phg/iodd-tool
0
0
Fork 0
Code Issues 5 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Establish mise-driven local prerelease mechanics #29

New issue
Closed
opened 2026-10-16 09:16:41 +00:00 by phg · 2 comments
phg commented 2026-10-16 09:16:41 +00:00
Owner
Copy link

Parent: Plan the signed IODD Tool prerelease
Type: research
Mode: AFK

Question

Which primary-source-backed local release mechanics are available for automating the accepted signed prerelease procedure through mise, and what constraints do they impose on the later human decisions?

Read official mise, Apple and Forgejo documentation/source for pinned local tool prerequisites, explicit task dependencies/arguments, opt-in side-effect stages and private credential references; Developer ID signing of app/ordinary worker/lifecycle helper and DMG, hardened runtime/timestamps, notary submission/stapling and final Gatekeeper checks; and versioned Forgejo prerelease assets plus a separate tap update using the final immutable DMG digest. Verify current command/API details rather than importing a CI pipeline. Cover retry/idempotence and interrupted-stage limitations as facts, not a chosen workflow.

Separate build/source identity, unsigned evidence, final signed/stapled bytes, downloaded bytes and cask SHA-256. Describe what is technically required before the freeze/evidence handoff can be selected. Do not create release scripts, mise configuration, credentials, signed artifacts, releases or tap repositories; do not inspect secret values. Commit one cited report under docs/research/ on research/prerelease-mise-mechanics; link branch, exact commit, artifact and delegated-task context from the resolution.

Parent: [Plan the signed IODD Tool prerelease](https://git.s1q.dev/phg/iodd-tool/issues/27) Type: research Mode: AFK ## Question Which primary-source-backed local release mechanics are available for automating the accepted signed prerelease procedure through mise, and what constraints do they impose on the later human decisions? Read official mise, Apple and Forgejo documentation/source for pinned local tool prerequisites, explicit task dependencies/arguments, opt-in side-effect stages and private credential references; Developer ID signing of app/ordinary worker/lifecycle helper and DMG, hardened runtime/timestamps, notary submission/stapling and final Gatekeeper checks; and versioned Forgejo prerelease assets plus a separate tap update using the final immutable DMG digest. Verify current command/API details rather than importing a CI pipeline. Cover retry/idempotence and interrupted-stage limitations as facts, not a chosen workflow. Separate build/source identity, unsigned evidence, final signed/stapled bytes, downloaded bytes and cask SHA-256. Describe what is technically required before the freeze/evidence handoff can be selected. Do not create release scripts, mise configuration, credentials, signed artifacts, releases or tap repositories; do not inspect secret values. Commit one cited report under docs/research/ on research/prerelease-mise-mechanics; link branch, exact commit, artifact and delegated-task context from the resolution.
phg self-assigned this 2026-10-16 09:17:32 +00:00
phg commented 2026-10-16 09:19:01 +00:00
Author
Owner
Copy link

Research claim and delegated context

Claimed by phg before work for Establish mise-driven local prerelease mechanics, a child of Plan the signed IODD Tool prerelease. Isolated AFK primary-source research is now running; production code and release execution remain outside scope.

  • Delegated task: node:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1.
  • Backing child thread: thread:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1.
  • Stable request: iodd-prerelease-map27-mechanics-r1.
  • Expected research branch: research/prerelease-mise-mechanics.
  • Expected artifact: docs/research/prerelease-mise-mechanics.md.
  • Parent will append the named resolution pointer to the map after reviewing the result; the researcher does not edit the shared map body.
## Research claim and delegated context Claimed by phg before work for [Establish mise-driven local prerelease mechanics](https://git.s1q.dev/phg/iodd-tool/issues/29), a child of [Plan the signed IODD Tool prerelease](https://git.s1q.dev/phg/iodd-tool/issues/27). Isolated AFK primary-source research is now running; production code and release execution remain outside scope. - Delegated task: `node:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1`. - Backing child thread: `thread:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1`. - Stable request: `iodd-prerelease-map27-mechanics-r1`. - Expected research branch: `research/prerelease-mise-mechanics`. - Expected artifact: `docs/research/prerelease-mise-mechanics.md`. - Parent will append the named resolution pointer to the map after reviewing the result; the researcher does not edit the shared map body.
phg commented 2026-10-16 09:29:12 +00:00
Author
Owner
Copy link

