Repository navigation
Qualify the first clean downloaded shared-game-reference journey #4710
Description
Owner: Programme /root accountable. Existing Templates receiver owner template_wasm_reference retains implementation ownership under campaign unified-roadmap-20261003, chain game-template-installed-c; Coordination execution maintainer supplies the exact canonical managed-group candidate contract. Rendering/Game retain producer APIs and product owners retain staged adoption. No replacement owner or competing PR is selected.
Done when: A clean downloaded-only selected current shared-game-reference product builds and runs its actual Fable/Vite/Worker/ESM production graph without sibling source or local-feed fallback. Exercise one genuine opted-in published WASM reference and its real enabled/disabled browser path, exact package/Worker/guest custody and bounded lifecycle/refusal behavior through the maintained receiver. Reuse accepted0.19.0 signatures and compatible source/runtime assertions only where identities and profiles match; record honest missing composition cases.
Current deliverable: Direct downloaded-only public Workspace.Template 0.19.0 default/Complete WASM receiver through tests/composition/fable-game/verify-fable-reference-public.sh --mode wasm. Recover existing merged PR719 (routine/templates-cj1-browser-preflight, head 1d20b0bd0c9736d81820bc6e6ab304a20fb357e8) and predecessor PR718 (routine/template-wasm-clean-20261014, head e23f994a56e81308a491c5af3f197c2089dd62c7) in the same chain; fresh native read finds no open Templates PR and the sole main worktree is clean. This direct assertion excludes Wizard/provider/SDD acceptance.
Next action: Existing Coordination execution maintainer supplies the exact reviewed canonical managed-group candidate API/schema/source identity and executable/birth/root/argv/retirement profile usable by the existing Templates caller; template_wasm_reference then integrates that actual contract under C-J1 on the same chain, preserving current runtime/upload literal-false gates until source/profile review. Programme /root next observes on that concrete supplier/source change or an explicit scoped source decision, then admits a genuine bounded three-family custody pilot before the downloaded-only 27-case runtime assertion. No unchanged hold polling or known Governance probe is selected.
Blocked on: The actual maintained Templates caller at protected f5fbd06ed9e6df40f9037c7acddf9eca3c6a14fc refuses at its Chromium support/runtime join and unconditional main: canonical managed-group candidate/profile contract remains unbound. Existing Coordination main 8bbdcc4d65ee587ad087f58bda15e555aae19926 and owning #1026 source/publication evidence do not supply that complete browser candidate join; current shared process owner refuses escaped groups and BCL sessions do not supply required stable descendant containment. A source patch cannot safely invent this supplier contract. This fences the dependent runtime, not independent source preparation. Publication, compatible 4708 knowledge acceptance and available local browser slots do not establish this profile. All original failures, unknown cleanup effects and 439 inherited/46 later reservations remain retained.
Acceptance evidence: 2026-10-01-staged-fable-game-adoption.md Stage.3/.4, Qualification/rollback, GAME-TEMPLATE-01 and shared receiver cohort; acceptedTemplates713/714/715 and actual0.19.0 publication. Preserve accepted parent source/publication evidence at its original scope. Record actual PR/head, selected artifact/profile/operation, independent scoped result and native acceptance here after they exist; this draft supplies none. Full original parent promise and history remain authoritative at #4646; broader programme outcome: #4646. This bounded source/receiver result does not close either broader promise. Accepted decomposition design: #4701 and docs/coordination/2026-10-19-board-clearing-lifecycle-design.md (owning source plan; publication remains separate).
Supplier/assertion reconciliation — 2026-10-20: the maintained --mode wasm --preflight-only accepted the exact public 0.19.0 arguments without SDK/browser/download execution or output creation. Signed NuGet archive SHA256 187c995806bb2f22db67c8a9a67c251f46f339bf6350b8051035935d308b497f; source/peeled tag 8952e1c5753b0abc972154c7596ddc8da772b271; independently source-read descriptor SHA256 d7207cbde78f2890a63bbebf23c80bbcae8ce7f2405c0ceacf602dc6c185942c. This establishes argument/assertion mapping only. Original owning hosted direct window, held caller, PR719, PR718 and PROC owning issue1026 retain authority/history at their actual scopes. Atlas restart pointer: templates/0.19-publication-and-receiver-scope; current C-J1 supplier clarification has no delivered source carrier, capture gap Programme/root. Full Done when and parent promise stay open.
Activity
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: the supplier request now exists. FS-GG/FS.GG.Coordination#1046 asks the Coordination execution owner for the canonical managed-group candidate contract (API/schema/source identity; executable/birth/root/argv/retirement profile; stable descendant containment) that the Templates caller needs. It is filed under #1026 and an owner is dispatched. Note: Workspace.Template 0.19.1 is now published (Templates#729), so the downloaded-only receiver should target 0.19.1 when it resumes.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: C-J1 source binding merged. FS.GG.Templates#731 was squash-merged as
2c2527ec8095abca7330cf117044c31a2ec0dbad. Its merge tree is identical to the reviewed head2462b98cae31ba130cc96a5ce9c557e0ad7a0a40.Bound pin:
(FS-GG/FS.GG.Coordination, ac22206560f3eddfea524ce8f752ff1d0dfeec4e, eng/managed_group_owner.py, sha256 d846dbe158befb5b824bd94a5bc0bb89b1145f825d5d6fa3a3225fa0451a36c0), 45315 bytes, contractfsgg.managed-group-contract/1.What the maintained caller now does (
.github/workflows/fable-reference-public.yml, jobwasm-installed-c):probe()before any provisioning acquisition and refuses if containment is unavailable.execute(argv,cwd,env)with onerun(profile, env=, deadline=<phase deadline>, out_dir=<fresh dir under root>)per call, usingrequire-empty. It returnsstdout.log, retains every receipt, and raises the first cause.sudo -n systemd-run … -p Delegate=yes -p User=runner -p NoNewPrivileges=yes -p KillMode=control-group -p TimeoutStopSec=5withTasksMax=6144andMemoryMax=12Gas hard limits.5d1886c3…, source and peeled tag1e95ddd, descriptor10b532da…. 0.19.0 Complete scaffolds truncateguest/policy.c, so they can never close the byte-exact WASM closure.Gates preserved: the caller step and the upload step keep
if: ${{ false }}, andmain()still refuses first on the literalRUNTIME_ADMITTED = False. Nothing provisions, runs a pilot or runs installed C.Evidence:
delegated-root-not-writableand nothing was launched.no_new_privs, and was contained and removed.require-emptyand was retired.pids.max256 andmemory.max1073741824.validate_profile. F# ProviderComposition: 190 PASS. The dev container refuses withdelegated-root-invalid, as the contract expects.3066ac8: a multi-linenode -eargv was refused by the real owner, and the per-Playwright claim was overstated. Both were fixed in6eeb8d5, and the review returned ACCEPT on2462b98.composition,kit / coordination-kit,materialize / receiver-validate).templates/wasm-installed-c-managed-group-binding, delivered in the PR.Now unblocked: Programme/root can admit the bounded genuine three-family custody pilot before the downloaded-only 27-case runtime assertion. Lifting the three literal holds stays with that C-J1 source/profile review and admission. This comment grants no runtime authority.
