LithosAnanke v4.0.0-alpha.1: the first alpha release #127

Merged

rajames merged 21 commits from StarForth-v4.0.0 into master 2026-11-07 17:46:02 +00:00

Conversation 0 Commits 21 Files Changed 66

+2416 -26

rajames commented 2026-11-07 17:16:13 +00:00

Owner

Copy Link

Copy Source

What and why

LithosAnanke v4.0.0-alpha.1, the first alpha release (Captain Bob, 2026-11-07: "Kernel is 4.0.0. This is our first alpha release"). After this merges, master's merge commit is tagged v4.0.0-alpha.1, which starts release.yml.

• Version: LITHOS_VERSION 2.1.0 → 4.0.0-alpha.1; the engine (VERSION) stays 3.2.0. The versioning policy in kernel/Makefile records the ruling: 4.x is a working line, v3.0.0 is no longer the next number.
• The StarshipOS CA (FABRIC-3 XLVI): ci/pki/make-ca.sh, run on the CI box; capsules/pki/starshipos-intermediate.der (StarshipOS Capsule Signing, issued by the StarshipOS Root CA) in place of the snakeoil intermediate; mkcapsule refuses a key that is not the certificate's; CI signs with the secret CAPSULE_SIGN_KEY. This PR's acceptance run is the first to sign the capsules.
• CI: the runner image fetches HOL-Library prebuilt (the server cannot build it); build.yml ignores site/-only commits.
• Websites: site/ -- the .com from the design canvas, the .org landing page and dashboards, inquiries (master/detail, admin-only), the StarshipOS banner, the design's colours over the wikis' high-contrast theme.
• Records: FABRIC-3 XLVI and XLVII, CHANGELOG.

Part of #120, #17. Not the v4.0.0 milestone: its nine open issues are what 4.0.0 itself will be.

Acceptance

The Acceptance check runs on this pull request, with the signing key. By hand, in a session with 15 GiB, on the tree this PR carries:

• Logs from runs made by hand are committed in logs/: amd64 20261107-165611, aarch64 -165817, riscv64 -170149 (POST 538/538, dict_hash=0xfec8c47cfc6f437f on all three), the stick loaded high -170326, test-32 (39 programs, 0 failures), the Isabelle/HOL proofs -171020
• Hardware this was tried on, if any: none

The record

• docs/fabric/FABRIC-3.md has the ruling and what was built (XLVI, XLVII)
• CHANGELOG.md (2026-11-07, v4.0.0-alpha.1)
• Nothing in this PR is a fix nobody asked for (.claude/CLAUDE.md, Hard Rules)

🤖 Generated with Claude Code

https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

## What and why **LithosAnanke v4.0.0-alpha.1, the first alpha release** (Captain Bob, 2026-11-07: "Kernel is 4.0.0. This is our first alpha release"). After this merges, master's merge commit is tagged `v4.0.0-alpha.1`, which starts `release.yml`. - **Version:** `LITHOS_VERSION` 2.1.0 → `4.0.0-alpha.1`; the engine (`VERSION`) stays 3.2.0. The versioning policy in `kernel/Makefile` records the ruling: 4.x is a working line, v3.0.0 is no longer the next number. - **The StarshipOS CA** (FABRIC-3 XLVI): `ci/pki/make-ca.sh`, run on the CI box; `capsules/pki/starshipos-intermediate.der` (StarshipOS Capsule Signing, issued by the StarshipOS Root CA) in place of the snakeoil intermediate; `mkcapsule` refuses a key that is not the certificate's; CI signs with the secret `CAPSULE_SIGN_KEY`. **This PR's acceptance run is the first to sign the capsules.** - **CI:** the runner image fetches HOL-Library prebuilt (the server cannot build it); `build.yml` ignores `site/`-only commits. - **Websites:** `site/` -- the .com from the design canvas, the .org landing page and dashboards, inquiries (master/detail, admin-only), the StarshipOS banner, the design's colours over the wikis' high-contrast theme. - **Records:** FABRIC-3 XLVI and XLVII, CHANGELOG. Part of #120, #17. Not the v4.0.0 milestone: its nine open issues are what 4.0.0 itself will be. ## Acceptance The **Acceptance** check runs on this pull request, with the signing key. By hand, in a session with 15 GiB, on the tree this PR carries: - [x] Logs from runs made by hand are committed in `logs/`: amd64 `20261107-165611`, aarch64 `-165817`, riscv64 `-170149` (POST 538/538, `dict_hash=0xfec8c47cfc6f437f` on all three), the stick loaded high `-170326`, `test-32` (39 programs, 0 failures), the Isabelle/HOL proofs `-171020` - [ ] Hardware this was tried on, if any: none ## The record - [x] `docs/fabric/FABRIC-3.md` has the ruling and what was built (XLVI, XLVII) - [x] `CHANGELOG.md` (2026-11-07, v4.0.0-alpha.1) - [x] Nothing in this PR is a fix nobody asked for (`.claude/CLAUDE.md`, Hard Rules) 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

