mikebrandon/here-telemetry-rnd
1
0
Fork 0
Code Issues Pull requests Projects Releases 10 Packages Wiki Activity Actions

WIP: integrate native Capture, private insights and HERE Capture Rooms #22

Closed
LNK wants to merge 56 commits from codex/here-room-cold-recovery-20260905 into main
pull from: codex/here-room-cold-recovery-20260905
merge into: mikebrandon:main
Conversation 1 Commits 56 Files changed 168 +25424 -3019
LNK commented 2026-09-05 13:53:11 +00:00
Contributor
Copy link

Capture Rooms adds a runnable HERE-authorized server alongside the native Capture
client and console. A participant can pair a device, accept a capture session,
upload private images, share selected material with a room and withdraw that
sharing. The server bounds request duration and upload size and shuts down pending
identity work in a controlled way. Initialization, enrollment, inspection, serving
and recovery are explicit commands.

This review spans the complete Capture integration: 56 commits and 168
changed paths from c251e4ded4227652414176eb9a311594e7a01d38 to
8017863e70b35ffb22d317505b773e9778455f2f (25,424 additions, 3,019 deletions).
It includes native Rust consent, storage, retention, uploader and session-history
work; the Capture console, local personal insights, encrypted insight vault,
import merging, opt-in Bluetooth heart-rate adapter and room interface; the
standalone server and Python authority adapter; deployment templates; and the
verifier/recovery corrections, plus a pinned Linux CI image and exact-head workflow.

The runtime package records hashes for all 40 source inputs and its four payload
files. CI rebuilds the runtime from the exact PR head and checks each input against
its committed Git blob and each payload against the package manifest. The CI
changes add the gate and resolve two existing store Clippy findings without
changing transaction or deletion-acknowledgment behavior, and keep private test
temporary paths short enough for Unix sockets in deep Forgejo checkouts. Setup documentation
also matches the current Node/Rust/pnpm/Python prerequisites, Windows desktop test
effects and portable-versus-POSIX room coverage.

The latest recovery rehearsal deliberately destroys the runtime container and its
temporary storage between phases. Separately retained synthetic checkpoints allow
a fresh runtime to reconcile an old source/pairing snapshot against its retained
frontier, revoke the old credential epoch and keep deleted images and withdrawn
sharing absent. A negative control demonstrates that a coherent old copy of all
three databases can pass local inspection; an independently retained latest
selection is required to reject that stale copy. These retained test archives
remain on the same host and do not prove production recovery after total host loss.

Validation receipts are source-specific:

  • 8017863: Forgejo run #3
    passed on the exact PR head: 434 Linux Rust tests, 810 TypeScript tests, six
    package typechecks, frontend build, contracts/codegen, and Clippy with warnings
    treated as errors. Supplemental checks passed: 18 launcher regressions,
    22 PowerShell process regressions on Linux, 28 packaging/harness/Compose
    regressions, and nine Caddy adapter checks. The uploaded artifact was downloaded
    and verified against all 40 committed source inputs and four runtime payloads.
    Artifact ZIP SHA-256: 2e0ccdad7fe38896c4a25b0b875ab9350641ba84f1e259b3b92ad71b72185707.

  • e03a775: 24 controller regressions passed. The renamed-container regression
    fails when the old name-only cleanup is restored. The final packaged runtime
    and exact committed harness passed 74 checks in three isolated Linux x86-64
    containers. External inspection confirmed all three exact container IDs were
    removed and the retained checkpoint hashes and private modes matched.

  • f7b0e35: 22 PowerShell verifier process regressions passed using real PowerShell
    7.6.5 on macOS with synthetic tool commands; five Bash verifier regressions
    passed. This does not verify Windows PowerShell 5.1 or native Windows argv.

  • a20f0c3: both real Compose parser regressions passed and failed against the
    prior unquoted tmpfs declarations.