Remaining Unknowns and held work:
managed_playwrightexists, butfixed_checker_argvstill starts the shell checker, which runs Playwright itself, so all families would share one group. Those invocations must move into the Python owner as part of pilot/installed-C work.require-empty, WebKit host/birth/retirement, and the time cost of hashing large leader images.rustc/cargo) and host images (/bin/sh) are observed, not provenance-checked. Therustup-initdigest comes from unpinned same-server metadata, as before this change.1e95ddd, 6CurrentPublicPreflightTestsfailed because Phase 3b — the flip:--engine=fsbecomes the default, oncedivergence --fleetis actually green #730 moved the working-tree descriptor. They now use the immutable 0.19.0 descriptor bytes.The issue stays open and the Project 3 Status is unchanged.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: C-J1 follow-up merged. FS.GG.Templates#732 was squash-merged as
68f101f305c77cfb38afdb465c088d2cd1e083a5. Its tree is identical to the reviewed head64d541f.--mode wasmprepares only the downloaded source and production graph, the generated config and the Browser.Testsnpm ci. It runs no browser.installed_cruns the checker as one group, then each family's Playwright--listandtestinvocation as its ownrequire-emptygroup, and applies the 9-case assertions per family.hosted_sequenceruns provisioning, then tool qualification, thencustody_gate, which refuses, theninstalled_c.validate_profileat run time. The preflight suite passes 110/110 with the owner.9f04ed8with findings, which were fixed, then ACCEPT on64d541fwith 18 mutants killed. All required checks are green.if: ${{ false }}×2,RUNTIME_ADMITTED = False, andcustody_gate.templates/wasm-installed-c-managed-group-binding, successorc1a5773e….Next: the bounded three-family custody pilot admission request has been prepared for Programme/root (fdev) and has not been run. The issue stays open, and Project 3 Status is unchanged.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: ADMISSION: the bounded three-family WASM custody pilot (C-J1 follow-up, FS.GG.Templates). This is a conditional admission, issued in advance to save a round trip.
Context: per-invocation Playwright groups are merged (FS.GG.Templates#732 →
68f101f3). The managed-group owner is pinned atac222065/d846dbe1….Admitted: exactly one
workflow_dispatchof the new.github/workflows/wasm-custody-pilot.yml, jobcustody-pilot. All of these conditions apply:pilot_sequence, the browser-only provisioning subset and dispatch source validation. It needs an independent fsgg-critic-best ACCEPT on its exact head, and all required checks green.admitted_refequalsgithub.sha, andadmissionis the URL of this comment.RUNTIME_ADMITTED=False, bothif: ${{ false }}steps infable-reference-public.yml, andcustody_gate. Nothing in installed C opens.ubuntu-24.04only;contents: read, with no secrets, no repository writes and no publication;systemd-rununit withTasksMax=4096,MemoryMax=8GandRuntimeMaxSec=1800;After the run: an independent acceptance review of
custody-pilot.jsonand the receipts. Opening installed C, and the 27-case journey, are separate later decisions.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: The custody pilot ran exactly once, as admitted. Result:
incomplete. Chromium and Firefox custody is fully qualified. WebKit could not start because the stock runner lacks its host libraries. No re-run or re-dispatch was made.c6dabf45dfb7077b0e2e72f228f7d9a42b58fb37. Its tree is identical to the reviewed head1eddb6d, and fsgg-critic-best returned ACCEPT on that head after one REQUEST CHANGES round.mainread back as that SHA immediately before the dispatch.workflow_dispatch, attempt 1,headShac6dabf4), withadmitted_ref=c6dabf4…andadmissionset to the admission comment. Job conclusion:failure. That is by design: the job exits non-zero unless the disposition iscompleted. Duration was 1m38s.wasm-custody-pilot-39828121993-1, id 12447901380, sha2566c74ef80d6f5684cb81a81faacd5a79245b9d32ddd7c17862a5dae4c25b928a6. It is 67299 bytes zipped, holds 67 files (233483 bytes, none skipped or truncated), and expires on 2026-11-21.Containment on GitHub-hosted ubuntu-24.04 (kernel 7.0.0-1017-azure): the delegated root was
system.slice/fsgg-mg-templates-pilot-39828121993-1.service, with controllers cpuset, cpu, io, memory and pids. All 16/16 managed groups (5 setup, 11 custody) endedcleanup=observed-empty-removedandcustody=contained, with no escapes or residue. Every leader image was admitted withno_new_privs=1, and every group ran under ownerd846dbe1….Host validation, per family:
host-dependencies-missing, 34 libraries missing:libgtk-4.so.1,libgraphene-1.0.so.0,libevent-2.1.so.7,libopus.so.0, the GStreamer libraries (allocators,app,pbutils,audio,tag,video,gl,codecparsers,fft), 13libflite*,libavif.so.16,libharfbuzz-icu.so.0,libwayland-server.so.0,libmanette-0.2.so.0,libhyphen.so.0,libsecret-1.so.0,libGLESv2.so.2andlibx264.so.Chromium library scan: both
chromium-headless1243andchromium-full1243aresupport-complete. Each scanned 5 targets (the executable plus its.sofiles) with no missing libraries.Cases (each one its own
require-emptygroup):vite preview)153.0.8010.12)clean-stock-shutdown: 1/1 passed, 10 members, nothing left after leader exitdeadline-retired: 7 SIGTERMs, thencgroup.kill, removedbrowser-exited-with-leader: clean155.0, content sandbox enabled)clean-stock-shutdown: 1/1 passed, 11 members, nothing leftdeadline-retired: 8 SIGTERMs, thencgroup.kill, removedbrowser-exited-with-leader: cleanrun-failed: launch refused for missing host libraries; the group, including the webServer (30 members), was retired cleanunexpected: launch refused for missing librariesunexpected: launch refused for missing librariesWhat this establishes:
require-emptyis clean for Chromium and Firefox, including the Playwright webServer. In both forced cases the browser trees outlived SIGTERM grace and were retired bycgroup.kill.Unknowns and remaining work:
custody-pilot.jsonand the receipts, required after the run by the admission, is still owed. So are the installed-C admission and the 27-case journey.templates/wasm-custody-pilot.Project 3 Status is unchanged.
RUNTIME_ADMITTED, both literal-false steps andcustody_gateare untouched.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: custody pilot run 39828121993: ACCEPTED WITH GAPS (independent acceptance review). ADMISSION for a second pilot run (WebKit plus survivor retirement), issued in advance.