rajames added 20 commits 2026-11-07 17:16:13 +00:00

ci: the nightly's proofs run last, and cannot hold back the images ... 5690d2980b

Nightly 174 passed acceptance, then Isabelle was killed building HOL-Library
(exit 137, out of memory on the runner), and the images were never built or
published. The proofs check the theories, not the images: they now run after
the publish, whatever happened before them, and a failure still turns the run
red. Their log stays in the run's logs artifact. A release still runs them
before it publishes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

ci: HOL-Library built into the runner image ... 4ae1f759d5

Measured here (Isabelle2025-2, one thread): HOL-Library from scratch takes
~11 minutes and peaks at ~5.3 GiB -- what nightly 174 was killed doing; the
StarForth session on a built HOL-Library takes under a minute and ~2.2 GiB.
The image builds HOL-Library once into Isabelle's own heaps, so every job
finds it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

pki: the StarshipOS CA, made on the CI box; capsules signed in CI ... 03027f9769

Ruled by Captain Bob, 2026-11-07: "New root CA on the CI box. Valid
StarshipOS rather than snake oil intermediate."

- ci/pki/make-ca.sh makes the StarshipOS Root CA (its key stays on the CI
  box) and the StarshipOS Capsule Signing intermediate it issues, and
  stores the signing key as the secret CAPSULE_SIGN_KEY.
- The kernel finds the signing certificate by one name,
  CAPSULE_SIGNING_CERT_NAME = pki:starshipos-intermediate.der. The
  certificate itself lands once make-ca.sh has run; until then the
  snakeoil intermediate is in the tree under its old name and the
  capsules check as "no root key" (a warning, as "missing" was).
- mkcapsule refuses a signing key that is not that certificate's.
- SIGN_KEY has no default; acceptance, build, nightly and release set it
  from the secret.

FABRIC-3.md XLVI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/org: the .org wiki's landing page and its two dashboards ... 51dd4a8391

Ruled by Captain Bob, 2026-11-07: a generic landing page for anonymous
visitors, a login-protected admin dashboard for him, and a protected
contributors' dashboard. Main.WebHome (everyone), Admin.WebHome
(XWiki.rajames alone), Contributors.WebHome (XWiki.StarshipContributors
and the administrator); CI shown as Gitea's live workflow badges.
install.sh puts them on the wiki through XWiki's REST API, with the group
and the space rights, and checks a guest's view. Not yet run: the .org
XWiki answers 503.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/org: the .org pages in the starshipos-f18.com look ... 6f14d8d6bc

Captain Bob, 2026-11-07: style .org like the StarshipOS.com design canvas.
build.py makes the three pages from one source, as {{html}} blocks in the
canvas's look (navy, orange accent, JetBrains Mono and Exo 2), and the same
pages as the canvas's .org artboards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

Merge remote-tracking branch 'origin/master' into StarForth-v4.0.0 911b1529cc

site/com: the .com pages from the design canvas, installed ... 8918951482

Captain Bob, 2026-11-07: build the .com from the StarshipOS.com canvas.
canvas/ holds the artboards as drawn; build.py makes Main, Inquiries and
TryIt as {{html}} pages (the wiki's links and domains, the images as
attachments, the real console in Try it, the forms by e-mail); install.sh
puts them on the wiki and checks a guest's view. Installed on
starshipos-f18.com: every page and image reads 200 as a guest, and renders
without a macro error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/org: installed; rights before pages; objects as XML ... 7d9dd4e4a9