Resolution — local prerelease mechanics established

Answered the AFK research question for Establish mise-driven local prerelease mechanics, under Plan the signed IODD Tool prerelease. This resolves the research question; the existing HITL choices and every accepted release gate remain open.

Committed artifact and delivery limitation

  • Exact report commit: f83201112cf0f5625ebd12654a3c1ac0a558efbc.
  • Task-owned local branch: research/prerelease-mise-mechanics; local branch ref.
  • Committed research report in the isolated worktree.
  • Portable artifact locator in the shared Git object database: git show f83201112cf0f5625ebd12654a3c1ac0a558efbc:docs/research/prerelease-mise-mechanics.md.
  • Starting commit: b8334e758a8fb11d61b7af8d3ed6f0f632a4216b. The sole committed file is docs/research/prerelease-mise-mechanics.md; the worktree is clean.

The required non-force push, git push origin research/prerelease-mise-mechanics:refs/heads/research/prerelease-mise-mechanics, failed with forgejo@git.s1q.dev: Permission denied (publickey). There is no confirmed hosted branch/commit/artifact URL. The links above are local workspace pointers for the owner/parent, not remotely hosted artifacts. The local branch, exact commit and report are retained; no credentials, remote configuration, main or integration branch was changed.

Findings

  1. Mise supplies the local building blocks, with ordering and consent constraints. Dependencies may run in parallel; ordered steps or actual edges are needed for byte transformations. An outer task's confirmation occurs after its dependencies, and --yes can accept it. wait_for, post-dependencies, failure continuation, freshness and cache replay must not be mistaken for successful release gates. Task arguments and private credential references can be explicit. See report source refs M1–M11 and mise dependency documentation, task configuration.
  2. Apple supports the required component/container path. Sign nested worker/lifecycle executables before the app, with appropriate Developer ID Application identities, hardened runtime and timestamps; sign the DMG with Developer ID Application. Submit the outer container, retain submission UUID/status/log, and staple supported objects. Standalone worker/helper binaries cannot themselves be stapled. Notary wait timeout does not cancel server processing. See report A1–A10/L1–L2, Apple signing, notary workflow.
  3. The actual host is Forgejo 15.0.5. Its OpenAPI schema exposes prereleases, drafts and assets but no immutable-release field or asset SHA-256. Editable/deletable assets mean a versioned URL alone is not a byte-immutability guarantee. Creation/upload/publication/tap update are separate mutations; lost responses require read-back reconciliation. Report F1–F9 pins the host schema and upstream implementation, including fj command details.
  4. Keep five evidence identities separate: source/build inputs, unsigned qualification products, final signed/stapled bytes, independently downloaded bytes and the cask's final DMG SHA-256. Signed/stapled artifact changes invalidate the prior final-byte identity. The report inventories what must be known before a freeze/evidence handoff is chosen. Apple TN2206, Homebrew Cask Cookbook, and report R1/R2 retain the existing evidence/lifecycle gates.

Source dates, versions and unresolved choices

All external sources retrieved 2026-10-16. Pinned mise: v2026.10.11, commit a24763b05e203e4d8e72702d7bc68214b99fbd06 (tag dated 2026-10-15). Host Forgejo: 15.0.5, schema SHA-256 2829e5da4a16c45b2eb3a1fcd2661012c1419120b4477949e979a5e6dbd1487b; corresponding upstream source 18bc4734f6ed9ce95d6f9f4ca71e5ccebe266628. fj: 0.6.0, upstream f968e0a4f98078d9e9786cd65992e13fb804fa47. Read-only local Apple help/version baseline: Xcode 27.0 / 27A266a, notarytool 1.1.3 (42); these are observations, not selected release pins. Apple TN3147 revision 2024-02-05; DTS testing guidance revision 2024-12-05. The report distinguishes documented guarantees, pinned observations and inferences, with precise URLs.