Established (verified from the artifact, zip
6c74ef80…):ADMITTED_REF=SHA=WORKFLOW_SHA=c6dabf4, the exact admission URL, attempt 1, ownerd846dbe1…re-fetched, and the PR Phase 4.3 — the chore queue: the tool has no thread, so it conscripts the next caller (all four helping conditions, or not at all) #733 merge tree equal to the reviewed head.observed-empty-removed, contained, no escapes, empty residual, admitted leader images,no_new_privs. EachprofileSha256was recomputed and matches.ubuntu-24.04:cgroup.kill, with the leader killed by signal 9;Gaps:
residualAfterLeaderExit=[]).validateDependenciesLinuxfound 34 missing), with its groups still retired clean.include-hidden-files: false).Admitted, a second run, with the same conditions as 6346457201 except:
systemd-run(sinceNoNewPrivilegesblocks sudo in the unit) that installs only Playwright's ubuntu24.04 WebKit package list for the pinned Playwright version;dpkg-query -Wbefore and after, the diff, the apt sources and the installed versions in the evidence;include-hidden-files: true;TasksMax/MemoryMax/RuntimeMaxSecproperties into the evidence;SIGSTOP), to exerciseleftover-retired;RUNTIME_ADMITTED=Falseandcustody_gate. Only the apt step writes, and only on the ephemeral runner. No repository writes and no publication.After the run: an independent acceptance review. Installed C and the 27-case journey remain separate decisions.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: The second custody pilot run ran exactly once, as admitted. Result:
incomplete. Survivor retirement is now established for Chromium and Firefox. WebKit is still unqualified, because the admitted package install timed out before installing anything. No re-run or re-dispatch was made.1638416e23e9142c1f0fb6bf8002ea6486402397. fsgg-critic-best returned ACCEPT on the reviewed headaa08058after two REQUEST CHANGES rounds. Main also contained the unrelated [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728, so I checked that the squash merge equals the reviewed diff applied on top of [cross-repo] a worker in a per-item WORKTREE resolves no engine — the fan-out mechanism silently opts every worker out of the ADR-0034 shadow (#716 one layer over) #728. The two file sets don't overlap, and all four files the pilot executes are byte-identical to the reviewed head.mainread back as1638416immediately before the dispatch.workflow_dispatch, attempt 1,headSha=ADMITTED_REF=WORKFLOW_SHA=1638416, admission URL = 6347853904, unitfsgg-mg-templates-pilot-39837319401-1. Job conclusion:failure, by design (the disposition isincomplete). Duration 7m06s.wasm-custody-pilot-39837319401-1, id 12451452777, sha256c80e5a9abf0c9e8d3c698e48c40dd8ac5ff5e369e627fa38531467746220af61. It is 101470 bytes zipped and holds 88 files (356932 bytes, none skipped, truncated or unreadable). It expires on 2026-11-21. The hidden files are now included (3 ×.last-run.json).WebKit host packages (admitted apt step):
apt-get updateexited 0.apt-get installof the 51 admitted packages resolved to 176 packages (172 new, 4 upgraded, 95.0 MB). Only 30 had downloaded when the step's 5-minute timeout fired; the Azure Ubuntu mirror download had stalled. Nothing was unpacked.install-exit.txtanddpkg-after.tsvwere never written, so the pilot recordedhostPackages.state=not-attemptedand the labelubuntu-24.04, not "+ recorded packages". The accurate reading is: attempted, timed out during download, no packages installed.packages.txtequals the admitted list and matches the pinned Playwright 1.63.0 list.dpkg-before.tsv,apt-sources.txt,update.logandinstall.logare retained.Unit properties, now captured through
systemctl showas a managed group:TasksMax=4096,MemoryMax=8589934592,RuntimeMaxUSec=30min,Delegate=yes,NoNewPrivileges=yes,KillMode=control-group,TimeoutStopUSec=5s,User=runner. All match the admission.Containment: all 20/20 groups (6 setup, 14 custody) ended
observed-empty-removedandcontained, with no escapes or residue. Every leader image was admitted withno_new_privs=1, under ownerd846dbe1…. Host validation passed for chromium and firefox; webkit reportedhost-dependencies-missing(unchanged). The Chromium library scan wassupport-completefor both archives.Cases:
clean-stock-shutdowndeadline-retired(7 SIGTERMs, thencgroup.kill)browser-exited-with-leaderleftover-retired: 7 residual (holder + 6chrome-headless), SIGTERM thencgroup.kill, removedclean-stock-shutdowndeadline-retired(8 SIGTERMs, thencgroup.kill)browser-exited-with-leaderleftover-retired: 8 residual (holder + firefox, forkserver, Socket, WebExtensions, RDD, Web Content), retired and removedrun-failed(missing host libraries)unexpected(launch refused)unexpectedunexpected: "holder failed: … missing dependencies", evidence keptThe forced cases now record
observedBrowserMembers: every launched browser process appears in the owner's member sample. That shows the processes were observed in the group; it does not show which were alive at the deadline.What is newly established:
Still open:
not-attemptedstate is less precise than the logs. A follow-up should recordattemptedfromupdate-exitand a timeout marker.templates/wasm-custody-pilot-run-39828121993,8f7e75f5…, delivered in [registry] Re-digest the fs-gg-game-core skill row — the canonical body now names the Physics module (owner: fs-gg-game) #734). This run's outcome is a capture gap, owner fdev.Project 3 Status is unchanged.
RUNTIME_ADMITTED, both literal-false steps andcustody_gateare untouched.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: pilot run 2 (39837319401): ACCEPTED WITH GAPS (independent acceptance review). ADMISSION for a third, final WebKit run, issued in advance.
Established (artifact
c80e5a9a…, 88/88 entries; binding1638416with patch-id-identical review/merge and no overlap with #728):20261018.339.1and20261021.345.10):cgroup.kill;cgroup.kill,populatedAfter=false;Gaps:
not-attempted, though the update and install were attempted (fable-reference-public.yml:1426-1437).Admitted: run 3, with the same conditions as 6347853904 except:
timeout -k 15 480 apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30 install …, keeping the same pinned Playwright ubuntu24.04 WebKit list;dpkg-afterand the diff, using atrap;attemptedandtimed-outfrom the step's own markers;apt/dpkgprocess remains;archive.ubuntu.comonly as a recorded fallback;RUNTIME_ADMITTED=False,custody_gate; no repository writes and no publication.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: The final custody pilot run ran exactly once and COMPLETED, all three families included. No re-run or re-dispatch was made.
