From 007556df90bbafbb0e5d89b5c7e2847bc589d358 Mon Sep 17 00:00:00 2001
From: igneum-labs <337424239+igneum-labs@users.noreply.github.com>
Date: Mon, 5 Oct 2026 08:53:28 +0000
Subject: [PATCH] release-0.3.6 plan: section 8, the cut (merges, changes,
 tests, secrets, binaries, digest, live manifest)

---
 docs/plans/release-0.3.6.md | 95 +++++++++++++++++++++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/docs/plans/release-0.3.6.md b/docs/plans/release-0.3.6.md
index ab713eeb..c2ed9dfe 100644
--- a/docs/plans/release-0.3.6.md
+++ b/docs/plans/release-0.3.6.md
@@ -265,3 +265,98 @@ ceiling when the relay is down. Numbers below are measured, not estimated.
 Not yet done on this branch: the relay deploy (`relay/`, by the owner; the `/wake` route and the 60 s `maxDuration`
 go live with it, the `relay_wake` table appears on the first POST), the first live publish, and the Windows curl path
 of the long-poll (curl.exe 8.x in System32; the 58 s `--max-time` was reviewed, not run).
+
+## 8. The cut, 5 October 2026 (release engineer, from 09:30 BST)
+
+the project lead at 09:30 BST: "can we push 0.3.6 through?". Worktree `/Users/joshm/Projects/igneum-wt-ship036`, branch
+`release-0.3.6` from master 31c1b34. Every build through `/Users/joshm/Projects/igneum/tools/lock/with-lock.sh build`
+at `nice -n 19` with `-j 4`, the rustup cargo 1.99.0 on `~/.cargo/bin`. Times are UTC unless marked BST.
+
+### 8a. The merges, in order
+
+| Merge | Head | Commit | Conflicts and how they were resolved |
+|---|---|---|---|
+| `origin/testnet-adopt` | 09baf8e | c9bc6d4 | `docs/spec/05-fees-and-economics.md`: master's 5.10 (security budget, E15) kept as 5.10, the adopted fee table from testnet-adopt became 5.11; its cross references in `docs/analysis/base-fee-floor.md` and this file moved to 5.11. `docs/plans/release-0.3.6.md` (add/add): testnet-adopt's plan is the body, master's "what the proving activation taught us" follows as section 7. `site/index.html`, `site/journey.json`: generated, rebuilt with `node site/build.mjs` (bench, journey 40 entries, index, litepaper, live, evidence, wallet, 404, miners 6 rows) |
+| `app-ui` | ce31cbb | 356b3e6 | `.github/workflows/ci.yml`: both test steps kept (the wake test from master, the notice-strip test from app-ui); `node --test app/igneum-app/ui/notices.test.mjs`: 6 pass |
+| `proving-app` | 010a372 | ada90aa | `app/igneum-app/src/prover.rs`: proving-app's probe taken (the same hidden `wsl` call as master's 31c1b34, through the shared `wslhost::lookup_script`). This file: proving-app's Done table kept under section 7 |
+| `rotation-2` | 5317305 | 50920da | `.github/workflows/windows.yml`: both header comments; rotation-2's "packaged configuration" step runs first, then master's G13 "payload inputs" step (signature, hashes, node commit); the duplicate `dl-token` write in the inputs step dropped (the configuration step writes it). `node tools/ci/check-workflow-shell.mjs`: 12 run blocks, 25 `.ps1`, 0 findings |
+
+`engine.rs`, `state.rs` and `ui/app.js` auto-merged. job-wake was already in master.
