe50173fcc480d096a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep runner-control deadlines above browser setup under load
Playwright's test deadline also covers context and page setup. Under builder
load setup exceeded the 5 s deadline, so controls failed as test-level
deadlines (infrastructure) before their own failure ran (nixbot builds 1000,
1001). Each control's failure stays bounded by its own mechanism.
Change-Id: Ic05f5683ec74a702033b0c40688995e56a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge bec748fc0a820563329385f1a04e0096b94da7be into gitea-mq/batch/55
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(jj): show pull request numbers next to bookmarks
jj has no forge integration, so which bookmark is which PR was invisible in
`jj log` and jjui, and enqueueing meant leaving the graph for gh-dash.
- `jj-pr-sync`, run once in a repository, registers it and caches
`gh pr list` as a jj config file in conf.d scoped to that repository
(`--when.repositories`). A branch name reused across PRs maps to its open
PR, else its newest; merged and closed PRs are marked ✓ and ✗.
- A user service (launchd agent on darwin, systemd timer on Linux) runs
`jj-pr-sync --all` every five minutes at background priority. A refresh
that cannot reach GitHub keeps the previous mapping; a repository that no
longer exists is unregistered; a lock prevents overlapping runs.
- An override of `format_commit_labels(commit)` keeps jj's builtin labels and
appends each bookmark's PR number, in `jj log` and jjui alike.
- jjui, on a revision's bookmark: `G o` opens its PR; `G m` enqueues a single
PR (auto-merge, rebase) and `G M` labels the topmost PR of a stack
merge-queue, mirroring gh-dash's m/M. `jj-pr` applies the landing
protocol: it refuses drafts, auto-merge on stack members, and labels on
anything but a stack's top, and is a no-op when already enqueued. Each
action refreshes the tags immediately.
jj-pr-tags-rehearsal runs against a stubbed gh in scratch jj repositories:
registration and rendering (reused, merged, slash-named and PR-less
bookmarks; no leakage into another repository), --all refresh, offline
retention and unregistration, every enqueue decision judged by the gh
mutations made, no G-prefix collision with the packaged jjui's default
bindings, and drift of jj's builtin format_commit_labels.
Change-Id: I7468279a834fb1fea2876295a64c921a6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(secrets): rotate the Cloudflare effects token
The docs preview and production effects, and the local docs recipes, used
a user API token that expires on 2026-10-24. They now use an account API
token (vanixiets-effects, expiring 2027-10-02) limited to Workers: Editor
on the account and Workers Routes: Write on the cameronraysmith.net zone,
which serves the docs custom domain. Updated in secrets/shared.yaml and in
magnetite's vanixiets-effects-secrets var; the account ID and GitHub token
are unchanged, only re-encrypted.
Change-Id: I24963c05cb0bfc454231e0280b6709476a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: claude-code: 2.1.286 -> 2.1.288
Change-Id: Iacd4ed321e4898358b12d43f02590c366a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix
Change-Id: I09dee06e0e5db47e519e3bc3354891416a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency @types/node to ^26.6.4
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep WebKit failure screenshots in Darwin build reports
On aarch64-darwin, Nix build users have no LaunchServices database, so WebKit's image encoder returns an empty data URL and Playwright writes a 0-byte failure screenshot without raising an error. The report validator rightly rejects empty attachments, so a WebKit product failure on Darwin kept no report. A shared test fixture now replaces a 0-byte WebKit screenshot with the latest screencast frame, or fails the attempt as infrastructure if none exists. e2e-webkit-negative-control proves that a WebKit failure keeps a real PNG.
Change-Id: I01c2ad58cb950529278fb87dda109414ead21c09
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): give each browser report build its own preview ports
Darwin Nix builds are unsandboxed and share the host network, so report derivations built at once all served on localhost:4321 and raced for the workerd inspector port from 9229; one build's server broke another's tests. The report build now picks a free loopback port and passes it to Playwright as DOCS_PREVIEW_PORT, and sets DOCS_DISABLE_WORKER_INSPECTOR so astro preview opens no inspector. Local runs keep 4321 and the inspector.
Change-Id: Ia0c3192bbfed2940fbd062e68105432e6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep the homepage hero within narrow viewports
The homepage hero uses raw ![]()
markup inside Starlight's .hero-html wrapper, which Starlight sizes but does not constrain. On phones the image overflowed and widened the layout viewport past the device, cutting off the logo and header search. The mobile scenario now requires no horizontal overflow and a hero image inside the viewport; it failed on all three engines before the CSS fix and passes after it.
Change-Id: Id64a1dfa32e0a68946327dba89fc8362f7f62473
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): publish validated browser evidence from finished builds
publish-evidence is the trusted build_finished sidecar. It finds the docs report check through nixbot's build API, validates it with its own copy of validate-report.mjs, and copies run.json, completion.json and the referenced PNG screenshots beside a deterministic receipt. Unsafe paths, symlinks, non-PNG data and identity mismatches are rejected; missing outputs are reported, never rebuilt. No effect runs it yet: storage, access and retention are undecided, so publication ends at a local --out directory. publish-evidence-rehearsal covers each case against a loopback API and a chroot store.
Change-Id: I9adcceeed84b3fe7e7c86c572fdc8f5b5a0d7b02
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(agents): relock root apm lock for the playwright-cli skill
The planning-and-development plugin gained the microsoft/playwright-cli skill dependency in #3265. The root lock follows published plugin refs on main, so it could only record that dependency after the merge.