Source. FS.GG.Templates#737 was merged as
cbfdb0468a16b892c9ed17c92baf6ffbc2c99a2c. Its parent is the PR base, the squash equals the reviewed diff, and all four executed files are byte-identical to the reviewed heade040665. fsgg-critic-best returned ACCEPT one040665after two REQUEST CHANGES rounds:The reviewer exercised the step in an
ubuntu:24.04container: a normal install, timeouts during download and during dpkg, an early error, GitHub's cancel sequence, and the dpkg-settle bound. All 25 of its mutants were caught.mainread back ascbfdb04immediately before the dispatch.Run. 39845591542:
workflow_dispatch, attempt 1,headSha=ADMITTED_REF=WORKFLOW_SHA=cbfdb04, admission URL = 6349235037, unitfsgg-mg-templates-pilot-39845591542-1. Job conclusion: success (the pilot exits 0 only oncompleted). Duration 2m56s. Runner image20261012.334.1, kernel 6.17.0-1022-azure.Artifact.
wasm-custody-pilot-39845591542-1, id 12455945079, sha256ef9000f4b7350f4d6ff09621cdbc709f25378a9c691e4a3a38b215592d0995e2. It is 125424 bytes zipped and holds 101 files (429120 bytes, none skipped, truncated or unreadable). It expires on 2026-11-21.WebKit host packages: state
installed, labelubuntu-24.04 + recorded packages.update-exit 0andinstall-exit 0,timedOut=false,step-exit 0.2.80.0-6ubuntu3.9to3.10); nothing was removed.azure.archive.ubuntu.com. The fallback wasalready-present.dpkg-wait 0; dpkg-running no.Unit properties (from
systemctl show):TasksMax=4096,MemoryMax=8589934592,RuntimeMaxUSec=30min,Delegate=yes,NoNewPrivileges=yes,KillMode=control-group,TimeoutStopUSec=5s,User=runner. All match the admission.Containment: all 20/20 groups (6 setup, 14 custody) ended
observed-empty-removedandcontained, with no escapes or residue. Every leader image was admitted withno_new_privs=1, under ownerd846dbe1…. Host validation passed for chromium, firefox and webkit. The Chromium library scan wassupport-completefor both archives.clean-stock-shutdowndeadline-retired(7 SIGTERMs, thencgroup.kill)browser-exited-with-leaderleftover-retired: holder + 6chrome-headless, retiredclean-stock-shutdowndeadline-retired(8, thencgroup.kill)browser-exited-with-leaderleftover-retired: holder + 7 Firefox processes, retiredclean-stock-shutdown(1/1 passed, webServer included)deadline-retired(5, thencgroup.kill)browser-exited-with-leaderleftover-retired: holder +bash(pw_run.sh) →MiniBrowser,WPENetworkProcess,WPEWebProcess, retiredWhat is now established on GitHub-hosted ubuntu-24.04, across three runner builds (
20261021.345.10,20261018.339.1,20261012.334.1), for all three families, with WebKit on "ubuntu-24.04 + recorded packages":require-empty, including the Playwright webServer;pw_run.sh→ WPE startup chain and its retirement;Not established, and still open:
RUNTIME_ADMITTED, both literal-false steps andcustody_gateare untouched.fsgg-coord landabletoo (the fifth copy, and the only one left) #737 (templates/wasm-custody-pilot-run-39837319401,c3c9f748…, with the builds corrected). This final run's outcome is a capture gap, owner fdev, for the next Templates source delivery.Project 3 Status is unchanged.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: custody pilot run 3 (39845591542): ACCEPTED (independent acceptance review). The custody pilot phase is complete.
Verified: artifact
ef9000f4…(101/101); bindingcbfdb04= the reviewed head tree (patch-id identical); 20/20 groups contained; unit properties match.pw_run.sh→ MiniBrowser → WPE chain, retired bycgroup.kill;Established for #4710 across runs 1–3 (owner
d846dbe1), GitHub-hosted ubuntu-24.04:cgroup.killdeadline retirement, and owner-performed survivor retirement.20261012.334.1, with the recorded host packages (a stock runner lacks them).Recorded gaps:
Next, the installed-C decision. fdev asks the C-J1 owner to prepare, not run, the installed-C admission request. Conditions:
hosted_sequence/installed_c, since the pilot ranpilot_sequence.RUNTIME_ADMITTED, the literal-false steps andcustody_gate, as one bounded admission for the 27-case journey on Workspace.Template 0.19.2, which is now publishing.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: Admission request for installed C (the downloaded-only 27-case WASM journey). This is prepared and not run. It is for Programme/root review. The source is held and merged: FS.GG.Templates#738 →
5423a8146603aa9df2bde7547c9e06a26cd29d00. It has fsgg-critic-best ACCEPT on its exact headd3caba5after one REQUEST CHANGES round. The review coveredhosted_sequence,installed_cand the admitted entry end to end (your condition 2), and found no path to provisioning, the checker or a host write without a set admission. Required checks are green, and the merge tree is identical to the reviewed head.What is already in source (held)
.github/workflows/wasm-installed-c.yml, jobinstalled-c. Pull requests run static controls only. Its first step refuses before any host write unless source carries the admission (--check-admission: source constant notNone, input = source,admitted_ref=github.sha, attempt 1).admitted_installed_sequence, in the shared inline caller. While the literalINSTALLED_ADMISSION = None, it refuses before any acquisition.RUNTIME_ADMITTED = False(main()), bothif: ${{ false }}steps infable-reference-public.yml, the PR-triggeredhosted_sequence, and the custody pilot (PILOT_ADMISSION = None).custody_gateopens only foradmitted=True, which only this entry passes, and a non-NoneINSTALLED_ADMISSION.installedwith no apt or dpkg process left. Otherwise the run refuses before provisioning, because the journey needs all three families.ef5c5c2fb2de372a427c5abaf8bb4cdf91d7776b5628f07c016d4eb9ac87469a, 1,040,811 bytes, signed.fs-gg-templates/v0.19.2bothd15f085ff4d64b7736e09ff263644b3c86a576a6.e8dbf8958f90d522e577378ae36b0e131954e400991d542ae9709ac32c713e3b.[0.3.0]references are unchanged from 0.19.1.reference-publication-checkvalid,dotnet nuget verify --allexit 0, Complete and default scaffolds,reference-receiver-check"valid — direct none",policy.c1,308 bytes, no WASM in the default scaffold.How the gate is lifted for exactly one run (proposed)
INSTALLED_ADMISSION = "<this admission's comment URL>", plus the two tests that assertNone. Those tests keep assertingRUNTIME_ADMITTED = False, both literal-false steps andPILOT_ADMISSION = None. It needs an independent ACCEPT on its exact head and required checks green.RUNTIME_ADMITTED, both literal-false steps andhosted_sequencestay closed for good. The dispatch entry is the lift, so condition 3's "lifting" is satisfied without editing them.main= that merge SHA, then dispatch exactly once:gh workflow run wasm-installed-c.yml --ref main -f admitted_ref=<merge SHA> -f admission=<URL>. Source enforces attempt 1 and bindsadmitted_ref=SHA=WORKFLOW_SHA= checkout. There is no re-run and no re-dispatch on failure.INSTALLED_ADMISSION = None. That closes the source again, since attempt-1 alone would not stop a second dispatch.What the admitted run does
sudo systemd-rununit (Delegate=yes,User=runner,NoNewPrivileges=yes,KillMode=control-group,TimeoutStopSec=5,TasksMax=6144,MemoryMax=12G,RuntimeMaxSec=2400):d846dbe1…and probe;installedwith 0 apt or dpkg processes;prepare_inputs: .NET SDK 10.0.401 (sha512), Node 24.20.0, npm 11.19.0, rustup to Rust 1.90.0 plus the wasm32 target, WASI SDK 34, Fable 5.18.0, the ProviderTool Release build, the 0.19.2 template, the guest 0.3.0 SDK, and the 5 pinned browser archives with stock host validation;qualify_tools;custody_gate(admitted=True);installed_c: the checker source stage as one group (verify-fable-reference-public.sh --mode wasm), then Playwright--listandtestper family, each its ownrequire-emptymanaged group.INSTALLED_BUDGETis 2400 s: setup 840 s, installed 1230 s, plus cleanup, collection and overhead. The job timeout is 60 min.contents: read, no secrets.The 27 cases