  • 72066d9: 420 room tests, the room package typecheck, two packaging tests,
    12 harness regressions and a 64-check dedicated Linux x86-64 runtime/Caddy
    rehearsal passed. These older receipts are not represented as fresh e03a775
    full-suite or CI runs.

The workflow checks out the exact pull-request head, runs the complete Linux
verifier as UID/GID 1000 with a fixed environment and at most two available CPUs,
and uploads its logs and packaged runtime through the Forgejo-compatible artifact
action. Its pinned image is loaded in the existing runner's separate Docker daemon;
no new runner was registered and the default image for other projects was unchanged.
Base images and downloaded tools are pinned; apt package resolution happens at
image build time, so the resulting image ID and package inventory identify the
actual environment. The recipe is not a hermetic rebuild guarantee.

CI does not replay the real Docker runtime/ingress/recovery rehearsals, run native
Windows or macOS implementations, probe production identity, or establish recovery
after total host loss. Those platform and deployment receipts remain separate. The three previously known
Windows SSH routes timed out again at 14:56 UTC on September 5; no native Windows
verification ran. The next Windows run requires a controlled test desktop.

Relevant source documents are docs/ROOM-BRIDGE-RUNTIME.md,
docs/ROOM-BRIDGE-RECOVERY.md, docs/ROOM-BRIDGE-CI.md and
deploy/room-bridge/README.md.
This review does not activate live capture. Production acceptance still requires
the selected room and membership, actual browser identity/account binding,
independent recovery retention and a publisher-controlled connection window.