Change-Id: I9d4bfe9b21276c10c2ef01b88c6d689389875957
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge cb6fceccfd628dca78c94bf290a8012922987d56 into gitea-mq/batch/51
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 81224d254ba7ee571a4299b021c7eec338b0bc48 into gitea-mq/batch/50
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(docs): type the browser evidence tooling
Change-Id: I356b84749e0208e8cb45b4cfa884595b6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): keep browser evidence valid under CI build contention
nixbot build 951 failed correct docs changes with navigation timeouts while three PRs built on magnetite. The builders run cores = 0, so each concurrent report build got NIX_BUILD_CORES=16 and started 16 workers against its own astro preview, and the validator rejected the run even where retries recovered, because it required every failed attempt to be a product failure.
Report builds now run at most four workers. Navigations no longer have their own 10 s deadline, since a failed navigation is never product evidence. An infrastructure-class attempt, including a test deadline, is accepted only when a later attempt of the same test completed, and is counted as infrastructureRetries; a terminal one still invalidates the report. The negative controls inherit the suite's retries and require every attempt to fail with a product-class terminal attempt.
Change-Id: I50a0cab69083ddca584cdea07880a5d7a03f0963
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge d23c077f79b6e0df7e6f89cc5a15629882201f39 into gitea-mq/batch/49
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track playwright-cli's flake upstream instead of a rev pin
The input was pinned to a commit of halfwhey/nix-playwright-nightly, but
the CLI release is already fixed in pkgs/by-name/playwright-cli
(version 0.1.21, read from the flake's pins/cli/0.1.21.json), and
apm-skills-compose guards that version against the skill's apm.yml ref.
Upstream keeps every release pin (0.1.5 through 0.1.22, none ever
deleted), so tracking its default branch cannot change what we build;
the commit pin only routed this input through Renovate digest PRs
instead of the flake-updater bot like the other inputs.
Relocking advances to 59e4df6 (the commit #3268 proposed); the CLI stays
0.1.21.
Change-Id: If28f81c80c8c25ae75eb31597cc4413e6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fa357c817941e5ec5128060962347991454ddc9 into gitea-mq/batch/48
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 42d26efa13b47b99956ee33f3a973412c99b9bb1 into gitea-mq/batch/48
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: openspec: update artifacts for 1.11.0 -> 1.14.0
Regenerated with `just openspec-regen`. The vendored workflow skills were
last generated by 1.11.0 while the packaged CLI is 1.14.0. Every removed
line traces to OpenSpec v1.11.0's own templates, so no local text is
lost; the skill set is unchanged.
Change-Id: I30a25ccf3763955308b686890f9e10786a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix
Change-Id: Idfa8f8dee160ce27f5c3a900de4c4e616a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(darwin): stop the DNS resolver check aborting activation
The post-activation check read the active resolver with
`scutil --dns | awk '... { print; exit }'`. awk exited after the first
match while scutil was still writing; scutil then died of SIGPIPE, and
under the activation's pipefail the `$(...)` assignment failed with 141
and set -e aborted activation (seen on stibnite once its resolver list
grew). awk now keeps reading to the end and prints only the first match.
Change-Id: I677b7ec56ea4b1350aceeb8f3d4304156a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: ci: evaluate without import-from-derivation
nixbot now evaluates with allow-import-from-derivation = false, through
NIX_CONFIG on its unit, which nixbot forwards into its evaluator sandbox;
buildbot-nix and interactive use are unaffected. `just check-ifd` runs the
same evaluation locally for all three systems without building anything.
The flake deliberately leaves the setting out of nixConfig: with
accept-flake-config it would override both the command line and nixbot's
NIX_CONFIG.
preferences-nix-development records the rule: why IFD is avoided, the
IFD-free patterns, the enforcement, and the bar for an exception.
Change-Id: I98fc5ca74a8db78ac2dd8bc96f97a0e66a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(cryolite): require import-from-derivation-free rendering
The cryolite tree and the capi-cryolite render must evaluate on every
system with import-from-derivation disallowed: charts, CRDs and upstream
YAML enter evaluation only as committed JSON goldens or flake-input
files, and a sandboxed regulator re-renders and diffs them. Adds R17,
SP24 and AC24 to the charter, requirements and tasks to both OpenSpec
changes, tightens the platform VM regulator's chart sourcing, and
corrects the statements that still listed the retired nixidy checks.
Change-Id: I25b495d6d47706cc95b1432f4173d9b76a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(checks): retire the local k8s and nixidy checks
The k8s-manifests-local*, nixidy-*-local-k3d and k8s-cilium-compat checks
and the k8s-deploy-* apps in apps-build rendered Helm charts and YAML at
evaluation time, about 29 evaluation-time builds per system for output
identical on every system. The local cluster is a frozen prototype; the
code stays and remains buildable on demand. The cryolite programme
reintroduces cluster checks with IFD-free rendering.
Change-Id: Ie302e3d90e4f0b754b2014694eff54866a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(omnigent): test the credential policy without a synthetic clan machine
omnigent-worker-credentials evaluated a synthetic clan machine over a
committed tree of fake sops secrets, only so clan's sops backend would
resolve vars paths, and mostly asserted that options forwarded those
paths. It also needed import-from-derivation.
- flake.lib.omnigentCredentialPolicy is the one pure boundary from clan
vars to the worker credential policy; the Home Manager module consumes
only the policy record, including the rendered Linear credentials.
- Value-level cases cover what the boundary decides: disabled sources are
omitted, Linear requires the rendered template, no Linear means no
template.
- Delivery ordering (secrets installed before workers start, readiness in
the host unit, rendered template required instead of the raw key) is
asserted on the real worker hosts: magnetite, pyrite and stibnite.
- Runtime behaviour (credentials.py readiness, the TS loader, gh and
Linear mocks, disclosure audit) stays a hermetic build fed synthetic
paths.
The fixture tree and the forwarding assertions are deleted.