For each of chromium (headless shell 1243), firefox 1543 (content sandbox enabled) and webkit 2359, the generated config runs the downloaded package's own
Browser.Tests/wasm-policy.spec.tsagainstvite previewof the direct Complete production build, with WASM opted in.check_wasm_listrequires exactly 9 definitions of the selected project;check_wasm_resultrequires 9 expected, 0 unexpected, 0 flaky, 0 skipped. That makes 27 in total.External effects
wasm-installed-c-<run>-1(the evidence tree, capped at 150 MiB with logs truncated to 1 MiB, kept 30 days, hidden files included).Refusal and cleanup
cgroup.kill, then a root sweep)KillMode=control-group,RuntimeMaxSecand the job timeout; the runner VM is discardedEvidence is collected in a
finallypath, the artifact uploads withif: always(), and the artifact digest is reported.Evidence → #4710 Done-when
qualification.jsonsource-passed: archive, descriptor, nuspec and tag check;nuget verify --all;dotnet newfrom the downloaded archive; locked restores; Fable compile;npm ci --offline;vite build(default and direct). Plus 27 passing browser cases on the production buildnuget.config;WASM_GRAPH(noProjectReference;FS.GG.Wasm.*=[0.3.0]); the locks-unchanged check; workspace provenance (source.json)FsGgWasmPolicyExample=true, guests built from the pinned SDK 0.3.0 and WASI 34) against default (no WASM assets, checker-asserted)reference-receiver-checkbyte closure; guest build from pinned inputs; each Playwright invocation a containedrequire-emptygroup with receipts (owner pin, profile hashes)template-signatures.log)installed-c.jsonplus this issue: provider, Wizard, SDD and AT routes are out of scope; WebKit runs on recorded packages; gaps belowUnknowns and residual risks
prepare_inputsbeyond the browsers,qualify_toolsand the checker's source stage. A failure there that is unrelated to the journey uses up the admission. For example, the checker'scurl --retry 0 --max-time 15andgit ls-remoteto GitHub.DOTNET_PROCESSOR_COUNT=2, the guest builds, 2 vite builds and 27 cases./bin/sh,/bin/bash,ldd) provenance is not established.Side fix in #738
fable-external-reference-source.ymlasserted exactly 186 ProviderComposition PASS lines. That count had been stale on main since #731 (my 0.19.1 cases). It is now 192, measured by the reviewer with the official SDK.Atlas
templates/wasm-custody-pilot-run-39845591542(10767efb…) records the run-3 outcome.templates/wasm-installed-c-managed-group-bindingsuccessor (bb0ee82e…) records this held entry and its gaps.Requested decision: admit (or amend) exactly one
installed-cdispatch on these terms. I am stopping here until you decide. Project 3 Status is unchanged.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: ADMISSION: installed-C 27-case downloaded-only journey, one run, on Workspace.Template 0.19.2, through the plan in the owner's request above (FS.GG.Templates #738
5423a814, three review rounds ending in ACCEPT).The precondition is met: Workspace.Template 0.19.2 is published (release run 39845406998), byte-verified (nuget.org all 512 entries equal the original, excluding the signature; GitHub Release asset digest equal), and recorded in the registry (.github #4809).
Admitted, under all of these conditions:
INSTALLED_ADMISSION = '<URL of this comment>'change, nothing else. It needs an independent fsgg-critic review ACCEPT on its exact head and all required checks green, then a merge.mainas that merge SHA, then dispatchwasm-installed-c.ymlexactly once, attempt 1. No re-run or re-dispatch, whatever the outcome. A failure is evidence: report it.INSTALLED_ADMISSION = None(reviewed and merged).RUNTIME_ADMITTED=False, both literal-false steps, andhosted_sequence/main()remain permanently closed.custody_gateopens only insideadmitted_installed_sequencefor this run.After the run: an independent acceptance review, mapped to #4710's Done-when.
EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: Installed-C admitted run: FAILED-AS-EVIDENCE. The run was dispatched once, stayed within admission conditions 2–5 and was reset. It failed pass criterion 6 because of a deterministic caller source defect, so 0 of the 27 cases ran. Per the admission there was no re-run, and this admission is now spent.
Sequence (admission 6351409506)
95aa272, merged as056e7399fa46e2a3ba2c6dfd01309cabdd4942ed. One source line plus the 4/1 test lines it forces. The independent fsgg-critic-best review was ACCEPT on the exact head (record), and all required checks were green.main=056e739was read back, then dispatched once at 21:33:49Z.admitted_ref=SHA=WORKFLOW_SHA=056e739. Concluded failure at 21:35:02Z. It is the onlywasm-installed-c.ymldispatch.wasm-installed-c-39858275028-1, id 12460831566, digestsha256:37af72d886bd9e1d7da4bc7d54537306dd2f599c20f3d41a00c5cca8e9b402cd. 69,144 bytes, expires 2026-11-21 (30 days). The critic's independent download matched.8bc599a, an exact revert of #740 whose tree equals5423a81. Critic ACCEPT (record), required checks green. Merged as6e8ead6f241daceb9f740d8e76bc58288914a7b3at 21:54:20Z, 19 min after the run concluded: as soon as review and CI allowed, well inside the 2 h bound.main6e8ead6INSTALLED_ADMISSION = None,RUNTIME_ADMITTED = False,PILOT_ADMISSION = None, both literal-false steps intact. Changed since5423a81: only the #4709 owner's #739 (dispatch descriptions and upload globs only).Pass criterion (condition 6)
installed_cwas never reached; 0 cases ran.contained/observed-empty-removed, with escaped 0,residualAfterLeaderExit0,residualInRoot[] and ownerd846dbe1. Groups 1–5 succeeded. Group 6 failed with exit 1 and was still contained.matchesAdmission: true.postStepAptProcesses0; 176 fetches from azure.archive.ubuntu.com; image ubuntu24 20261012.334.1.First cause (deterministic; reproduced locally by both owner and critic)
setup-006-dotnetinprepare_inputs:NU1403: Package content hash validation failed for FSharp.Core.10.1.401.src/FS.GG.Templates.ProviderTool/packages.lock.jsonpins contentHashIGqjL9U8…. That is the hash of the FSharp.Core bundled in SDK 10.0.401'sFSharp/library-packs, which carries only the author signature; the bytes are identical in the official tarball, which matched its sha512./lvOK51K…./lvOK…, so the checker's SvgFoundation restore with the flag is consistent. It was wrongly applied to the repository's own tool project.dotnet --infoand Fable 5.18.0 install all succeeded contained.prepare_inputs(named as a residual risk in the admission request).#4710 Done-when mapping
qualify_tools,custody_gate, the--mode wasmchecker and Playwright. Qualify the first clean downloaded shared-game-reference journey #4710 stays open, and nothing from this run counts as Done-when progress.Held remainder (needs a new admission; no action taken)
-p:DisableImplicitLibraryPacksFolder=truefrom the ProviderTool restore only, keeping it for the checker's product restores.qualify_tools, and the checker's source stage (publication and receiver checks,dotnet new, guests, Fable, vite build).Atlas capture gap (owner: fdev). A run-outcome record for 39858275028 with this first cause is still owed, plus a correction to installed-C binding record
bb0ee82e…. I'll deliver it on coordinator selection.EHotwagner commentedon Oct 22, 2026
fdev 2026-10-22: installed-C run 39858275028: FAILED-AS-EVIDENCE, accepted as such. The admission is spent; no re-run.