Capture Rooms adds a runnable HERE-authorized server alongside the native Capture client and console. A participant can pair a device, accept a capture session, upload private images, share selected material with a room and withdraw that sharing. The server bounds request duration and upload size and shuts down pending identity work in a controlled way. Initialization, enrollment, inspection, serving and recovery are explicit commands. This review spans the complete Capture integration: 56 commits and 168 changed paths from `c251e4ded4227652414176eb9a311594e7a01d38` to `8017863e70b35ffb22d317505b773e9778455f2f` (25,424 additions, 3,019 deletions). It includes native Rust consent, storage, retention, uploader and session-history work; the Capture console, local personal insights, encrypted insight vault, import merging, opt-in Bluetooth heart-rate adapter and room interface; the standalone server and Python authority adapter; deployment templates; and the verifier/recovery corrections, plus a pinned Linux CI image and exact-head workflow. The runtime package records hashes for all 40 source inputs and its four payload files. CI rebuilds the runtime from the exact PR head and checks each input against its committed Git blob and each payload against the package manifest. The CI changes add the gate and resolve two existing store Clippy findings without changing transaction or deletion-acknowledgment behavior, and keep private test temporary paths short enough for Unix sockets in deep Forgejo checkouts. Setup documentation also matches the current Node/Rust/pnpm/Python prerequisites, Windows desktop test effects and portable-versus-POSIX room coverage. The latest recovery rehearsal deliberately destroys the runtime container and its temporary storage between phases. Separately retained synthetic checkpoints allow a fresh runtime to reconcile an old source/pairing snapshot against its retained frontier, revoke the old credential epoch and keep deleted images and withdrawn sharing absent. A negative control demonstrates that a coherent old copy of all three databases can pass local inspection; an independently retained latest selection is required to reject that stale copy. These retained test archives remain on the same host and do not prove production recovery after total host loss. Validation receipts are source-specific: - 8017863: [Forgejo run #3](https://everything.hereandmore.com/mikebrandon/here-telemetry-rnd/actions/runs/3) passed on the exact PR head: 434 Linux Rust tests, 810 TypeScript tests, six package typechecks, frontend build, contracts/codegen, and Clippy with warnings treated as errors. Supplemental checks passed: 18 launcher regressions, 22 PowerShell process regressions on Linux, 28 packaging/harness/Compose regressions, and nine Caddy adapter checks. The uploaded artifact was downloaded and verified against all 40 committed source inputs and four runtime payloads. Artifact ZIP SHA-256: `2e0ccdad7fe38896c4a25b0b875ab9350641ba84f1e259b3b92ad71b72185707`. - e03a775: 24 controller regressions passed. The renamed-container regression fails when the old name-only cleanup is restored. The final packaged runtime and exact committed harness passed 74 checks in three isolated Linux x86-64 containers. External inspection confirmed all three exact container IDs were removed and the retained checkpoint hashes and private modes matched. - f7b0e35: 22 PowerShell verifier process regressions passed using real PowerShell 7.6.5 on macOS with synthetic tool commands; five Bash verifier regressions passed. This does not verify Windows PowerShell 5.1 or native Windows argv. - a20f0c3: both real Compose parser regressions passed and failed against the prior unquoted tmpfs declarations. - 72066d9: 420 room tests, the room package typecheck, two packaging tests, 12 harness regressions and a 64-check dedicated Linux x86-64 runtime/Caddy rehearsal passed. These older receipts are not represented as fresh e03a775 full-suite or CI runs. The workflow checks out the exact pull-request head, runs the complete Linux verifier as UID/GID 1000 with a fixed environment and at most two available CPUs, and uploads its logs and packaged runtime through the Forgejo-compatible artifact action. Its pinned image is loaded in the existing runner's separate Docker daemon; no new runner was registered and the default image for other projects was unchanged. Base images and downloaded tools are pinned; apt package resolution happens at image build time, so the resulting image ID and package inventory identify the actual environment. The recipe is not a hermetic rebuild guarantee. CI does not replay the real Docker runtime/ingress/recovery rehearsals, run native Windows or macOS implementations, probe production identity, or establish recovery after total host loss. Those platform and deployment receipts remain separate. The three previously known Windows SSH routes timed out again at 14:56 UTC on September 5; no native Windows verification ran. The next Windows run requires a controlled test desktop. Relevant source documents are `docs/ROOM-BRIDGE-RUNTIME.md`, `docs/ROOM-BRIDGE-RECOVERY.md`, `docs/ROOM-BRIDGE-CI.md` and `deploy/room-bridge/README.md`. This review does not activate live capture. Production acceptance still requires the selected room and membership, actual browser identity/account binding, independent recovery retention and a publisher-controlled connection window.
LNK added 53 commits 2026-09-05 13:53:11 +00:00
ci(capture): verify the exact PR head on a pinned Linux runner image
Some checks failed
Capture Linux / Full Linux source gate (pull_request) Failing after 4m20s
Details
d624abd8a0
fix(ci): keep Unix socket fixtures short in deep Forgejo checkouts
All checks were successful
Capture Linux / Full Linux source gate (pull_request) Successful in 4m48s
Details
c51ac8b1ec
docs(capture): align verifier prerequisites and native test effects
All checks were successful
Capture Linux / Full Linux source gate (pull_request) Successful in 5m2s
Details
8017863e70
LNK commented 2026-09-07 10:02:12 +00:00
Author
Contributor
Copy link

Closing: everything on this branch is already in HERE/Capture. Its head (8017863) is an ancestor of HERE/Capture main, which became the project's home on 2026-09-05 (HERE/Capture PR #1) and carried this integration forward there (PRs #8 to #12). Nothing is lost by closing; the branch stays in place.

Closing: everything on this branch is already in HERE/Capture. Its head (8017863) is an ancestor of HERE/Capture main, which became the project's home on 2026-09-05 (HERE/Capture PR #1) and carried this integration forward there (PRs #8 to #12). Nothing is lost by closing; the branch stays in place.
LNK closed this pull request 2026-09-07 10:02:12 +00:00
All checks were successful
Capture Linux / Full Linux source gate (pull_request) Successful in 5m2s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
mikebrandon/here-telemetry-rnd!22
No description provided.