Change-Id: Iafadccceba9fa05233c7ede63ceb61c36a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(catppuccin): read bottom and starship themes from flake inputs
catppuccin's bottom and starship ports importTOML their theme from
whiskers build outputs, the only import-from-derivation in the
configurations of christophersmith, janettesmith, raquel, tara and
ubuntu. Both ports stay enabled and read the committed themes/ of the
same upstream revisions, pinned as flake = false inputs.
Change-Id: Ia61f24b77f899c75edae5055a7f9f22b6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(skills): enumerate skills from a committed index
Skill delivery read the built apm-skills-compose output with readDir at
evaluation and wrapped every skill in builtins.path, realising that
unsubstitutable output once per skill per sink (514 realisations per AI
user, 1028 for stibnite). Every NixOS, darwin and home configuration of
the AI users therefore needed a builder for its own platform just to
evaluate.
- pkgs/by-name/apm-skills-compose/skills.json lists the composed skill
names; the compose build fails, printing the corrected index, when the
two drift, and `just agents-skills-index` regenerates it.
- Skills are `"${composed}/.claude/skills/"` strings with context:
no read, no builtins.path. Home Manager passes such sources through.
- aiSkills.extraSkillDirs (directories read with readDir) is replaced by
aiSkills.extraSkills (name to directory) for linear-cli, tuicr and
omnigraph.
The delivered skill set is byte-identical: 696 home.file entries per AI
user before and after.
Change-Id: If1ae8e9f5a648670680e900fdf37ceac6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nixpkgs): expose flake packages only for supported systems
nixpkgs re-applies the default overlay to nested package sets such as
pkgsi686Linux. withSystem on i686-linux then evaluated a whole perSystem
whose packages read per-system flake outputs that do not exist there
(playwright-cli), so nixosConfigurations.scheelite failed to evaluate
with `attribute 'i686-linux' missing`. The overlay now adds the flake's
packages only for systems in config.systems.
Change-Id: Iab8193713bde096ba3b9543ffa3e48fa6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(incidents): record the magnetite concurrent-evaluation OOMs
Accounting for the 2026-09-27 and 2026-10-01 OOM kills: nixbot's
evaluation overlapping a remote check-fast evaluation, the swap-blind
nix-eval-jobs governor, the uncharged zram pool, and victim selection by
nix-daemon's OOMScoreAdjust; the mitigations shipped and the measurements
left for phase two.
Change-Id: Ifa6aeee15ba01cd5f7711787f65f55626a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(just): choose the remote host for check-fast
check-fast takes a fourth parameter, remote (magnetite by default, or
pyrite), and sizes evaluation for it: magnetite keeps 4 eval workers,
pyrite runs 2 with a 2 GiB per-worker cap. Remote evaluations now queue
behind nixbot's on the host lock. The skill, agent-context fragment and
docs describe the parameter and the waiting message.
Change-Id: I367b756e6a4ec00cf61bd42ebd398b136a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(magnetite,pyrite): enable the evaluation lock and memory guards
Both hosts enable the evaluation lock and MGLRU protection. pyrite also
caps zram's resident pool at 55% of RAM, the recorded livelock mode;
gives nix-daemon OOMScoreAdjust 250 and user@ -100, so builds and
evaluators are killed before niri and DankMaterialShell; and caps its two
omnigent workers at 8G combined, which previously could reach 16G on a
15.5 GiB machine. Stale headroom comments on magnetite and in buildbot.nix
are corrected. nixbot's worker count, memory limits and magnetite's zram
are unchanged. nix-eval-lock-wiring asserts nixbot and buildbot resolve
nix-eval-jobs to the wrapper on both hosts.
Change-Id: Iba3b9e2f3975daae2e61dee23989ff416a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nixos): add memory-pressure guards and an omnigent slice cap
services.memoryPressureGuards enables MGLRU thrashing protection
(min_ttl_ms = 1000), which makes sustained thrashing end in a prompt
kill instead of a livelock. services.omnigent-host.workerSliceMemoryMax
places all omnigent workers in one omnigent.slice with a combined
MemoryMax; unset keeps the existing per-unit limits.
Change-Id: Ib183fb9a53c9cd7c920166b1f486d1096a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(nix): serialize nix-eval-jobs behind a host-wide evaluation lock
Two concurrent nix-eval-jobs evaluations on magnetite (nixbot's 8 workers
plus a remote `just check-fast`) exhausted RAM and zram twice. A wrapper
now takes an exclusive flock on /etc/nix/eval.lock before evaluating, so
evaluations on a host queue instead of overlapping; a waiter prints every
30 s which process holds the lock and since when (or that the holder is
not visible from its sandbox). The evaluator then raises its own
oom_score_adj to 900: nix-eval-jobs requeues a worker the kernel kills,
so it is the cheapest victim.
services.nixEvalLock provides the wrapper; nixbot, buildbot-nix and the
home-manager nix-eval-jobs on PATH use it when enabled, which also covers
remote nix-fast-build sessions. nix-eval-lock-rehearsal drives the
wrapper: uncontended exec, waiting with and without a visible holder,
release on holder death, exit status propagation.