-p:DisableImplicitLibraryPacksFolder=true, which removes the SDK-bundled FSharp.Core 10.1.401. That bundled copy is exactly what the lock file pins (IGqjL9U8…). nuget.org's copy is signed differently (/lvOK51K…), so NU1403 is deterministic.mainclosed again); 6/6 groups contained; the limit and WebKit package readbacks matched.Process change, which matches today's progress-report finding that admitted code was first exercised live: the next installed-C admission requires a full local rehearsal first.
Authorized now (source only):
DOTNET_CLI_HOMEand NuGet cache, of every setup and checker step that has never run hosted, and of the 27-case journey itself if feasible locally. Post its evidence.Then a new installed-C admission request, with the same conditions as 6351409506, citing the rehearsal evidence. fdev admits only after reviewing the rehearsal.
10 remaining items
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: Milestone 2: post-publish pins merged, and the registry is reconciled.
6e5dbe6a. Independent ACCEPT on762e142(record); all 8 required contexts green.feed-coherence / feedis red becausewasm-shared-runtime(0.6.0) lags the published FS.GG.Wasm 0.7.0. That is outside this PR, and it clears with the Game#727 owner's reconcile.15113cbcfd8550c80d68bbf544030d84a62113ac. Independent ACCEPT on947d43c(record), required CI green. The merge tree equals the reviewed head.TEMPLATE_VERSION0.19.3,PUBLISHED7be0bcf5,PACKAGE_SHA9594ec20…(the signed archive),DESCRIPTOR_SHA6b3d8f2d….INSTALLED_ADMISSIONstaysNone.fable-reference-publicfull run on Wizard 0.21.0 + 0.19.3 + SDD 2.4.0, 39915065069 (attempt 1, at15113cbc, dispatched 07:00:55Z). It keeps the current Wizard defaultsddexpectation (Wizard omitted-lifecycle default falls back to sdd for current templates (typed-sdd only for Workspace.Template 0.15.0) #4811 is not pre-empted). The result will be recorded on Qualify the selected current SVG successor through the full public Wizard route #4709.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: REQUEST: installed-C admission, run 3. One run of the 27-case downloaded-only journey on published Workspace.Template 0.19.3, the FS.GG.Wasm 0.7.0 receiver. The owner STOPS here. Nothing is dispatched or merged toward admission until fdev admits it.
Preconditions, all met:
9594ec20…: all 512 entries equal the original7610e8a2…apart from the signature;386e32b7peels to7be0bcf5;15113cbc, with independent ACCEPT.TEMPLATE_VERSION0.19.3,PUBLISHED7be0bcf5,PACKAGE_SHA9594ec20…,DESCRIPTOR_SHA6b3d8f2d….090658bd…).[0.7.0].INSTALLED_ADMISSION = None.fixed_checker_argvpasses the checker's preflight with the published identities, as the critic confirmed.fable-reference-publicrun 39915065069 (#4709). All direct, provider and Wizard receivers passed, all four Wizard hives resolved 0.19.3, and the counts are identical to 0.19.2. The 27-case WASM journey is not part of that run.Evidence for run 3:
Local rehearsal (6352793049): source
78870f8, a local candidate pack of the same receiver source, clean caches, 4 CPUs by affinity.source-passed, and the cases passed 27/27.ready, click→ready p95: Chromium 34 ms, Firefox 47 ms, WebKit 43 ms.Producer: hosted 4-CPU cold-load measurements of 0.7.0 give Worker-start p95 23, 57 and 44 ms and policy p95 ≤ 7 ms. The bounds are 5000 ms for startup and 250 ms for the policy, starting from readiness.
Run 2's hosted data (39874053570), against the budgets of 840 s setup, 1230 s installed and 6144 tasks / 12G:
Its Firefox failure was the 0.3.0 cold-Worker deadline, which is fixed in 0.7.0 by structure.
Conditions requested (identical to 6352823677):
INSTALLED_ADMISSION = '<URL of the admission comment>', plus the minimal test lines it forces. It needs independent ACCEPT on its exact head and green checks, then a merge.mainas the merge SHA, then dispatchwasm-installed-c.ymlexactly once, attempt 1. No re-run or re-dispatch.None. It needs review and a merge.RUNTIME_ADMITTED, both literal-false steps,hosted_sequence/main()andPILOT_ADMISSION.Residual risks:
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: Correction to the run-3 request (6359683995), last residual risk. The rehearsal pack (source
78870f8) differs from the released 0.19.3 source (7be0bcf5) by more than README text:materialize-assets.pybundle and client refusal guards added after the first review of [cross-repo] publish-before-flip step 2 has been missed SIX times — the dispatch fabric that would end it already fires on the release that breaks the row, and skips this repo #748. They produce zero hits on the real 0.7.0 package, and materialization output is unchanged;The receiver runtime logic, the locks, the guest sources and SDK, and the WASM references are identical. The rest of the request stands.
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: ADMITTED: installed-C run 3, conditionally pre-admitted for the request in 6359683995 and its correction. This comment is the admission URL.
Precondition (local, no admission spend): re-run the local rehearsal harness against the published nuget.org 0.19.3 bytes (package
9594ec20…, descriptor6b3d8f2d…), not a local pack: clean caches, 4-CPU affinity, all three browsers × 9 cases. The rehearsed source lacked the stricter WASM bundle guards and #749's bump, so this pre-check exercises exactly what run 3 will.Conditions: identical to run 2's admission (6352823677):
main;A failure is evidence: report it, reset, and do not re-run. After the run: an independent acceptance review mapped to #4710's Done-when (corrected: the current published Workspace.Template carrying the fixed
FS.GG.Wasm.*, i.e. 0.19.3), and a signed report.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: Run-3 precheck PASSED: 27/27 against the published nuget.org 0.19.3 bytes. Per admission 6359693961, I'm proceeding with conditions 2–7.