+
+### 8b. Changes on top of the merges
+
+| Commit | What |
+|---|---|
+| 9541543 | Every process the engine starts on Windows is hidden. The four helpers (`detect::run_timeout`, `jobrun::run_capture`, `jobrun::run_streamed`, `procs::spawn`) already set `CREATE_NO_WINDOW`, which is why only 15 of the 89 `Command::new` sites were visibly wrapped; the direct `.output()`/`.spawn()` sites were not: the window host launch (`main.rs`), `icacls` and the three `reg` calls (`platform.rs`), the setup's `cmd /c start` (`prover.rs`), the Mac-only `xattr`/`hdiutil` calls (`ota.rs`, wrapped for a clean audit; `quiet` is a no-op off Windows). `igneum-prove-verify.exe` is now a windows-subsystem binary: the fork's `igneum/exec/src/proving.rs:498` spawns it with a bare `Command::new` from a node that has no console, so a console-subsystem wrapper opened a window on every verification. Sites left as they are: inside `#[cfg(target_os = "macos")]` or `#[cfg(target_os = "linux")]` blocks (scutil, caffeinate, osascript, open, pkexec, xdg-open) and the test-only bash in `manifest.rs` |
+| 3811d8e | Every WSL script runs from a file (coordinator, 09:4x BST; PC 2 on 0.3.5 reported "proving needs the WSL2 setup" with `/opt/igneum/igneum-prove-host` present: the inline `bash -lc "<script>"` with `[ -x "$f" ]` and the "Igneum Miner" path reached bash mangled; the same script from a file found the host, job prove-install-pc2-3 09:12 BST). `src/wslhost.rs`: `script_dir()` (`%LOCALAPPDATA%\igneum\wsl`), `write_script` (UTF-8, LF, no BOM, `#!/bin/bash`, unique name per process and call, removed on drop), `bash_line` (`bash [-l] '<file>' '<arg>'...`, every word single-quoted, never a double quote or newline), `command` (on Windows the tail after `--` goes on the command line as written, `CommandExt::raw_arg`, so neither the C runtime's quoting nor the shell inside the distribution re-reads it; arguments reach the script as `$1`, `$2`). Converted: the prover probe and `run_tool` (`prover.rs`), the setup launch (`cmd /c start "" wsl -d <distro> -- bash -l '<setup-wsl.sh>'`), the wrapper's probe and run (`bin/prove-verify.rs`; its `wslpath -a` round trip dropped for the pure mapping, same exposure), jobrun's six inline scripts (prover-probe, wsl-context, gpu-run, prover-kill, build-kill, free-gb). Unit tests: the line never carries a double quote or a newline; the file has LF endings and no BOM and is removed after use; the wrapper's run script ends in `exec "$h" "$@"` |
+| 7d7570a | `Igneum Miner 0.3.6: ...`, the six version files (bumped with the tool's own table, checked by `node tools/ship-app.mjs --check`: 0.3.6 in all 6) |
+| a98be35 | `push-build-inputs.sh`: the live sha256 check retries for a minute (8c) |
+
+Not changed: the fork's own `Command::new` for the verifier (no flags; the wrapper's subsystem makes it moot).
+
+### 8c. Test results, with the command
+
+| Tip | Command | Result |
+|---|---|---|
+| 9541543 (merges + hidden windows) | `cargo test -p igneum-app` | ok: 72 (lib) + 26 (bin) + 5 (prove-verify), 0 failed, 08:36Z |
+| 9541543 | `cargo build --release -p igneum-app` | ok, 1 min 32 s (target cloned by APFS from the main checkout: 5.5 s) |
+| 3811d8e (WSL scripts from files) | `cargo test -p igneum-app` | ok: 75 + 26 + 8, 0 failed, 08:47Z |
+| 3811d8e | `cargo check --target x86_64-pc-windows-gnu -p igneum-app` | ok (`raw_arg` and the subsystem attribute compile for Windows) |
+| 3811d8e | `cargo build --release -p igneum-app` | ok |
+| a98be35 | `packaging/windows/test-inputs-signing.sh` (signer from this tree) | 16 passed, 0 failed, the Mac's real OTA key verified by the key compiled into the app |
+| a98be35 | `node tools/ship-app.mjs 0.3.6 --node vendor/igneum-node-036 --branch release-0.3.6 --dl-both --dry-run` | preflight read everything; the only problems were the two Windows exes not yet built (8e) |
+| a98be35 | `bash -n packaging/windows/push-build-inputs.sh` | ok |
+
+### 8d. Secrets (values never shown)
+
+| Where | Name | Set | Listing |
+|---|---|---|---|
+| GitHub repo `igneum-network/igneum` | `LOG_INTAKE_KEY` | 08:36:35Z from `~/.config/igneum/log-intake-key` (`tr -d '[:space:]' \| gh secret set`) | `gh secret list`: DL_TOKEN (04 Oct), DL_TOKEN_NEXT, LOG_INTAKE_KEY, LOG_INTAKE_KEY_NEXT |
+| GitHub | `LOG_INTAKE_KEY_NEXT` | 08:36:36Z from `log-intake-key.next` | same |
+| GitHub | `DL_TOKEN_NEXT` | 08:36:37Z from `dl-token.next` | same |
