From a0ee487f47c81eb90d6baf78bd78f69f070d45cc Mon Sep 17 00:00:00 2001 From: Ajay Krishnan Date: Tue, 18 Aug 2026 12:37:29 -0700 Subject: [PATCH 1/2] Record pending OpenCode 1.18.18 image Allow public_ci rows that the upstream recorder already emits as pending, and add v1.18.18 as an uncertified shared-client target. Certified alpha8 rows and consumer tuples stay as they are. --- manifests/image-matrix.json | 11 +++++++++ manifests/upstream.json | 12 +++++----- test/repository_test.rb | 48 +++++++++++++++++++++++++------------ 3 files changed, 50 insertions(+), 21 deletions(-) diff --git a/manifests/image-matrix.json b/manifests/image-matrix.json index 087c357..6583b6c 100644 --- a/manifests/image-matrix.json +++ b/manifests/image-matrix.json @@ -102,6 +102,17 @@ "full_text": "compat-ok", "llm_request_count": 1 } + }, + { + "id": "upstream-1.18.18-f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + "version": "1.18.18", + "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + "tag_provenance": "ghcr.io/anomalyco/opencode:1.18.18", + "consumers": [], + "profiles": ["ruby-rest-sse"], + "required_consumer_profiles": [], + "certification_scope": "shared-client-contract-only", + "certification_status": "pending" } ], "host_canary": [ diff --git a/manifests/upstream.json b/manifests/upstream.json index baf7342..7085f6c 100644 --- a/manifests/upstream.json +++ b/manifests/upstream.json @@ -1,9 +1,9 @@ { "repository": "anomalyco/opencode", - "release_tag": "v1.18.3", - "version": "1.18.3", - "published_at": "2026-07-16T15:34:33Z", - "release_url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.3", - "image": "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e", - "observed_at": "2026-07-18T00:00:00Z" + "release_tag": "v1.18.18", + "version": "1.18.18", + "published_at": "2026-08-13T01:15:04Z", + "release_url": "https://github.com/anomalyco/opencode/releases/tag/v1.18.18", + "image": "ghcr.io/anomalyco/opencode@sha256:f3e00f8e25500150373c817e24b13f2f08e2ccd4cafd53dc3ad4827d47863b6f", + "observed_at": "2026-08-18T19:30:00Z" } diff --git a/test/repository_test.rb b/test/repository_test.rb index 27ca8d9..b4b86a4 100644 --- a/test/repository_test.rb +++ b/test/repository_test.rb @@ -13,6 +13,30 @@ class RepositoryTest < Minitest::Test JSON.parse(File.read(File.join(ROOT, path))) end + def assert_certified_public_target(target) + current = target.fetch("current_certification") + assert_equal "certified", current.fetch("status") + assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit")) + assert_match(/\A[0-9a-f]{40}\z/, current.fetch("rails_commit")) + assert_equal current.fetch("expected_text"), current.fetch("full_text") + assert_equal 1, current.fetch("llm_request_count") + assert_path_exists File.join(ROOT, current.fetch("evidence")) + previous = target["previous_certification"] + return unless previous + + assert_equal "certified", previous.fetch("status") + assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit")) + assert_equal previous.fetch("expected_text"), previous.fetch("full_text") + assert_equal 1, previous.fetch("llm_request_count") + end + + def assert_pending_public_target(target) + refute target.key?("current_certification") + refute target.key?("previous_certification") + assert_empty target.fetch("consumers") + assert_empty target.fetch("required_consumer_profiles") + end + def test_every_json_document_parses paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles}/**/*.json")) refute_empty paths @@ -49,22 +73,16 @@ class RepositoryTest < Minitest::Test assert_equal ["ruby-rest-sse"], target.fetch("profiles") assert_equal "shared-client-contract-only", target.fetch("certification_scope", "shared-client-contract-only") - assert_equal "certified", target.fetch("certification_status") - current = target.fetch("current_certification") - assert_equal "certified", current.fetch("status") - assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit")) - assert_match(/\A[0-9a-f]{40}\z/, current.fetch("rails_commit")) - assert_equal current.fetch("expected_text"), current.fetch("full_text") - assert_equal 1, current.fetch("llm_request_count") - assert_path_exists File.join(ROOT, current.fetch("evidence")) - previous = target["previous_certification"] - next unless previous - - assert_equal "certified", previous.fetch("status") - assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit")) - assert_equal previous.fetch("expected_text"), previous.fetch("full_text") - assert_equal 1, previous.fetch("llm_request_count") + case target.fetch("certification_status") + when "certified" + assert_certified_public_target(target) + when "pending" + assert_pending_public_target(target) + else + flunk "#{target.fetch("id")} certification_status must be pending or certified" + end end + assert targets.any? { |target| target.fetch("certification_status") == "certified" } end def test_candidate_client_train_is_lockstep_and_bound_to_unpublished_commits From 88809aa98dc6e76976bf42ba9ab28e86f1aca39b Mon Sep 17 00:00:00 2001 From: Ajay Krishnan Date: Tue, 18 Aug 2026 14:24:49 -0700 Subject: [PATCH 2/2] Pin public_ci certified identities and pending latch Keep the three certified consumer-backed rows by id, image, and evidence. Allow at most one pending row, and only when it is the upstream.json image. --- test/repository_test.rb | 91 ++++++++++++++++++++++++++--------------- 1 file changed, 58 insertions(+), 33 deletions(-) diff --git a/test/repository_test.rb b/test/repository_test.rb index b4b86a4..ec86b1a 100644 --- a/test/repository_test.rb +++ b/test/repository_test.rb @@ -13,30 +13,6 @@ class RepositoryTest < Minitest::Test JSON.parse(File.read(File.join(ROOT, path))) end - def assert_certified_public_target(target) - current = target.fetch("current_certification") - assert_equal "certified", current.fetch("status") - assert_match(/\A[0-9a-f]{40}\z/, current.fetch("client_commit")) - assert_match(/\A[0-9a-f]{40}\z/, current.fetch("rails_commit")) - assert_equal current.fetch("expected_text"), current.fetch("full_text") - assert_equal 1, current.fetch("llm_request_count") - assert_path_exists File.join(ROOT, current.fetch("evidence")) - previous = target["previous_certification"] - return unless previous - - assert_equal "certified", previous.fetch("status") - assert_match(/\A[0-9a-f]{40}\z/, previous.fetch("client_commit")) - assert_equal previous.fetch("expected_text"), previous.fetch("full_text") - assert_equal 1, previous.fetch("llm_request_count") - end - - def assert_pending_public_target(target) - refute target.key?("current_certification") - refute target.key?("previous_certification") - assert_empty target.fetch("consumers") - assert_empty target.fetch("required_consumer_profiles") - end - def test_every_json_document_parses paths = Dir.glob(File.join(ROOT, "{evidence,fixtures,manifests,profiles}/**/*.json")) refute_empty paths @@ -73,16 +49,65 @@ class RepositoryTest < Minitest::Test assert_equal ["ruby-rest-sse"], target.fetch("profiles") assert_equal "shared-client-contract-only", target.fetch("certification_scope", "shared-client-contract-only") - case target.fetch("certification_status") - when "certified" - assert_certified_public_target(target) - when "pending" - assert_pending_public_target(target) - else - flunk "#{target.fetch("id")} certification_status must be pending or certified" - end + assert_includes %w[certified pending], target.fetch("certification_status") + end + + certified_rows = targets.select { |target| target.fetch("certification_status") == "certified" } + assert_equal %w[upstream-1.16.1 upstream-1.17.18 upstream-1.18.3], + certified_rows.map { |target| target.fetch("id") }.sort + certified = certified_rows.to_h { |target| [target.fetch("id"), target] } + + travelwolf = certified.fetch("upstream-1.16.1") + assert_equal "ghcr.io/anomalyco/opencode@sha256:e975a0647576016dfdf77d54b979ca30d32b4750472c10263e9894aad6628c2a", + travelwolf.fetch("image") + assert_equal ["travelwolf"], travelwolf.fetch("consumers") + assert_equal ["rails-persisted-turn"], travelwolf.fetch("required_consumer_profiles") + assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", + travelwolf.dig("current_certification", "client_commit") + assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json", + travelwolf.dig("current_certification", "evidence") + + ajent_plugin = certified.fetch("upstream-1.17.18") + assert_equal "ghcr.io/anomalyco/opencode@sha256:bf9d0e84b7cedef436a8f57db4d48767cd5d8fc6604f666335c1cc916b199a97", + ajent_plugin.fetch("image") + assert_equal ["opencode-ajent"], ajent_plugin.fetch("consumers") + assert_equal ["plugin-ledger"], ajent_plugin.fetch("required_consumer_profiles") + assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", + ajent_plugin.dig("current_certification", "client_commit") + assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json", + ajent_plugin.dig("current_certification", "evidence") + + ajent_rails = certified.fetch("upstream-1.18.3") + assert_equal "ghcr.io/anomalyco/opencode@sha256:c2d5d6398df72aac85cb1bdc8f900c71a9b75a33fb7c0a76dc1484e4b126e41e", + ajent_rails.fetch("image") + assert_equal ["ajent-rails"], ajent_rails.fetch("consumers") + assert_equal ["rails-persisted-turn", "plugin-ledger"], + ajent_rails.fetch("required_consumer_profiles") + assert_equal "9277646a4bb2cf25a8384ffc140b154f49ea5766", + ajent_rails.dig("current_certification", "client_commit") + assert_equal "evidence/2026-07-20-opencode-alpha8-shared-client-ci.json", + ajent_rails.dig("current_certification", "evidence") + + certified.each_value do |target| + current = target.fetch("current_certification") + assert_equal "certified", current.fetch("status") + assert_equal "a9add2a7c1dd3eb978aa8b4ebf9ef7e111d1057f", current.fetch("rails_commit") + assert_equal current.fetch("expected_text"), current.fetch("full_text") + assert_equal 1, current.fetch("llm_request_count") + assert_path_exists File.join(ROOT, current.fetch("evidence")) + end + + pending = targets.select { |target| target.fetch("certification_status") == "pending" } + assert_operator pending.length, :<=, 1 + upstream_image = json("manifests/upstream.json").fetch("image") + assert_equal 1, targets.count { |target| target.fetch("image") == upstream_image } + pending.each do |target| + assert_equal upstream_image, target.fetch("image") + refute target.key?("current_certification") + refute target.key?("previous_certification") + assert_empty target.fetch("consumers") + assert_empty target.fetch("required_consumer_profiles") end - assert targets.any? { |target| target.fetch("certification_status") == "certified" } end def test_candidate_client_train_is_lockstep_and_bound_to_unpublished_commits