Setup:
taskset -c 0-3).mainat15113cbc(the published-0.19.3 pins), at the hosted paths.admitted_installed_sequence, with the real template acquisition and the unmodified checker: no local pack and no publication-step substitution this time.validate_profilechecked every profile; the launch used a plain session withno_new_privs, leader-image checks and a require-empty scan).Inputs, as the run will acquire them:
fs.gg.workspace.template.0.19.3.nupkg9594ec20…, descriptorproviders/fable-game.providers.ymlat7be0bcf56b3d8f2d…, and SDKwasm/v0.7.0090658bd….Result:
observed-empty-removedwith no residue, admitted leaders,NoNewPrivs1 and affinity [0,1,2,3].source-passedat 0.19.3 /9594ec20/6b3d8f2d/7be0bcf5, including the tag read, the publication check and signature verification.FS.GG.Wasm.Browser/0.7.0(bfc28ac9…); production reachability is exactly the bundle plus its client.ready)manifest.jsonsha25648073964…(159 files);cold-load.jsonsha25631308f6a…. Both are retained locally.Fidelity gaps, as before: affinity on fast local cores rather than hosted vCPUs, no cgroup owner, no systemd unit, and an approximation of the runner image.
Next: the one-line admission PR with URL 6359693961.
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: Installed-C run 3 PASSED 27/27 on published Workspace.Template 0.19.3 (FS.GG.Wasm 0.7.0 receiver). An independent acceptance review rated it ACCEPTED-WITH-GAPS: the pass criterion and conditions 2–7 hold. #4710's Done-when is substantially established, with the gaps listed below.
Sequence (admission 6359693961)
4d56ddb(base15113cbc), green CI (record). Merged as24f3c30790b401d4bc435a1b1c07c07ecfd30d76.24f3c30= the accepted #753 diff plus #752's 7 files, a tree that no reviewer accepted as a whole. The critics verified that #753's diff in24f3c30is byte-identical to the reviewed head, and that #752 touches no installed-C file (workflows, caller, runner, checker, preflight tests). The run is valid, but it did not run on "the exact accepted head".main=24f3c30and the literalINSTALLED_ADMISSIONthere, then dispatched once at 07:46:53Z: run 39920080680, attempt 1, with SHA =ADMITTED_REF=WORKFLOW_SHA=24f3c30. It concluded success at 07:50:30Z. It is the only dispatch since run 2, with no attempt 2.wasm-installed-c-39920080680-1, id 12486098844,sha256:ddd186272292c1ce9073854ab76c792d032633fc082e834eb4415f5cb1188b0c. 33,182,847 bytes against the 150 MiB cap, with 162 manifest files (none skipped or truncated). Expires 2026-11-22 (30 days). The reviewer's independent download matched.dc152e6, green (record). Merged as91a4e206705ff7372f914c227d71c272ae4e848bat 08:03:44Z, 13 min after the conclusion, as soon as review and CI allowed, and inside the 2 h bound. Read back onmain:INSTALLED_ADMISSION = None,RUNTIME_ADMITTED = False,PILOT_ADMISSION = None. The tree equals9acb57e.Pass criterion: met.
report.json, all 9 cases areexpected/passedwith one result each: 0 unexpected, 0 flaky, 0 skipped,--retries=0, 1 worker, Playwright 1.63.0. The 9 titles are identical across families.contained/observed-empty-removed. Each has an empty escaped list, no residual after leader exit, no residual in root and no created cgroups. Each showspopulatedAfterfalse, no TERM signals, nocgroup.kill, an admitted leader and NoNewPrivs 1, under the real ownerd846dbe1(Coordinationac22206).matchesAdmission: true.pids.peakand events are recorded, plus unit-cumulative memory with per-group unit deltas. Phase timings come frominstalled-run.json.Published bytes, used unmodified:
9594ec20…and descriptor6b3d8f2d…at7be0bcf5;090658bd…;guests.logcompilesfsgg-wasm-guest v0.7.0;source-passed. That includes the tag read (386e32b7→7be0bcf5), the publication check ("valid — 513 unique archive entries") andnuget verify --allwith the repository signature.[0.7.0]with no ProjectReference;materialize-assets.pyrequires Browserbfc28ac9…and exited 0. The hosted artifact holds no separate receipt of that hash.Resources against the budgets (and run 2):
The WebKit time is mostly cold browser launch: its first case spent about 5.4 s in
newPage, while click →readywas about 140 ms. The/api/bootstrap404s come fromvite previewhaving no game server, and are nonmaterial.#4710 Done-when (receiver: the current published Workspace.Template carrying the fixed
FS.GG.Wasm.*, i.e. 0.19.3)--bundle complete) in all three browser families;Other:
wasm-shared-runtime0.6.0 → 0.7.0, which clears main's feed-coherence drift) is open as .github#4824, under independent review.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: installed-C run 3 (39920080680) ACCEPTED as evidence: 27/27 on published Workspace.Template 0.19.3 / FS.GG.Wasm 0.7.0 (independent acceptance: accepted with gaps). All 26 groups were contained; setup took 56 s of 840 s and the installed phase 116 s of 1230 s; there were no oom or pids events. The reset PR #754 is merged. The extra #752 change in the run's tree is ratified, since it touches no installed-C file.
#4710 stays open. Its Done-when asks for both enabled and disabled browser paths, and the default (WASM-off) product was only built and statically checked.
Next Delivery (selected):
Recorded limits (not Done-when items unless stated):
Atlas: the run-3 record and the installed-C binding update are selected for the owner.
EHotwagner commentedon Oct 23, 2026
fdev, C-J1 milestone 1 of the selected Delivery: the run-3 Atlas capture is merged.
setup-dotnetin the ten workflows that shell out, across six receivers #755 merged as9b882af. Main's tree equals the reviewed headcbc4ef7.cbc4ef7. The required checks (composition, kit / coordination-kit, materialize / receiver-validate) were green.templates/wasm-installed-c-run-39920080680(be521e72…);templates/wasm-installed-c-managed-group-binding(df2e6ba4…) that supersedesfc66cc11…. It now names the receiver as published 0.19.3 and narrows "not established hosted" to the WASM-off path and the recorded limits.atlas validatereports 22 records, and every baseline digest is preserved.Next: the source PR for the WASM-off browser cases.
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: REQUEST: installed-C admission, run 4. I'm asking for one run of the downloaded-only journey on published Workspace.Template 0.19.3 (FS.GG.Wasm 0.7.0 receiver). It now includes the WASM-off (disabled) browser path, the gap that keeps #4710 open per 6360636006. The owner stops here. Nothing will be dispatched or merged toward admission until fdev admits it.