The human still chooses prerelease identity/coordinates/access, the manual/Homebrew handoff, mise stages/opt-in and private credential interaction, ticket placement/retry receipts, and the actual integrated freeze/evidence-reuse rules in the existing HITL children. The separate Homebrew compatibility research remains independent. Commit-specific findings for integration 381442f79cd5736fceaffa15d5f1edacb1ca8842 and lifecycle 44b4247d83811ce4232b1f04f65021adf590116d do not imply that missing artifacts are absent from every live branch.

No app build/test, credential inspection/provisioning, signing, notarization, installation, VM/device operation, release publication or tap update was performed. Documentation and tool help are not runtime proof. The accepted product/recovery/lifecycle contracts are preserved. Only this research ticket is being resolved; no HITL ticket or map body is changed.

Delegated-task context retained

As recorded in the research-start comment:

  • Task: node:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1.
  • Backing child thread: thread:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1.
  • Stable request: iodd-prerelease-map27-mechanics-r1.

The parent will append the named resolution pointer to the canonical map serially.

## Resolution — local prerelease mechanics established Answered the AFK research question for [Establish mise-driven local prerelease mechanics](https://git.s1q.dev/phg/iodd-tool/issues/29), under [Plan the signed IODD Tool prerelease](https://git.s1q.dev/phg/iodd-tool/issues/27). This resolves the research question; the existing HITL choices and every accepted release gate remain open. ### Committed artifact and delivery limitation - Exact report commit: `f83201112cf0f5625ebd12654a3c1ac0a558efbc`. - Task-owned local branch: `research/prerelease-mise-mechanics`; [local branch ref](/Users/phg/workspace/privat/git.s1q.dev/phg/iodd-tool/.git/refs/heads/research/prerelease-mise-mechanics). - [Committed research report in the isolated worktree](/Users/phg/.t3/worktrees/iodd-tool/t3-cd97b823/docs/research/prerelease-mise-mechanics.md). - Portable artifact locator in the shared Git object database: `git show f83201112cf0f5625ebd12654a3c1ac0a558efbc:docs/research/prerelease-mise-mechanics.md`. - Starting commit: `b8334e758a8fb11d61b7af8d3ed6f0f632a4216b`. The sole committed file is `docs/research/prerelease-mise-mechanics.md`; the worktree is clean. The required non-force push, `git push origin research/prerelease-mise-mechanics:refs/heads/research/prerelease-mise-mechanics`, failed with **`forgejo@git.s1q.dev: Permission denied (publickey).`** There is no confirmed hosted branch/commit/artifact URL. The links above are local workspace pointers for the owner/parent, not remotely hosted artifacts. The local branch, exact commit and report are retained; no credentials, remote configuration, main or integration branch was changed. ### Findings 1. **Mise supplies the local building blocks, with ordering and consent constraints.** Dependencies may run in parallel; ordered steps or actual edges are needed for byte transformations. An outer task's confirmation occurs after its dependencies, and `--yes` can accept it. `wait_for`, post-dependencies, failure continuation, freshness and cache replay must not be mistaken for successful release gates. Task arguments and private credential references can be explicit. See report source refs M1–M11 and [mise dependency documentation](https://mise.jdx.dev/tasks/architecture.html), [task configuration](https://mise.jdx.dev/tasks/task-configuration.html). 2. **Apple supports the required component/container path.** Sign nested worker/lifecycle executables before the app, with appropriate Developer ID Application identities, hardened runtime and timestamps; sign the DMG with Developer ID Application. Submit the outer container, retain submission UUID/status/log, and staple supported objects. Standalone worker/helper binaries cannot themselves be stapled. Notary wait timeout does not cancel server processing. See report A1–A10/L1–L2, [Apple signing](https://developer.apple.com/documentation/xcode/creating-distribution-signed-code-for-the-mac), [notary workflow](https://developer.apple.com/documentation/security/customizing-the-notarization-workflow). 