The first run on starshipos-f18.org created the dashboards, then XWiki
refused the group and rights objects: a form-encoded POST needs XWiki's
form token (CSRF), an XML one does not. For about two minutes Admin.WebHome
and Contributors.WebHome were readable by guests (links and the names of
secrets, no values). Objects now go as XML, and the spaces' rights are made
before the pages, so a failed run cannot leave a dashboard open. Installed:
Main 200, Admin and Contributors 401 as a guest, 200 as rajames; a second
run changes nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site: the design's colours over the wikis' high-contrast theme; .org inquiries ... c2ff10015f

- site/colorlock.py: both XWikis force black and white with !important (a
  HIGH CONTRAST DARK THEME block in the skin's cssVariablesInit.css). On our
  pages only, the design's colours win: each inline colour made !important,
  and a stylesheet scoped to the page root (.ssos) for the rest. Used by
  site/com/build.py and site/org/build.py; the .com reinstalled with it.
- site/org/inquiries (Captain Bob, 2026-11-07): the .com's inquiries go to an
  admin-only master/detail on the .org -- Inquiries.WebHome (Live Data
  table), one page per inquiry under Inquiries.Entries with a sheet and a
  status, PublicInquiry (public) filing them with its author's rights and
  echoing nothing a visitor sends; a hidden trap field for robots. The .com
  form posts there. Installed and tested: a guest's inquiry filed and
  deleted; one whose name and message were script macros was stored as
  text, nothing ran.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site: no Python caches ... dca3ea56b9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site: visitors see the design alone, not XWiki's chrome ... 038556bb3e

Captain Bob, 2026-11-07: "Menu bar". For guests only, the .com pages and
the .org landing page hide XWiki's top bar, breadcrumb, title block, page
menu, panels, footer and tour, and the design runs the full width (a
velocity check on $isGuest; the stylesheet in a literal block). Logged in,
the wiki is all there. Checked on a phone and a desktop: the chrome is
hidden on Main, Inquiries and TryIt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

ci: no Build run for a commit that only changes site/ [skip ci] ... bb3246f924

Five website commits queued five Build runs (183-187), ~17 minutes of image
builds each on the server both wikis run on; the .org stopped answering.
build.yml now ignores pushes whose changes are all under site/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

site/brand: the banner says StarshipOS [skip ci] ... 236839a914

Captain Bob, 2026-11-07: "The banner XWiki should not say that." Both
wikis now have a colour theme of their own, FlamingoThemes.StarshipOS (the
stock Iceberg, copied, with the starshipOS wordmark as its logo; Iceberg
untouched), and the browser tab's title ends "- StarshipOS". Installed on
both; checked as a guest on each (logo and title), and the .org's top bar
seen logged in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

kernel: v4.0.0-alpha.1, the first alpha release [skip ci] ... b7534107f3

Captain Bob, 2026-11-07: "Kernel is 4.0.0. This is our first alpha
release." LITHOS_VERSION 2.1.0 -> 4.0.0-alpha.1; the engine (VERSION)
stays 3.2.0. The 4.x line is a working line (even major); v3.0.0 is no
longer the next number, and an LTS line takes the next odd major when
FABRIC-3.5.md XXX.5's criteria are met. Recorded in kernel/Makefile's
versioning policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

release v4.0.0-alpha.1: accepted in full, logs and record [skip ci] ... d7d431f1d6

The acceptance protocol on b7534107 (LithosAnanke v4.0.0-alpha.1), in this
session, one QEMU at a time in the foreground:
- amd64 logs/20261107-150809, aarch64 -151023, riscv64 -151359: [zuse@Hera]
  ok>, PARITY:V4_POST tests=538 pass=538 fail=0, POST: PASSED,
  dict_hash=0xfec8c47cfc6f437f on all three
- the PC stick loaded high, logs/20261107-151539: the same, no fault
- make -C v4 test-32: 39 programs, 0 failures
- Isabelle/HOL proofs, logs/20261107-152312/isabelle: Finished StarForth