+| Vercel project `igneum` (team `igneum`, linked from `site/` in the shared checkout) | `LOG_INTAKE_KEY_NEXT` (production) | 08:3xZ from `log-intake-key.next` | `vercel env ls --scope igneum`: DATABASE_URL, LOG_INTAKE_KEY, LOG_INTAKE_KEY_NEXT (the function reads it at the next production deploy, which the push to master is) |
+
+### 8e. Node binaries from fork 2b6d23ef
+
+| Platform | Path | sha256 | Size | Build |
+|---|---|---|---|---|
+| Mac arm64 igneumd | `vendor/igneum-node/target-036/release/igneumd` (copied to `vendor/igneum-node-036/target-integration/release/`) | 64138a1760ebcd5809582b26c7ba2c1e1c1f94f2a8e217287e2d71f97aa4a40b | 40,968,080 | `CARGO_TARGET_DIR=vendor/igneum-node/target-036 cargo build --release -j 4 -p kaspad -p igneum-miner --features kaspad/igneum-pow`, 8 min 26 s, done 08:45:58Z; `strings`: 2b6d23ef present, 20139145 absent; `igneum-miner --help` lists `--dev-fee`, `--poll-templates`, `--job-ms` |
+| Mac arm64 igneum-miner | same folder | ef438be2eaaaedfa767408a319ec5b9dd5178d51e264e618d5a8207f1044b195 | 8,514,864 | same |
+| Windows x86-64 igneumd.exe, igneum-miner.exe; Linux igneumd, igneum-miner, igneum-app | PC 1 build job (8f) | see 8f | | |
+
+### 8f. The PC build job (Windows and Linux)
+
+`IGNEUM_WIN_RELEASE=<main checkout>/vendor/igneum-node-036/target-integration/x86_64-pc-windows-gnu/release node tools/build-job.mjs run --node vendor/igneum-node-036 --target ae432dc7 --targets linux,windows --budget-minutes 45 --title "0.3.6 build on PC 1"` from the worktree root (a `vendor` symlink to the main checkout's `vendor/` makes the relative paths resolve; `vendor/` is ignored by git). take3 (release-0.3.5, 20139145) had finished at 08:30:50Z: every stage ok, 6 files uploaded, 5 min of 45.
+
+| Attempt | Published | What happened |
+|---|---|---|
+| 1 | 08:47:41Z | `push-build-inputs.sh` packed the fork (2b6d23ef) and the app (0.3.6), deployed the downloads folder (build-inputs.zip 8,206,587 bytes, e46ae8d74b892097296f3fc3b4a44ce2b0960f6d3578cf00eccb1fed0c82fcbc) and then read the live `build-inputs.sha256` once, straight after "Aliased": the edge still served the previous file, the check failed and nothing was published. A curl a minute later served e46ae8d7. Fix a98be35: six tries, 10 s apart (publish-jobs.sh already retried) |
+| 2 | 08:51:35Z | `build-20261005-085135` published and the apps woken (stamp 2026-10-05T08:51:35Z.852c054f). PC 1 runs 0.3.5, which has no waker (job-wake landed after the 0.3.5 cut): the 10-minute poll applies unless Check now is pressed |
+
+### 8g. The digest check (step 4)
+
+`vendor/igneum-node/target-036/release/igneumd --devnet --override-params-file=/tmp/igneum-devnet/override-v3.json --appdir=<scratch>/digest-036/appdir --rpclisten=127.0.0.1:60985 --listen=127.0.0.1:60986 --nodnsseed --nologfiles --yes` for 20 s (08:48:06Z to 08:48:28Z, then killed; nothing else touched; the override file reads `{"difficulty_v2_activation_daa": 33000, "proving_v0_activation_daa": 84100}`):
+
+```
+Proving v0 from the override file: provers paid from DAA score 84100
+Difficulty rule v2 from the override file: active from DAA score 33000
+Fees on igneum-devnet: pgas table v0, B_p 30000000 pgas, S_p 7500000 pgas, floors 1000000000 wei per gas and 1000000000 wei per pgas; calibrated v1 from DAA score never
+Consensus params digest: f10a4eab4b1f4f341d54b0b0221161d1122fac302bca90d6b61d14939b69fbd6 (exchanged in the p2p handshake; a peer with another digest is refused)
+igneumd/2.1.0-2b6d23ef
+```
+
+The digest equals the live one (difficulty 33000, proving 84100); the fee switch stays "never". Two warnings in the log, neither about the node: UPnP found no free port, and the eth_ RPC port 26790 was held by the live node 1.
+
+### 8h. The live manifest before the cut (read 08:3xZ from `dl/<token>/igneum-app-latest.json`)
+
+| Field | Value |
+|---|---|
+| version, channel, published_at | 0.3.5, devnet, 2026-10-05T07:20:49Z |
+| consensus.override | `{"difficulty_v2_activation_daa": 33000, "proving_v0_activation_daa": 84100}` |
+| consensus.activation_height, deadline_note | 84100, "proving v0" |
+| fees_v1_activation_daa | absent |
+| tuning | absent |
+| mac | dmg 2dad2b26..., 40,027,384 |
+| windows | inno-setup 0184abec..., 44,447,899 |
+
+`publish-manifest.sh` carries `consensus.override` and `tuning` over from the folder's manifest when not given; `activation_height` and `deadline_note` only come from flags, so the ship command passes `--activation-height 84100 --deadline-note "proving v0"` to keep the consensus object identical field by field.