3. **The actual host is Forgejo 15.0.5.** Its [OpenAPI schema](https://git.s1q.dev/swagger.v1.json) exposes prereleases, drafts and assets but no immutable-release field or asset SHA-256. Editable/deletable assets mean a versioned URL alone is not a byte-immutability guarantee. Creation/upload/publication/tap update are separate mutations; lost responses require read-back reconciliation. Report F1–F9 pins the host schema and upstream implementation, including fj command details. 4. **Keep five evidence identities separate:** source/build inputs, unsigned qualification products, final signed/stapled bytes, independently downloaded bytes and the cask's final DMG SHA-256. Signed/stapled artifact changes invalidate the prior final-byte identity. The report inventories what must be known before a freeze/evidence handoff is chosen. [Apple TN2206](https://developer.apple.com/library/archive/technotes/tn2206/_index.html), [Homebrew Cask Cookbook](https://docs.brew.sh/Cask-Cookbook), and report R1/R2 retain the existing evidence/lifecycle gates. ### Source dates, versions and unresolved choices All external sources retrieved **2026-10-16**. Pinned mise: **v2026.10.11**, commit `a24763b05e203e4d8e72702d7bc68214b99fbd06` (tag dated 2026-10-15). Host Forgejo: **15.0.5**, schema SHA-256 `2829e5da4a16c45b2eb3a1fcd2661012c1419120b4477949e979a5e6dbd1487b`; corresponding upstream source `18bc4734f6ed9ce95d6f9f4ca71e5ccebe266628`. fj: **0.6.0**, upstream `f968e0a4f98078d9e9786cd65992e13fb804fa47`. Read-only local Apple help/version baseline: **Xcode 27.0 / 27A266a**, **notarytool 1.1.3 (42)**; these are observations, not selected release pins. Apple TN3147 revision 2024-02-05; DTS testing guidance revision 2024-12-05. The report distinguishes documented guarantees, pinned observations and inferences, with precise URLs. The human still chooses prerelease identity/coordinates/access, the manual/Homebrew handoff, mise stages/opt-in and private credential interaction, ticket placement/retry receipts, and the actual integrated freeze/evidence-reuse rules in the existing HITL children. The separate Homebrew compatibility research remains independent. Commit-specific findings for integration `381442f79cd5736fceaffa15d5f1edacb1ca8842` and lifecycle `44b4247d83811ce4232b1f04f65021adf590116d` do not imply that missing artifacts are absent from every live branch. No app build/test, credential inspection/provisioning, signing, notarization, installation, VM/device operation, release publication or tap update was performed. **Documentation and tool help are not runtime proof.** The accepted product/recovery/lifecycle contracts are preserved. Only this research ticket is being resolved; no HITL ticket or map body is changed. ### Delegated-task context retained As recorded in the research-start comment: - Task: `node:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1`. - Backing child thread: `thread:delegated-task:command%3Amcp%3Abe5e5d8b-8159-412e-a97a-d75495eadd8e%3Adelegate-task%3Aiodd-prerelease-map27-mechanics-r1`. - Stable request: `iodd-prerelease-map27-mechanics-r1`. The parent will append the named resolution pointer to the canonical map serially.
phg closed this issue 2026-10-16 09:29:19 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
implement/iodd-tool-spec-7
prototype/native-workflow
research/engine-recovery-constraints
research/supported-volume-geometry
No results found.
Labels
Clear labels   
needs-info

   
needs-triage

   
ready-for-agent
Ready for an agent; explicit blockers and scope still apply

  
ready-for-human

   
wayfinder:grilling

   
wayfinder:map

   
wayfinder:prototype

   
wayfinder:research

   
wontfix
No labels
needs-info
needs-triage
ready-for-agent
ready-for-human
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
phg
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
phg/iodd-tool#29
No description provided.