Change-Id: I9e6643ac44790eb0ffe00294d082b5956a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update cloudflare-workers-tooling
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: describe both verdict wiring negative fixtures
Change-Id: Ied7532ff7d45fdf5c6e2c2feb7412d246a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): run report verdict CLI through symlinked paths
Change-Id: I2084d4f6f61b99a554bb7330b8ae09136a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(docs): retain browser regression evidence and version observations
Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: test(nix): verify report dependencies and aggregate capabilities
Change-Id: If6d1644ec30318b99cf7addf56e59b2a6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(effects): require permission guards for credentialed build-finished events
Change-Id: I5db749b6056044f701cac83b8030fe116a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs: specify the closed-loop web verification reference design
Change-Id: If14f8d7b146627ee546faa5eacbd97cc6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(docs): preserve browser evidence behind a required verdict gate
Change-Id: Iaf02384766e531cc30c510abd62877cf6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(effects): support build-finished event registration
Change-Id: I0489702282e4a89827bcd0b02a3caa906a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(ai): compose Playwright skills through shared APM capabilities
Change-Id: Ifef0eea7fb531d088f68e89f482799a16a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(packages): add pinned Playwright CLI with matching browsers
Change-Id: I1c568c44d8960ffd22c1bdb04965b3826a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate bun.nix
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): regenerate flake.lock
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(deps): update dependency @astrojs/starlight to v0.42.5
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(deps): update dependency argoproj/argo-helm to argo-cd-10.9.6
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omp): plan with Opus 5.5 instead of Fable
Opus 5.5 now runs planning as well as the session and delegated work,
so the plan comes from the model that executes it, at 40% of Fable's
price. Fable stays available when picked deliberately, and the Anthropic
server-side fallback stays on for those sessions.
Change-Id: Ic790baf18c08c434908f94e7fb52c7446a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(atomic): use Opus 5.5 instead of Opus 5
atomic stayed on claude-opus-5 because its bundled model registry
(@bastani/pi-ai) did not know claude-opus-5-5. Since atomic 0.9.24 it
does (providers/data/anthropic.json; `atomic --list-models` lists it),
so the Opus fallback, the codebase-* research agents and the Opus
thinking level move to claude-opus-5-5, matching omp and Claude Code.
The omp comment recording the exception is removed.
Change-Id: I4722e4acb437418ce1dc6d024b61f9526a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(claude-code): default to Opus 5.5 instead of Fable
The session model was Fable 5.1 with Opus 5.5 only for subagents. Opus
5.5 is now the default for both: `model = "opus"`, which resolves to
claude-opus-5-5 through ANTHROPIC_DEFAULT_OPUS_MODEL. Fable stays one
alias away (ccfable) and keeps its medium effort setting.
fallbackModel moves from Opus, which is pointless as its own fallback,
to Sonnet 5.
Change-Id: Ic5cd168d981e22c119a154e8d41fa1796a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(moshi): reconcile hooks after managedConfigs
moshi-hook install writes into every supported agent's config, devin's
included, which turned devin's store symlink into a regular file and
made every second activation block on a .before-home-manager backup
collision. The reconcile step was ordered after a hand-kept list of four
per-agent steps that did not include devin.
It now runs after the single managedConfigs step, which rewrites every
file moshi touches, and managed-config-wiring asserts both halves: every
config moshi writes for an enabled agent is a managed config and none is
also a home.file target, and moshi orders after managedConfigs.
Change-Id: I086a785cc40a31183d04eb0d4778ed426a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: refactor(ai): manage agent config files with managedConfigs
Eleven agent configuration files moved from five mechanisms (install
copies behind mutableSettings toggles, a shallow jq merge, two deep yq
merges, and plain store symlinks) to managedConfigs:
- replace (no app-owned keys): claude-code and its glm and cerebras
wrappers, codex, pi, devin, openspec, omp WATCHDOG.yml;
- with app-owned keys: atomic (onboarding and changelog versions), omp
config.yml (setupVersion, dev.autoqaConsent), omnigent (host identity
and server, 0600).
The mutableSettings options, six activation steps, the three merge
scripts and flake.lib.omnigentMergeConfig are removed. devin and
openspec no longer render store symlinks; openspec declares
completionTipSeen and atomic declares enableAnalytics = false so the
first activation keeps both. crs58 declares the omp UI preferences
(tui.vimMode, tui.vimModeDisplay, composer.shape) instead of relying on
runtime state. The atomic, omnigent-worker and pi-agent-environment
checks exercise the new program and wiring.
Change-Id: Ie3e1e56e8b65f66e1df9bf289b3522046a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(home): add managedConfigs for files applications also write
A configuration file that its application rewrites at runtime cannot be
a home-manager store symlink: the first runtime write replaces the link
with a regular file, the next activation backs it up, and the one after
collides with that backup and blocks.
managedConfigs. writes such a file as a real file on every
activation: the declared settings, plus the `appOwned` key paths copied
from the existing file. Every other key is dropped and reported by name,
never by value, so state that leaked in at runtime is either declared,
listed as app-owned, or removed, and keys Nix stops declaring are
retracted. `externalPaths` keeps subtrees that a later activation step
rewrites out of the report. Writes are atomic, honour `fileMode`, and a
target that cannot be read is left untouched when app-owned keys would
have to be preserved from it.
The module lives in modules/home/modules beside agents-md because it is
not specific to any aggregate. managed-config-rehearsal drives the
program over json, yaml and toml targets, including preservation,
retraction, the name-only report, unreadable targets, file modes and
multi-spec failure.
Change-Id: I989f1589b7c10542e045a9c4c88308c36a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Update flake inputs: llm-agents.nix
Change-Id: Id494be9893dc2095a1fe045d6b3d6e8a6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml for the linear-cli dependency
Records schpet/linear-cli at 196315343d2b (v2.6.0), added to
planning-and-development by #3262, with the ownership ledger for the 22
files its skill deploys, and moves the self-dependency entries to d5d75ca5.
apm 0.32.0; 173 skills deployed.
