b2e6d6159e
The app's install clears the jobs folder on a PC, so a run job whose kit was fetched by an earlier fetch job finds
nothing after an update and fails in seconds (5 October 2026, 21:49Z, the AMD kit; bench-log 4df339f). Rule: a run
playbook that reaches a path under the jobs folder other than its own tests the kit is there before its first use,
and the fetch is republished under a new id after any app update.
tools/ci/kit-path-check.sh reads every *.ps1 under relay/playbooks/ and tools/. A kit root is a path derived from
the jobs folder (`$jobs = Split-Path $env:IGNEUM_JOB_DIR` then `Join-Path $jobs '<fetch id>'`, the race-5090.ps1
shape) or one carrying a literal `jobs\` (the amd-card-test.ps1 shape); every path built from it belongs to that kit.
A presence check (Test-Path, [IO.File]::Exists, [IO.Directory]::Exists, Get-Item or Get-ChildItem with -ErrorAction)
on the root or anything under it covers the whole kit. A use before that line fails with "kit path used before a
presence check: republish the fetch after any app update", as does a literal jobs\ path in a command with no check.
The job's own folder ($env:IGNEUM_JOB_DIR) is not a kit path.
Fixtures: kit-path-ok.ps1 (both shapes, checked; a sibling pack file covered by the worker's check) and
kit-path-unchecked.ps1 (the worker run before its check, a literal never checked); --self-test asserts the lines.
Wired into ci.yml after the bash-body step, and into publish-jobs.sh add --kind run beside the other two checks;
test-publish-jobs.sh gains the refusal (34 passed, 0 failed). The current tree: race-5090.ps1 is the one playbook
with a kit, checked before use. README-ship.md: the rule.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
10 KiB
Shipping an Igneum Miner version (packaging/README-ship.md)
One command cuts a version for both platforms. 4 October 2026: 0.3.1, 0.3.2 and 0.3.3 each took eight hand steps and
an hour; tools/ship-app.mjs is those steps in order, each one checked and resumable.
node tools/ship-app.mjs 0.3.4 --node vendor/igneum-node-v4 --notes "one line for the changelog"
Add --dry-run first: it reads everything, prints the plan and writes nothing.
What it does
| Step | What happens | Skips itself when |
|---|---|---|
| preflight | this tree clean and on master, the fork worktree clean (--node-commit <sha> pins it), tools, binaries, secrets present, gh account, what is live |
never (reads only) |
| bump | the six version files, written by one function and read back | the files already say the version |
| inputs | packaging/windows/push-inputs.sh with the fork's Windows exes (IGNEUM_WIN_RELEASE, IGNEUM_NODE_SRC) |
the live payload-inputs.json carries these exact files from this fork commit |
| commit | Igneum Miner <v>: <notes>, push master (the push starts the Windows build) |
committed and on origin/master |
| ci | the windows.yml run for that commit (dispatched when the push started none), polled every 30 s |
a green run for the commit exists |
| fetch | packaging/windows/fetch-ci-artifacts.sh <run>: installer and payload zip into the downloads folder |
the installer from that run is there |
| dmg | packaging/mac/build-dmg.sh under tools/lock/with-lock.sh build |
the DMG is newer than the bump (--rebuild forces) |
| copy | the DMG into the downloads folder | same sha256 already there |
| manifest | packaging/ota/publish-manifest.sh --no-deploy: signed, signature verified locally |
never (cheap) |
| deploy | the downloads folder, one Vercel deploy for the files and the manifest together | never |
| verify | HEAD and GET of the DMG, the installer and the zip (size and sha256 against the local copies); the live manifest through igneum-ota-sign verify |
never |
| console | one build item on the console (version, sizes, hashes, run, commit), then sync-dl |
never (upsert on ship:<v>) |
The six version files: app/igneum-app/Cargo.toml, app/igneum-app/Cargo.lock, app/windows/version.h,
app/igneum-app/resources/igneum-app.rc, packaging/windows/Igneum-Miner.iss, packaging/mac/app/Info.plist.
node tools/ship-app.mjs --check says whether they agree; --self-test runs the bump on a scratch copy.
