You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Nightly artifacts are produced only from exact main, installed from the produced archive, executed as real binaries in a disposable home, bound cryptographically to that main SHA and workflow identity, and promoted without rebuilding different bytes.
Canonical nightly identity is 2026.10.0-nightly.<YYYYMMDD>.g<40-character-main-sha> after the #1811 CalVer/nightly successor is accepted. Nightly artifacts must use the same signed inventory, provenance, and install path as stable.
Parent
Tracking #1817. This is a successor certification lane, not a tag or publication authorization.
Scope and ownership
Repository: astrid-runtime/astrid.
Owned paths, when staffed:
.github/workflows/nightly.yml and the signed release.yml nightly path, only as needed to install and execute the produced archive
a dedicated archive-install harness
promote-without-rebuild evidence on promote-channel.yml / promote-nightly.yml
Do not fold this into the current #1811 unique-file set (discovery.rs fixture, release/nightly.toml, scripts/test_nightly_version.py). Do not invent a signed feature-enumeration schema here.
Dependencies
accepted release: prepare Astrid 2026.9.0 #1811 CalVer/nightly successor (next nightly base 2026.10.0, Windows runtime remaining unpublished, Unix inventory 20)
signed inventory/provenance already used by stable; do not create a new trust root
Exit gate
nightly CI installs the produced archive into a disposable home and runs the actual binaries, not merely build/package
nightly identity embeds the exact main SHA and is rejected if ancestry is not origin/main
install/launch re-verifies the signed inventory/provenance before exec
promotion of a nightly or stable pointer reuses the already-produced, already-tested bytes; a rebuild with different bytes is a fail-closed defect
independent exact-head review of workflow and harness
Claim boundary
A tagged nightly, a successful package job, or a channel pointer without archive-install execution does not prove nightlies work. This issue does not authorize enabling nightly publication, tagging, or live-home mutation.
Sequence
Staff after the #1811 CalVer/nightly successor is accepted. Keep nightlies enabled in source metadata; do not publish until later explicit release authority.
Outcome
Nightly artifacts are produced only from exact
main, installed from the produced archive, executed as real binaries in a disposable home, bound cryptographically to thatmainSHA and workflow identity, and promoted without rebuilding different bytes.Canonical nightly identity is
2026.10.0-nightly.<YYYYMMDD>.g<40-character-main-sha>after the #1811 CalVer/nightly successor is accepted. Nightly artifacts must use the same signed inventory, provenance, and install path as stable.Parent
Tracking #1817. This is a successor certification lane, not a tag or publication authorization.
Scope and ownership
Repository:
astrid-runtime/astrid.Owned paths, when staffed:
.github/workflows/nightly.ymland the signedrelease.ymlnightly path, only as needed to install and execute the produced archivepromote-channel.yml/promote-nightly.ymlDo not fold this into the current #1811 unique-file set (
discovery.rsfixture,release/nightly.toml,scripts/test_nightly_version.py). Do not invent a signed feature-enumeration schema here.Dependencies
2026.10.0, Windows runtime remaining unpublished, Unix inventory 20)Exit gate
mainSHA and is rejected if ancestry is notorigin/mainClaim boundary
A tagged nightly, a successful package job, or a channel pointer without archive-install execution does not prove nightlies work. This issue does not authorize enabling nightly publication, tagging, or live-home mutation.
Sequence
Staff after the #1811 CalVer/nightly successor is accepted. Keep nightlies enabled in source metadata; do not publish until later explicit release authority.