Change-Id: I45b6531bef4542b526eb8373ffc445cd6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 3fb87c3881da98fe3f2b18b60ffeeccd9953f25a into gitea-mq/batch/43
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: Merge 19610a72e7d680cd426bdb52d58795935f22ac15 into gitea-mq/batch/43
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(flake): track niri-flake and zen-browser upstream instead of rev pins
The pyrite desktop check once asserted niri-flake's revision as a literal,
so every flake-updater lock bump failed by construction (#3101, #3102,
#3169). #3232 answered that by pinning the URL by revision and having the
check assert `pinnedToDeclaredRev`, which passes only when flake.nix names
a revision: the check enforced the pin it was meant to justify, and
niri-flake and zen-browser moved to Renovate digest PRs while every other
unpinned input goes through the flake-updater bot.
Both inputs now track their upstream default branch like the rest, and
the two pinnedToDeclaredRev clauses and their helpers are gone. The
behavioural assertions stay: niri's options come from nixpkgs' module,
and the installed Zen package is the one zen-browser provides, built
against our nixpkgs. dms-src keeps its release-tag pin, which encodes a
real coupling to nixpkgs' dms-shell version.
Relocking advances niri-flake to dd2f795 (the commit #3261 proposed);
zen-browser's upstream head is the commit it was pinned to.
nixos-pyrite and every pyrite-* check build on x86_64-linux.
Change-Id: I16223a5ba0d1e1889c94f935d868a9aa6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: docs(skills): list companion skills for marketplace consumers
Add a Companion skills section to the consuming-marketplace-plugins guide
with upstream `apm install` lines for omnigraph, tuicr, duckdb-skills,
dagster-expert, hf-cli and huggingface-datasets. They complement
plugins here but are deliberately not bundled: bundling would add their
descriptions to every consumer's sessions and hold them at our pins.
Each command was run with apm 0.32.0 and installs exactly the named
skills; tagged upstreams use release tags per the pinning policy, the
tagless ones carry commit SHAs with the policy's caveat.
Transitive dependencies now names the linear-cli skill that
planning-and-development brings.
Change-Id: I99457cfd1e89b6128737470e9d3a8ded6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(omnigraph): deliver the upstream omnigraph skill with the client
Wire `${programs.omnigraph.package.src}/skills` into aiSkills.extraSkillDirs,
as tuicr does, so the skill comes from the same pinned source the client
and server are built from and always describes the deployed version
(currently v0.11.0).
The definition lives on the ai aggregate in the same file, guarded on the
omnigraph option existing and being enabled: tools reaches users without
ai (christophersmith, janettesmith, raquel, tara), where an aiSkills
definition would fail to evaluate.
Change-Id: I4ae90fe76122ef1c0423bb07a4b917e66a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: feat(skills): propagate the linear-cli skill through planning-and-development
openspec-linear-sync, which planning-and-development ships to marketplace
consumers, drives the linear CLI, but the upstream linear-cli skill
reached only Nix users (flake.lib.linearSkillDirs). A consumer who
installed the plugin with apm got a skill whose dependency was missing.
- apm.yml declares `git: schpet/linear-cli`, ref 196315343d2b (the v2.6.0
tag commit), `skills: [linear-cli]`; a scratch-project
`apm install schpet/linear-cli/skills/linear-cli#` with apm 0.32.0
installs exactly that skill.
- pkgs.linear-cli.src pins that commit instead of the tag name, so one
pin serves the package, apm's offline cache in apm-skills-compose, and
the drift guard. update.sh resolves the tag commit and rewrites both
package.nix and the apm.yml ref, and its platform map now lists only
the two Darwin binaries package.nix pins (Linux builds from source; the
Linux prefetches were downloads with no hash line to update).
- apm-skills-compose pre-seeds the cache from pkgs.linear-cli.src and
guards the apm.yml ref against it; the composed tree goes from 172 to
173 skills.
- Nix delivery is unchanged: linear-cli joins excludedUpstreamSkills, and
Nix users keep receiving it from linearSkillDirs only where they opt in,
from the same pin.
Change-Id: I048122dca5256fb58cc503d4c19fd4b06a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is minor
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(omnigraph): fail startup fast and bootstrap new storage roots once
Deploying #3257 stalled magnetite's switch-to-configuration for the full
start timeout. omnigraph-server v0.11.0 loads the cluster ledger and opens
every graph before binding, and any boot failure (here
[cluster_state_missing] on the new, never-applied dev-graph-v9 root)
exits the process within seconds. The ExecStartPost readiness probe kept
polling /healthz until readinessTimeout because it never noticed the main
process had died.
Readiness probe (flake.lib.omnigraphReadinessProbe):
- polls /readyz and exits 1 at once when $MAINPID is gone, naming the
journal and the apply remedy;
- treats quarantined graphs and, under requireAllGraphs, fewer served
graphs than declared as permanent: the server has no runtime graph
registration, and an imported-but-never-applied root boots empty yet
passes /healthz;
- keeps 503 and ready=false transient until the timeout.
Create-once bootstrap (flake.lib.omnigraphBootstrap, unit
omnigraph-cluster-bootstrap, option cluster.bootstrap.enable, default on
with the cluster): `cluster status` decides whether the root has state,
and a marker at /_omnigraph-markers/.initialized (outside
the root's key prefix, so deleting the root never deletes it) records
that it ever had state:
- state and marker: nothing;
- state, no marker: adopt the existing root by writing the marker;
- no state, no marker: first initialization, runs the existing
converge program, then writes the marker;
- no state, marker: a lost root; refuse without applying.
That initializes a new storageUri on deploy while keeping the protection
that holds apply.auto off: a lost root is never recreated empty. S3
markers use curl SigV4 path-style requests with credentials passed on
stdin; local roots must sit under /var/lib/omnigraph, the only directory
the hardened units can write. The server Wants (not Requires) the
bootstrap, so a refusal stays visible and the server then fails fast.