Flags
| Flag | Meaning |
|---|---|
--node <dir> |
the igneum-node worktree the node and miner were built from (required); binaries from its target-integration/, else target/ |
--notes "..." |
the manifest's changelog line and the commit message |
--dry-run |
reads only, prints the plan (exit 1 when preflight would stop the real run) |
--from <step> |
resume at that step (preflight runs again first); the failure message prints this command |
--skip-windows, --skip-mac |
one platform only (the other entry is carried over when the live manifest is the same version) |
--node-commit <sha> |
the fork must be on this commit |
--win-release <dir>, --mac-release <dir> |
other binary folders |
--min-supported, --activation-height, --deadline-note, --channel |
passed to publish-manifest.sh |
--rebuild |
build the DMG again even when a fresh one exists |
--branch <name> |
accept another branch than master (a dry run from a worktree; the Windows build still runs on pushes to master) |
--public |
the manifest step also publishes the version into dl/public/ (no token in any URL; its own signed manifest; the /public/ aliases rewritten), the same deploy carries it, verify checks every public file and alias. The token folders are untouched |
The public downloads path (5 October 2026, testnet launch)
dl/public/ in the downloads folder holds only the current installers, the HiveOS package and the two signed manifests
(app and wallet) with URLs under https://dl.igneum.network/dl/public/, plus an unsigned index igneum-downloads.json
that the site build reads. Four stable aliases are rewrites in the downloads folder's vercel.json, written from what the
folder holds, so they follow every release by themselves:
| Alias | Rewrites to |
|---|---|
https://dl.igneum.network/public/igneum-miner-windows.exe |
dl/public/Igneum-Miner-Setup-<v>.exe |
https://dl.igneum.network/public/igneum-miner-mac.dmg |
dl/public/Igneum-Miner-<v>.dmg |
https://dl.igneum.network/public/igneum-miner-hive.tar.gz |
dl/public/igneum-hive-<v>.tar.gz |
https://dl.igneum.network/public/igneum-wallet-mac.dmg |
dl/public/Igneum-Wallet-<v>.dmg |
packaging/ota/publish-public.sh --app | --wallet | --hive <tar.gz> [--deploy] [--verify] [--dry-run] does the work;
publish-manifest.sh --public and ship-app.mjs --public call it, so every future release lands there too. The
HiveOS package comes from packaging/hive/make-hive-package.sh (Linux node and miner from a PC build job, the two GPU
workers from infra/cross/build-workers-linux.sh) and is published with --hive. The site (site/build.mjs) reads the
index at build time and stamps every download button with the version and size; TESTNET_OPEN there removes the
"Public testnet: not yet open" line on the go.
When a step fails
The tool stops, prints why and the --from command to retry. Nothing is skipped silently. State that is not a secret
(commit, run id, bump time, the hashes) is in ~/.cache/igneum/ship/<version>.json.
Secrets come from ~/.config/igneum (dl-token, dlsite-dir, ota-signing-key, relay token and key, the Vercel login) and are
never printed; every output line is scrubbed. gh auth switch --user igneum-labs runs before every gh call and before the
push.
What a cut needs before it starts
- The node fork built for both targets in
--node:target-integration/release/{igneumd,igneum-miner}andtarget-integration/x86_64-pc-windows-gnu/release/{igneumd,igneum-miner}.exe(proto-cuda/windows-node/cross-build.sh). - The prebuilt workers (
proto-cuda/nvrtc/igneum-worker-cuda.exe,proto-opencl/igneum-worker-opencl.exe) and the prover (proving/igneum-prove/target/release/igneum-prove-{host,export}); missing ones are noted, not fatal. - The Mac on mains, nothing else building (the DMG step waits for the build lock).