CHANGELOG and FABRIC-3.md XLVII: the ruling, what was verified, and what
an alpha leaves open (the v4.0.0 milestone; unsigned capsules until the
StarshipOS CA).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

pki: the StarshipOS CA, made on the CI box (Captain Bob, 2026-11-07) c589d3d5b7

pki: the StarshipOS Capsule Signing certificate, in place of snakeoil [skip ci] ... 4ca935d82e

Made on the CI box by ci/pki/make-ca.sh (2026-11-07 16:50 UTC): subject
O=StarshipOS, CN=StarshipOS Capsule Signing; issuer O=StarshipOS,
CN=StarshipOS Root CA; 2026-11-07 to 2036-11-06; CA:TRUE, pathlen:0;
Ed25519. SHA-256 of the DER
13a28dda4098ef4f11cba42823a30a9898fdaffdf0c15130126fd2fe029b9a6c. Its key
is the repository secret CAPSULE_SIGN_KEY; the root's stays on the box.
The snakeoil intermediate leaves the tree (its history is in git).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

release v4.0.0-alpha.1: accepted again with the StarshipOS certificate [skip ci] ... 458f8f3ec8

The protocol on 4ca935d8: three boots (POST 538/538, one dict_hash), the
stick loaded high, test-32 (39 programs, 0 failures), the proofs. Every
capsule logs 'missing (unsigned)': the kernel reads the new certificate;
CI signs with CAPSULE_SIGN_KEY. FABRIC-3.md XLVII.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

Merge Captain Bob's c589d3d5 (the same certificate, committed on the CI box) [skip ci] 857083359f

ci: the runner image fetches HOL-Library, prebuilt, instead of building it ... 2580a40e1d

The server cannot build it (5.3 GiB from scratch; capped, still 2.6-3.3
GiB against ~2.3 GiB free). The heap built here by the same Isabelle2025-2
is a generic package in this repository's registry (45 MB, SHA-256
bb247846...e999cb339e); the Dockerfile fetches it into Isabelle's system
heaps with the checksum pinned, the token a build secret. Portable: a
fresh Isabelle home with only this heap checks StarForth without
rebuilding HOL-Library. FABRIC-3.md XLVII.4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

rajames added 1 commit 2026-11-07 17:17:13 +00:00

ci: one concurrency group for every workflow; a runner-image rebuild blocks the rest ... da020a430d

Captain Bob, 2026-11-07: "I also want that rebuilds block other jobs
always." acceptance, nightly and release shared the group qemu; now
runner-image, build and nightly-docs do too, so a rebuild of the runner
image (on the host's Docker daemon) never overlaps another job, whatever
the runner's capacity (#121). On this server every CI run is then one at a
time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GE3SDvQn5EoxdGufk84zz2

rajames merged commit 4f675c8b75 into master 2026-11-07 17:46:02 +00:00

rajames referenced this pull request 2026-11-07 17:47:23 +00:00

ci: the workflows run in the runner image with HOL-Library #128

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

area/capsules

capsules/ and mkcapsule

area/docs

docs/

area/kernel

kernel/ -- LithosAnanke

area/proofs

proof/ -- Isabelle/HOL

area/v3

v3/ -- the original StarForth VM

area/v4

v4/ and capsules/v4 -- the F18 engine

board/milkv

Milk-V Mars

board/pc

Generic x86-64 PC (SER5)

board/raspi4

Raspberry Pi 4 (not ported)

board/raspi5

Raspberry Pi 5

board/zynq7020

Zynq-7020 (ARMv7 port in progress)

kind

bug

Something is wrong

kind

chore

Housekeeping, repo hygiene

kind

ci

Build, CI, nightly, release

kind

docs

Documentation only

kind

feature

New capability

priority

must

Needed for v4.0.0 (JUSTIFICATION.md 14/16)

priority

nice

Nice to have

priority

should

Needed for the product, not for the tag

status

backlog

Not started

status

blocked

Waiting on something else

status

in-progress

Being worked on

status

needs-acceptance

Done; the QEMU acceptance boots are still to run

status

rejected

Decided against; closed

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

rajames (Robert A. James (Captain Bob))

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rajames/LithosAnanke#127