Checks: omnigraph-readiness-rehearsal and omnigraph-bootstrap-rehearsal
drive the real scripts against loopback HTTP/S3 stubs and a stub CLI
(every probe outcome; the truth table for both marker backends, apply
and status failures, S3 errors, missing endpoint, rejected roots,
SigV4 path-style signing). omnigraph-wiring asserts magnetite's unit
ordering and that the server's ExecStartPost is the new probe.
Change-Id: I931bf6ff300ba859422474546798e1d96a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(apm): relock apm.lock.yaml against main and apm 0.32.0
Follows #3257. The vanixiets self-dependency moves to 8aa5fb47; the
transitive worktrunk and mergify-cli entries move to the v0.80.0 and
2026.9.16.1 commits that version-control-and-forge/apm.yml now pins; the
comment-cleanup ledger records uncomment.toml instead of
uncommentrc.toml; content hashes follow the updated skills.
Change-Id: I5a8c3678bf1382d0eaf1a42edb5a5b556a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(apm-skills-install): relock from an empty apm_modules cache
apm 0.32.0 `install --update` re-fetches an already-materialized
dependency only when its ref is a semver range
(should_force_ref_recheck, src/apm_cli/drift.py:174-193). A literal
commit pin that changed in a dependency's own manifest reuses the cached
checkout and writes the old resolved_commit back into apm.lock.yaml.
Plain `apm install` does detect that drift; --update does not.
Observed after #3257 moved the worktrunk and mergify-cli refs in
version-control-and-forge/apm.yml: the relock kept de0052d8 and
727ce50b. Relock now removes the git-ignored apm_modules/ cache first,
so every dependency is resolved from its declaring manifest. Ownership
of deployed files lives in the lockfile ledger, so the only cost is a
re-fetch.
Reproduced and verified: with main's lock and the old worktrunk checkout
materialized, the patched relock resolves b49ca7ee/e7c1ebbc and matches
a cache-free relock byte for byte apart from generated_at.
Change-Id: I802a23af0d15cbaa526857556f6eede06a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigent): 0.15.0 -> 0.16.0
Upstream: https://github.com/omnigent-ai/omnigent/compare/v0.15.0...v0.16.0
omnigent, omnigent-client and omnigent-ui-sdk move together (wheel
hashes from the PyPI JSON digests). Only the version-locked pins change
in pyproject; the existing relaxations and overrides still hold.
acp-readiness.patch is still needed (0.16.0 still reports acp readiness
only for the bare `acp` harness) and is rebased: the ACP branch moved
into _harness_availability_core behind a new Windows guard. The readiness
test passes in the build.
Upstream breaking notes #8137/#8143 (65,535-byte caps on saved
preferences and inference snapshots) affect server-side data only. The
host CLI surface, config keys and environment variables our modules use
are unchanged.
Change-Id: I242bf10d54e879d31acbef5573af65ed6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(mergify-cli): 2026.8.31.1 -> 2026.9.16.1
Upstream: https://github.com/Mergifyio/mergify-cli/compare/2026.8.31.1...2026.9.16.1
Bumps mergify-cli-bin and, in lockstep, agent-plugins/mergify-cli
(version, releaseTag, tag commit) and the version-control-and-forge
apm.yml ref.
#1833 removes `mergify stack push --github-native`: native stack
registration is now the default (opt out with --no-github-native or
mergify-cli.stack-github-native=false). The git-stacked-pr-integration
skill and the adopt-queue-landing-protocol specs now publish with
`mergify stack push --trunk origin/main -R` and require the default to
stay on; the ADR note and its review keep their history with a dated
note.
#1803/#1806/#1807 add `mergify auth login|logout|status`; the
mergify.nix comment now documents the non-stack credential chain.
Change-Id: I323e343a51842dcf02a1a198766125796a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: fix(nix-fast-build): do not propagate python into consumers
The package's propagated build inputs put its site-packages on
PYTHONPATH in every devshell that includes it, which overrides the
wrapper of any other nix-fast-build binary run from that shell (a newly
built one loads the old module). Remove
$out/nix-support/propagated-build-inputs in postFixup, exactly as
upstream's default.nix does.
Change-Id: I5ce01d321cdfe1770858b78250f573856a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is patch
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(nix-fast-build): 1.6.0 -> 2.0.4
Upstream: https://github.com/Mic92/nix-fast-build/compare/1.6.0...2.0.4
2.x renders build logs itself: nix-output-monitor is dropped from the
wrapper PATH, --no-nom now selects the non-interactive renderer, and
interactive mode turns itself off without a TTY. --no-link is a
deprecated no-op (no out-links is the default), so check-fast stops
passing it. Every other flag our recipes pass is unchanged; --option now
reaches every nix call. The CI/CD skill's --no-nom description follows.
Change-Id: Icc74b794021b6725bbdc47cd2277bc356a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(worktrunk): 0.76.0 -> 0.80.0
Upstream: https://github.com/max-sixty/worktrunk/compare/v0.76.0...v0.80.0
Bumps worktrunk-bin and, in lockstep, the agent-plugins/worktrunk source
and the version-control-and-forge apm.yml ref (the apm-skills-compose
drift guard requires both to name the v0.80.0 commit).
Breaking upstream changes (0.77-0.80): wt list --format=json defaults to
schema 2; hook JSON context keys renamed to worktree_path / repo_path /
repo / primary_worktree_path; `wt config update --print` removed;
oh-my-pi plugin moved to `wt config plugins omp`; `{{ branch }}` unset in a
detached worktree. None is used here: the only config is
programs.worktrunk enable + package.
Change-Id: I08b82b5e98fec40122348980c3481fb76a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(uncomment): 3.6.0 -> 3.10.2
Upstream: https://github.com/Goldziher/uncomment/compare/v3.6.0...v3.10.2
3.8.0 makes .uncomment.toml the preferred config name (.uncommentrc.toml
still loads with a deprecation warning) and makes unknown config keys a
load error; scan, keep and lint subcommands are new.
