funman300/OpenFUT
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

blaze-host: move the dirty-tree safeguard to launch and evidence time

Browse Source 
The compiled-in dirty flag cannot be trusted for this job. Cargo does not
re-run a build script when another crate's source changes, so editing the
adapter and rebuilding the host leaves it reading 'clean' -- verified by
appending a line to the adapter and watching the flag not move.

So the stamp now only names the commit, and the real safeguards run at the
moment they matter and cannot go stale:

  * sidecar.sh checks the working tree at LAUNCH and warns.
  * check-live-parity.sh REFUSES on a dirty tree, since it produces the
    artefact a migration decision is made from. ALLOW_DIRTY=1 overrides for a
    throwaway check.

Both scope to the three migration crates, so unrelated submodule dirt does not
trigger them -- a warning that is always on is a warning nobody reads.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
funman300
2026-08-11 01:56:43 +00:00
parent 468b006008
commit cf3ddde3a6
3 changed files with 52 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openfut-blaze-host/build.rs
+12 -4
View File
@@ -49,10 +49,18 @@ fn main() {
println!("cargo:rustc-env=OPENFUT_BUILD_COMMIT={commit}");
println!("cargo:rustc-env=OPENFUT_BUILD_DIRTY={dirty}");
// Re-stamp when HEAD moves. Working-tree edits are not tracked by cargo's
// dependency graph, so `dirty` can go stale until something forces a
// rebuild — the startup banner says which commit it was stamped from, and
// the sidecar script re-checks the working tree independently at launch.
// Re-stamp when HEAD moves.
//
// IMPORTANT LIMITATION: this flag is best-effort and CAN BE STALE. Cargo
// will not re-run a build script because some other crate's source changed,
// so editing the adapter and rebuilding the host can leave `dirty` reading
// "clean". Verified: appending a line to the adapter and rebuilding did not
// flip it.
//
// So the compiled-in value is useful for naming the commit, and is NOT the
// safeguard. `sidecar.sh` re-checks the working tree at launch and
// `check-live-parity.sh` refuses to produce evidence from a dirty tree —
// those run at the right moment and cannot go stale.
for p in ["../.git/HEAD", "../.git/index"] {
if std::path::Path::new(p).exists() {
println!("cargo:rerun-if-changed={p}");