The site project on Vercel (4 October 2026, checked by hand)
Two Vercel projects are called igneum, in two teams, and the link file under site/.vercel points at the wrong one:
| Team | Login (global config) | Project | Holds | Deploys |
|---|---|---|---|---|
igneum |
igneum-labs (~/.config/igneum/vercel) |
igneum (prj_HcNO2NLY4jkhikmLMugpJ8nLcWNW, root directory site, build node build.mjs) |
igneum.network, igneum.com; env DATABASE_URL, LOG_INTAKE_KEY |
GitHub integration: every push to master is a production deploy, every branch push a preview (igneum-git-<branch>-igneum.vercel.app) |
[other-business] |
[user]-4826 (the default ~/.vercel) |
igneum (prj_y5lQg3C87fXAgoj3vug6iwWU3KwV, same settings) |
the 13 redirect domains (igneum.app, .art, .co.uk, .email, .info, .io, .net, .online, .org, .pro, .shop, .store, .vip, .xyz) |
nothing live |
So vercel env add from site/ fails with "Could not retrieve Project Settings" under the igneum login (the link file names
the [other-business] project, which that login cannot read), and would silently add the value to the wrong project under the default
login. The working commands, from site/ in the shared checkout (the link step rewrites site/.vercel/project.json, which
is ignored by git):
cd site
npx --yes vercel@latest --global-config ~/.config/igneum/vercel link --scope igneum --project igneum --yes
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env ls --scope igneum # names only
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env add LOG_INTAKE_KEY_NEXT production --scope igneum
A production deploy by hand is npx --yes vercel@latest --global-config ~/.config/igneum/vercel deploy --prod --yes --scope igneum
from the repository root (the project's root directory is site), but the normal path is a push to master. The relay
(igneum-relay) and the downloads folder (igneum-dl) are the other two projects in the igneum team; both deploy by CLI
from their own folders (relay/README.md, packaging/ota/README.md). CLAUDE.md still says the site sits in the [other-business]
team and deploys with --scope [other-business] from site/: that was true on 3 October and is not now.
Job scripts (5 October 2026, the lost-quote class)
A bash body in a PowerShell job (relay/playbooks/*.ps1, tools/**/*.ps1) is written to a file and run with
bash <file>, never inline. That is the 0.3.6 cut's rule. Twice on 5 October a body travelled inside a PowerShell
string, a quote was lost on the way through PowerShell, bash refused the whole body, and the job either reported exit 0
having done nothing (tools/amd-prove/pc1-cpu-prove.ps1, first version: an apostrophe inside a single-quoted awk
program) or failed in 4 s (the 0.3.10 installer job). The file shape keeps the body readable by bash -n before it runs;
pc1-cpu-prove.ps1 does that in the job itself. tools/ci/bash-body-check.sh fails CI on an inline body that does not
parse: it finds every body handed to bash (bash -c "...", bash -lc $var, a + concatenation, a here-string written to a
file and run), unescapes it the way PowerShell would, and runs bash -n on it. A body it sees but cannot read fails too.
--self-test shows it firing on the fixtures under tools/ci/fixtures/. A job script is published from a worktree and
never passes CI before it runs, so packaging/ota/publish-jobs.sh add --kind run runs the same check (and
tools/ci/prover-socket-check.sh, the root-socket class; bash -n for a .sh script) on the script before anything is
signed, and refuses the publish with the check's output. packaging/ota/test-publish-jobs.sh proves the refusals.
The wiped-jobs-folder class (5 October 2026, 21:49Z): an app install clears the jobs folder, so a run job that uses a kit
fetched by an earlier fetch job tests the kit is there (Test-Path on the kit root or any file under it) before its first
use, and the fetch is republished under a new id after any app update. tools/ci/kit-path-check.sh fails CI and the
publish on a kit path used before that check.