Rename the repository-root config to .uncomment.toml and the
preferences-comment-cleanup template to uncomment.toml. The skill now
states behaviour measured against 3.10.2: census via `scan --only
removable --group-identical`, `keep --id` to write ~keep markers, and
`--check` as the completion gate. XXX and tflint-ignore are default-kept
now, so the template drops them.
Change-Id: Ie379fdf60fa2c6e5650467189469dc856a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(ouroboros): 0.42.0 -> 0.55.3
Upstream: https://github.com/Q00/ouroboros/compare/v0.42.0...v0.55.3
0.55 pins mcp==2.0.0 in the [mcp] extra and mcp==1.28.1 in
[claude]/[claude-sdk] and declares them conflicting, so the old
`ouroboros-ai[mcp,claude,tui]` spec no longer resolves. Following the
upstream README, the wrapper uses [mcp,claude-cli,tui] with
`uvx --isolated --python '>=3.12'`, and the claude-code MCP server entry
uses [mcp] with `--runtime claude-cli --llm-backend claude_code`, as
upstream's own .mcp.json does, keeping our exact version pin.
agent-plugins/ouroboros moves to the v0.55.3 tag peel.
Change-Id: I5ac2e15a511b418dc5fa5bb5cbad3f2b6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(omnigraph): 0.9.0-unstable-2026-08-05 -> 0.11.0
Upstream: https://github.com/ModernRelay/omnigraph/compare/12a8596626c80a7dceed0fd72182d421052ff8d1...v0.11.0
The unstable pin existed only because upstream published no releases;
it now does, and v0.11.0 contains the old pin. rev stays a commit sha
(the v0.11.0 tag peel) because OMNIGRAPH_SOURCE_VERSION is read from
src.rev and upstream stamps it with a sha. update.sh now tracks the
latest stable vX.Y.Z release instead of main.
The lance-linalg AVX-512 VNNI postPatch moves to lance-linalg-11.0.0;
the three deleted lines are still present verbatim there.
Cluster config migrated to the v0.11.0 policy schema (strict since
v0.9.0):
- server.policy.yaml drops `kind`; a bundle's kind follows its
`applies_to` in cluster.yaml, which already scopes it to `cluster`.
- dev.policy.yaml drops the `stream_ingest`/`stream_manage` rules and
the `cluster` group: upstream removed the RFC-026 streaming-ingest
path (e1cd395) before v0.9.0, loads go through `change`, which
operators already hold, and cluster apply no longer evaluates policy.
- the omnigraph-cluster wrapper passes `--as` to `apply`/`approve` only;
`cluster stream` no longer exists.
Deploy note: the old pin wrote internal manifest schema v19, an
abandoned format that 0.11 refuses and that `omnigraph upgrade` cannot
migrate. magnetite's storageUri therefore moves to a parallel root
(clusters/dev-graph-v9), following upstream's upgrade.md "same graph ID
in a parallel cluster root" procedure; the old root is untouched as the
export source and rollback copy. Carrying data over is a manual
export (old binary) / load (new binary) on magnetite.
Change-Id: I4db767af7224204fa83f52a56b7f96e86a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(buzz): 0.5.20 -> 0.5.26
Upstream: https://github.com/block/buzz/compare/desktop-v0.5.20...desktop-v0.5.26
Only the shared source changes (src hash, passthru.rev, vendored cargo
hash); buzz-cli, git-credential-nostr and git-sign-nostr inherit it. The
line references in their comments are unchanged at the new tag.
Change-Id: If97c50c44e8c19db3d109f98c235b15d6a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(no-mistakes): 1.60.2 -> 1.84.0
Upstream: https://github.com/kunchenguid/no-mistakes/compare/v1.60.2...v1.84.0
No release in the range is marked breaking. The package's assumptions
hold: internal/buildinfo.Version, empty telemetry host defaults, and the
NO_MISTAKES_TELEMETRY / NO_MISTAKES_NO_UPDATE_CHECK variables.
Change-Id: Ie2d6877297cee4239c1b0f66f3faf4936a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(treehouse): 2.1.1 -> 3.1.0
Upstream: https://github.com/kunchenguid/treehouse/compare/v2.1.1...v3.1.0
3.0.0 makes `treehouse return` (and `treehouse get` when its subshell
leaves the worktree dirty) exit 3 instead of 0; callers need --force or
must treat 3 as not-returned. 3.0.1 adopts pre-3.0 pool state
automatically. The only consumer, modules/home/ai/firstmate, lists the
package without invoking it. The -X main.version ldflag and
TREEHOUSE_NO_UPDATE_CHECK still exist. vendorHash is unchanged.
Change-Id: I9e8389a12507f0270db99e2fa9f03b616a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(atomic): 0.9.19 -> 0.9.24
Upstream: https://github.com/bastani-inc/atomic/compare/0.9.19...0.9.24
update.sh verified the npm tarball against the registry sha512,
regenerated npm-dist-repairs.patch and manifest.json, and learned the new
npmDepsHash from the build.
0.9.20 renames TYPESAFE_AI_API_KEY to TYPESAFE_API_KEY and the Jev router
models from typesafe-ai/jev* to typesafe/jev-latest; nothing here uses
either. 0.9.21-0.9.24 are features and fixes.
Change-Id: Ic89cc417078e62bf7f338e24d6bcd3e16a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The commit should not trigger a release
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analyzing commit: chore(dbt-fusion)!: 2.0.0-preview.101 -> 2.0.6
Upstream: https://public.cdn.getdbt.com/fs/versions.json (latest.tag v2.0.6)
Repository: https://github.com/dbt-labs/dbt-fusion
dbt Fusion is out of preview. Upstream no longer publishes the standalone
dbt-lsp artifact (fs/lsp/fs-lsp-v2.0.6-* returns 404; install.sh says to
run `dbt lsp` instead), so the package builds one src per platform and no
longer installs bin/dbt-lsp. update.sh drops the LSP fetch and rewrites
the single per-platform hash.