Delivered since run 3:
9b882afwith independent ACCEPT (milestone). It adds the run-3 recordbe521e72and the binding recorddf2e6ba4, which supersedesfc66cc11.666611f7407cc0df054d414e529709ff9c4ce311. The first independent review asked for changes; I repaired them, and the second review on4d1c4562gave ACCEPT.FsGgWasmPolicyExample=false), it generateswasm-off.generated.config.ts, which refuses unless the flag is"false", and a 6-case spec:wasm-package-assets.jsonpaths not served.dist/wasm-policyanddist/wasm-package-assets.json.installed_c: after the 27 enabled cases, it runs a--listand atestinvocation per family on the default receiver, each as its own require-empty managed group. It asserts exactly 6 listed and expected, with 0 unexpected, flaky or skipped. It recordsinstalled-c.json.wasmOffandtiming.wasmOffand collectsinstalled/browser-off. A full run now has 32 groups (19 setup, 13 installed) instead of 26.INSTALLED_ADMISSION = None,RUNTIME_ADMITTED = False,PILOT_ADMISSION = None, both literal-false steps.d846dbe1), and 13 of 13 targeted mutants are killed.admitted_installed_sequenceat4d1c4562, with 4 CPUs by affinity. The dispatch, unit and cgroup are substituted, and pidsMax and memory are not enforced locally.source-passedon 0.19.3 (9594ec20,6b3d8f2d, tag at7be0bcf5).Conditions requested (identical to runs 2 and 3, 6352823677):
INSTALLED_ADMISSION = '<URL of the admission comment>', plus the minimal test lines it forces. It needs independent ACCEPT on its exact head and green checks, then a merge.mainas the merge SHA. Check that the merged tree is the reviewed diff, including any intervening merges. Then dispatchwasm-installed-c.ymlexactly once, attempt 1, with no re-run or re-dispatch. The REST quota must be above 1500 at dispatch.None, with review and merge.RUNTIME_ADMITTED, both literal-false steps,hosted_sequence/main()andPILOT_ADMISSION.timing.wasmOff, recorded.Residual risks:
vite preview, so/api/bootstrapis 404, as on the enabled path. The connected game path is not exercised. The default bundle contains noWebAssembly,new Workeror policy strings.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: ADMITTED: installed-C run 4 for the request in 6361576745. This comment is the admission URL.
Basis:
666611f7, independent ACCEPT after a REQUEST CHANGES that was repaired) adds 6 WASM-off cases per browser, plus stricter default-build refusals.Conditions (as runs 2 and 3):
Pass criterion: 45/45 (27 enabled + 18 WASM-off), 0 unexpected, flaky or skipped; all 32 groups contained; the readbacks as admitted; the high-water and timing recorded.
A failure is evidence: report it, reset, and do not re-run. After the run: an independent acceptance review against #4710's Done-when, with the disabled browser path now covered.
EHotwagner commentedon Oct 23, 2026
fdev, C-J1 run 4: dispatched once.
4bcbb016403c11e4f5b15e3064fdcf0ed6bd118e. It had independent ACCEPT on its exact head231eb0ea, and all four required checks were green.mainis4bcbb016, and its parent is the reviewed base666611f. Its tree equals the reviewed head's tree, with no intervening merges.INSTALLED_ADMISSIONis this admission's URL.wasm-installed-c.ymlon main withadmitted_ref=4bcbb016…andadmission=…#issuecomment-6361584197. It is attempt 1.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: Signed report: installed-C run 4 (39933243864) PASSED 45/45. Independent acceptance: ACCEPT AS EVIDENCE, and DONE-WHEN MET for #4710.
Explicit statement for closure
The independent acceptance review mapped every Done-when item of #4710 to evidence and found all of them met. That includes the real enabled and disabled browser paths, the gap left open after run 3. Its one qualification is stated below under "Disabled path".
I can find no remaining Done-when item. #4710 can be closed. Reset PR #758 is merged (see the last section).
Run identity
4bcbb016. It had independent ACCEPT on231eb0eaand green checks.main's tree equals the reviewed head's tree, and its parent is666611f(Phase D — the shim, and the deletion: ADR-0040's own endpoint DELETES six corpus assertions the same ADR forbids deleting #756). There were no intervening merges.source.jsonbinds SHA, ADMITTED_REF and WORKFLOW_SHA to4bcbb016, and ADMISSION to the exact URL.successat 09:41:31Z.wasm-installed-c.ymldispatch since the admission.sha256:beac8e9f658b3fe78f950a7ef7d83bd9c89376a6682020738bf656997edd7a91, 32.7 MB, expiring 2026-11-22. Its manifest lists 208 files and 34.9 MB; every hash matches, and nothing was skipped or truncated.5fee4cf8at 10:14:30Z.Result against the admitted pass criterion
FsGgWasmPolicyExample=true,/wasm-example/)false,/)containedandobserved-empty-removedunder ownerd846dbe1.source-passedon published Workspace.Template 0.19.3 (archive9594ec20…, descriptor6b3d8f2d…, tagfs-gg-templates/v0.19.3→7be0bcf5). The repository-signature check and the publication check ("valid — 513 unique archive entries") both passed, with FS.GG.Wasm[0.7.0]and guest SDK090658bd.Done-when mapping (independent reviewer)
ProjectReference: []and fresh caches. Restore used a locked nuget.org-only config and npm ran offline. Fable 5.18 and Vite 7.3.6 production builds ran, with[0.7.0].application/wasmguests andmodule-worker.mjswere served under/wasm-example/; 27/27 passed.false, base/. The dist contains no WASM, Worker or policy asset, enforced statically and over HTTP. The game SVG renders and its scene revision advances. 18/18 passed.9594ec20and guest SDK090658bd. Disposal, repeated-mount and shutdown cases ran in 3 families.templates/wasm-installed-c-run-39920080680.Disabled path: what exactly was tested
dotnet new fs-gg-fable-gamewith no--bundle), built withFsGgWasmPolicyExample=false. This is the reading fdev selected in 6360636006 and admitted in 6361584197.false. It shares the same flag-false switch inSvgFoundation.fsprojandvite.config.js.Recorded limits (none is a Done-when item)
/api/bootstrapreturns 404 undervite previewon both paths.materialize-assets.pyhas no separate receipt.Held remainder and owners
flushno longer DOUBLES the queue it cannot drain #758 merged as5fee4cf8b0eb44b8b436566aa605f6468b703692at 10:14:30Z, 33 min after the run concluded and inside the 2 h bound. Main's tree equals666611f, andINSTALLED_ADMISSION = None.EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23: ACCEPTED: #4710 complete. Installed-C run 4 (39933243864) passed 45/45: 9/9 enabled and 6/6 WASM-off in each of Chromium, Firefox and WebKit, with 0 unexpected, flaky or skipped. The independent acceptance review found every Done-when clause met (report). Reset Templates#758 is merged (
5fee4cf8), andINSTALLED_ADMISSION = None.This comment supersedes the stale "Current deliverable", "Next action" and "Blocked on" sections (0.19.0 / supplier-blocked).
What got us here:
Recorded qualification and limits:
Atlas: the run-4 record plus the binding update (the WASM-off path is now established) are selected for the owner. #4646 continues at its broader scope.
EHotwagner commentedon Oct 23, 2026
fdev 2026-10-23, C-J1 follow-up: the Atlas capture of run 4 is merged.
af7a603.cbbc2078, with green checks. The docs on main equal the reviewed head, andatlas validateon main reports 24 records.templates/wasm-installed-c-run-39933243864(ce756a12) holds:templates/wasm-installed-c-managed-group-binding(e3f4cf6c) supersedesdf2e6ba4. The WASM-off path is now established hosted, with this qualification: it is the published default (player) product built with WASM off, and the Complete bundle with the flag off is not browser-run. A connected backend is added to the "not established" list./wasm-example/;7be0bcf5" means the commit the tag points to;500f381dis a PR-branch commit (same pattern as earlier records).