BREAKING CHANGE: pkgs.dbt-fusion no longer provides dbt-lsp; use
`dbtf lsp`. Nothing in this repository referenced dbt-lsp.
Change-Id: Ie5f4eb2d8ccb4a60c4648a3cb5719fa36a6a6964
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ The release type for the commit is major
[5:25:38 AM] [[secure]] [@[secure]/commit-analyzer] › ℹ Analysis of 2272 commits complete: major release
[5:25:38 AM] [[secure]] › ✔ Completed step "analyzeCommits" of plugin "@[secure]/commit-analyzer"
[5:25:38 AM] [[secure]] › ℹ The next release version is 1.0.0
[5:25:38 AM] [[secure]] › ℹ Start step "generateNotes" of plugin "@[secure]/release-notes-generator"
[5:25:42 AM] [[secure]] › ✔ Completed step "generateNotes" of plugin "@[secure]/release-notes-generator"
[5:25:42 AM] [[secure]] › ℹ Start step "prepare" of plugin "@[secure]/npm"
[5:25:42 AM] [[secure]] [@[secure]/npm] › ℹ Write version 1.0.0 to package.json in /build/release-packages-clone.aQz2N5/packages/evidence-worker
[5:25:42 AM] [[secure]] › ✘ Failed step "prepare" of plugin "@[secure]/npm"
[5:25:42 AM] [[secure]] › ✘ An error occurred while running [secure]: ExecaError: Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version
spawn npm ENOENT
at getFinalError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/final-error.js:6:9)
at makeError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/result.js:108:16)
at getAsyncResult (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:168:4)
at handlePromise (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:151:17)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async default (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/lib/prepare.js:26:3)
at async prepare (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/index.js:63:3)
at async validator (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/normalize.js:36:24)
at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:38:36
at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:32:5 {
shortMessage: 'Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version\n' +
'spawn npm ENOENT',
originalMessage: 'spawn npm ENOENT',
command: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',
escapedCommand: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',
cwd: '/build/release-packages-clone.aQz2N5/packages/evidence-worker',
durationMs: 10.430134,
failed: true,
timedOut: false,
isCanceled: false,
isGracefullyCanceled: false,
isTerminated: false,
isMaxBuffer: false,
isForcefullyTerminated: false,
code: 'ENOENT',
stdout: '',
stderr: '',
stdio: [ undefined, '', '' ],
ipcOutput: [],
pipedFrom: [],
pluginName: '@[secure]/npm',
[cause]: Error: spawn npm ENOENT
at ChildProcess._handle.onexit (node:internal/child_process:287:19)
at onErrorNT (node:internal/child_process:525:16)
at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
errno: -2,
code: 'ENOENT',
syscall: 'spawn npm',
path: 'npm',
spawnargs: [
'version',
'1.0.0',
'--userconfig',
'/build/c4062d2cd26241c0454c289a09672dc7/.npmrc',
'--no-git-tag-version',
'--allow-same-version'
]
}
}
ExecaError: Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version
spawn npm ENOENT
at getFinalError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/final-error.js:6:9)
at makeError (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/return/result.js:108:16)
at getAsyncResult (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:168:4)
at handlePromise (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/execa@9.6.1/node_modules/execa/lib/methods/main-async.js:151:17)
at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
at async default (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/lib/prepare.js:26:3)
at async prepare (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/@[secure]+npm@13.2.0+7218cc91dc451707/node_modules/@[secure]/npm/index.js:63:3)
at async validator (file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/normalize.js:36:24)
at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:38:36
at async file:///nix/store/6r5330pwwrfvf1jr3m349dx0ff1jai64-vanixiets-docs-deps-0.0.0/node_modules/.bun/[secure]@25.0.9+5d9c14df9042c98f/node_modules/[secure]/lib/plugins/pipeline.js:32:5 {
shortMessage: 'Command failed with ENOENT: npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version\n' +
'spawn npm ENOENT',
originalMessage: 'spawn npm ENOENT',
command: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',
escapedCommand: 'npm version 1.0.0 --userconfig /build/c4062d2cd26241c0454c289a09672dc7/.npmrc --no-git-tag-version --allow-same-version',
cwd: '/build/release-packages-clone.aQz2N5/packages/evidence-worker',
durationMs: 10.430134,
failed: true,
timedOut: false,
isCanceled: false,
isGracefullyCanceled: false,
isTerminated: false,
isMaxBuffer: false,
isForcefullyTerminated: false,
code: 'ENOENT',
stdout: '',
stderr: '',
stdio: [ undefined, '', '' ],
ipcOutput: [],
pipedFrom: [],
pluginName: '@[secure]/npm',
[cause]: Error: spawn npm ENOENT
at ChildProcess._handle.onexit (node:internal/child_process:287:19)
at onErrorNT (node:internal/child_process:525:16)
at process.processTicksAndRejections (node:internal/process/task_queues:90:21) {
errno: -2,
code: 'ENOENT',
syscall: 'spawn npm',
path: 'npm',
spawnargs: [
'version',
'1.0.0',
'--userconfig',
'/build/c4062d2cd26241c0454c289a09672dc7/.npmrc',
'--no-git-tag-version',
'--allow-same-version'
]
}
RELEASE-PACKAGE-FAILURE: packages/evidence-worker (exit 1)
}error: 1 package(s) failed: packages/evidence-worker
error: nix failed with exit code 1