diff --git a/quest/m0/ci/README.md b/quest/m0/ci/README.md index 48da9fd104c..ab5f523859b 100644 --- a/quest/m0/ci/README.md +++ b/quest/m0/ci/README.md @@ -180,6 +180,7 @@ The historical samples locate candidates; they are not controlled benchmarks. - [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - hosted Cache uploads `main`'s relay and CLI, and Smoke's nix channel substitutes them - [Record hosted cargo-hakari evidence](/quest/m0/ci/hakari.md) - compare scheduled macOS and Windows cache hits and estimated compiler work saved before and after the workspace-hack - [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the maintainer narrows `publish` to `release` and release tags once no job naming it runs as `main` +- [Release tags push to nix.moq.dev, and Cachix stops taking writes](/quest/m0/ci/cachix-retire.md) - backport `release-nix.yml` and its Just module to `release`, drop `cachix.yml`, prove a tag substitutes from nix.moq.dev, then revoke the Cachix token (the cache stays for old tags) - [Measure the Linux cache effect of native media exclusions](/quest/m0/ci/hakari-followups.md) - scheduled Linux jobs measure cache reuse after unrelated tests stop compiling PipeWire and libclang - [A release merge opens no stale release PR](/quest/m0/ci/release-pr-after-release.md) - `just rs release` publishes before it proposes, so a merged release isn't re-proposed - [Build two queue entries at once if it helps](/quest/m0/ci/queue-concurrency.md) - a measured trial of `maximumEntriesToBuild: 2` against the serial lane's burst latency diff --git a/quest/m0/ci/cachix-retire.md b/quest/m0/ci/cachix-retire.md new file mode 100644 index 00000000000..238a1ee54a5 --- /dev/null +++ b/quest/m0/ci/cachix-retire.md @@ -0,0 +1,71 @@ +# [S] Release tags push to nix.moq.dev, and Cachix stops taking writes + +## Goal + +Tags cut from `release` push their Nix packages to nix.moq.dev through +`release-nix.yml`, and a clean machine substitutes a tagged package from +there. `release` no longer runs `cachix.yml`, and `CACHIX_AUTH_TOKEN` is +deleted. Both nix.moq.dev bucket sizes hold under the CI bucket's 30-day +expiry. + +## Plan + +Decided 2026-11-05 (maintainer, /quest-unblock): ✅ backport now and retire +Cachix after the first `release` tag that proves nix.moq.dev, rather than +waiting for the m2 cut to merge `main` into `release`. Not chosen: retiring it +at the m2 cut with `CACHIX_AUTH_TOKEN` copied into `publish` meanwhile; +retiring it at the m2 cut with the token left at repository scope. This +absorbs [moq-dev/moq#7662](https://github.com/moq-dev/moq/pull/7662)'s m2 +"Release tags substitute from nix.moq.dev" quest, which it had split out +behind the cut; the backport removes its only reason to wait. + +Decided 2026-11-05 (maintainer, /quest-unblock): ✅ revoke the token but keep +the `kixelated` cache read-only. Older tags' flakes list only +`kixelated.cachix.org`, so deleting the cache would make `nix run` on them +build from source. Not chosen: copying the retained release paths to +nix.moq.dev first (old flakes still only name Cachix); deleting the cache and +accepting source builds. + +Today tags run `release`'s copies of the workflows. `release` still has +`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far, +through `moq-relay-v0.17.12` and `moq-cli-v0.14.12` on 2026-11-03, pushed to +Cachix and never reached nix.moq.dev. `cachix.yml` names `publish`, which does +not hold `CACHIX_AUTH_TOKEN`, so it reads the repository copy. That copy is +what [Keep pull-request CI read-only](/quest/m0/ci/read-only-secrets.md) would +otherwise have to move. + +- Backport to `release`, in one PR the maintainer merges (agents never merge + into `release`): `main`'s `release-nix.yml`, the `infra/nix` Just module and + its entry in `infra/justfile` (`release` has neither, so `just infra nix + push` would fail), any local action it uses, the deletion of + `cachix.yml`, and `main`'s `cache.yml` in place of `release`'s, whose + dispatch-only `warm` job still runs `cachix push kixelated` with + `CACHIX_AUTH_TOKEN` and would fail once the token is gone. Match `release`'s own tag patterns (it still cuts `libmoq-v*` + where `main` cuts `moq-c-v*`) and the flake attributes `release` builds; the + `cache-write` Environment must admit those tags. +- On the first `moq-relay-v*` or `moq-cli-v*` tag after the backport, record + its `release-nix.yml` pushes from all three legs, then + `nix run github:moq-dev/moq/#moq-relay --accept-flake-config` + substituting on a clean machine (`#moq` for a CLI tag), such as a fresh + container with only Nix installed. +- Then the maintainer deletes `CACHIX_AUTH_TOKEN` (a repository secret, so + `Maintainer:`), and docs stop naming Cachix as a current cache. + +Public API: none. Wire: none. + +## Waiting + +- Maintainer: record both bucket sizes no earlier than 2026-11-24, a month + after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against + the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a + `wrangler login` to the Cloudflare account, which agents lack. A path + expires 30 days after upload even while CI still reads it, and `nix copy` + re-uploads it on the next merge. Look for Nightly jobs that fell back to + source builds once paths expired (`building '/nix/store/...uniffi-bindgen` + in a job log), and refresh on a schedule or switch to a closure-aware + collector (niks3) if they recur. + +## Related + +- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence +- [Drop main from the publish Environment](/quest/m0/ci/publish-release-only.md) - the other workflow backport to `release` decided in the 2026-11-05 audit diff --git a/quest/m0/ci/mbx-r2-verify.md b/quest/m0/ci/mbx-r2-verify.md index e81792c20a2..9ad7fc95641 100644 --- a/quest/m0/ci/mbx-r2-verify.md +++ b/quest/m0/ci/mbx-r2-verify.md @@ -78,7 +78,10 @@ compilation is "not looked up". [Windows job](https://github.com/moq-dev/moq/actions/runs/42050683248/job/127326015447) of run 42050683248 set up mbx 1.29.2, and its workspace build, against a manifest of 2,604 predictions, reported 846 hits, 224 misses, 168 not looked - up and 1,019 prefetched. Windows inheritance pays. + up and 1,019 prefetched. Its `Cargo.lock` differed from the previous + scheduled run's, so those hits point to an inherited manifest, but the + summary does not name the manifest identity it looked up; record that + identity from a later Windows job before relying on inheritance. - macOS: on 2026-10-28 the build did inherit, prefetching 732 predictions, yet hit only 13, with 1565 compilations not looked up. The install order is not the cause. Find out why the inherited predictions mostly miss, for diff --git a/quest/m0/ci/nix-cache-verify.md b/quest/m0/ci/nix-cache-verify.md index d86532056a9..3f67ea55449 100644 --- a/quest/m0/ci/nix-cache-verify.md +++ b/quest/m0/ci/nix-cache-verify.md @@ -30,10 +30,13 @@ credentials. Decided 2026-11-05 (maintainer, /quest-audit, [moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ keep only this `main` evidence in m0 and move the release-tag proof, Cachix retirement, -and bucket sizes to -[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) -behind the release cut. Not chosen: moving the whole quest to m2; merging -`main` into `release` now. +and bucket sizes to an m2 quest behind the release cut. Not chosen: moving the +whole quest to m2; merging `main` into `release` now. + +Superseded the same day (maintainer, /quest-unblock): the release-tag proof, +Cachix retirement, and bucket sizes moved to +[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md), which +backports `release-nix.yml` to `release` now instead of waiting for the cut. Use the scheduled and push runs; never dispatch Nightly for this evidence. diff --git a/quest/m0/ci/publish-release-only.md b/quest/m0/ci/publish-release-only.md index 250364fd4e2..8995b044b34 100644 --- a/quest/m0/ci/publish-release-only.md +++ b/quest/m0/ci/publish-release-only.md @@ -23,10 +23,10 @@ The same PR dropped Cachix from `main` (decided 2026-11-02): Smoke's nix channel substitutes from `nix.moq.dev` and no longer pushes, so it names no Environment and `CACHIX_AUTH_TOKEN` needs no new home. The alternatives were moving the token into `cache-write`, or deleting Cachix everywhere now with a -`release` backport. `release` keeps its Cachix workflows until the next cut -merges `main` into it, and -[Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) deletes the Cachix -cache and token once a release tag substitutes from `nix.moq.dev`. +`release` backport. Changed 2026-11-05 (maintainer, /quest-unblock): +[Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) backports +`release-nix.yml` and drops `cachix.yml` on `release` now, and deletes +`CACHIX_AUTH_TOKEN` once a release tag substitutes from `nix.moq.dev`. Decided 2026-11-05 (maintainer, /quest-audit): `publish` still admits `main`, so this does not wait for the next cut. @@ -44,8 +44,11 @@ What remains, in order: 1. Open the backport PR against `release` (agent work). 2. Once it merges, the maintainer drops `main` from `publish`'s deployment - policy and removes `DISCORD_WEBHOOK` and `CACHIX_AUTH_TOKEN` from - `publish`. Environment settings need the maintainer's admin access. + policy. Environment settings need the maintainer's admin access. + `publish` holds neither `DISCORD_WEBHOOK` (it lives in `alert`) nor + `CACHIX_AUTH_TOKEN` (a repository secret that + [Release tags push to nix.moq.dev](/quest/m0/ci/cachix-retire.md) revokes), + so there is nothing to remove from it. Decided 2026-11-04 (maintainer, /quest-unblock): ✅ cut the combined patch release on `release` soon, once [moq-dev/moq#7596](https://github.com/moq-dev/moq/pull/7596)'s diff --git a/quest/m0/test-flakes-2/p2p-data-channel.md b/quest/m0/test-flakes-2/p2p-data-channel.md index 7993d1d4c1d..a7d681550aa 100644 --- a/quest/m0/test-flakes-2/p2p-data-channel.md +++ b/quest/m0/test-flakes-2/p2p-data-channel.md @@ -19,8 +19,10 @@ channel error just before: ERROR:third_party/blink/renderer/modules/peerconnection/rtc_data_channel.cc:867] Send failedINVALID_STATE ``` -A send on a data channel that was not open (or already closing) failed, and -the transfer then stalled instead of failing. It timed out once before, in +The log names neither the channel's sender nor its timing against the +stall, so this is a correlation to investigate, not a diagnosis: a send on a +data channel that was not open (or already closing) failed, and the transfer +stalled instead of failing. It timed out once before, in [41668668824](https://github.com/moq-dev/moq/actions/runs/41668668824), and passed locally then. diff --git a/quest/m1/README.md b/quest/m1/README.md index b2a24e9ed28..da9ea166324 100644 --- a/quest/m1/README.md +++ b/quest/m1/README.md @@ -174,8 +174,6 @@ quests that require them. - [TS fidelity and recovery](/quest/m1/ts-reliability/README.md) - both modes have explicit profiles, automated validation, loss tests, and a dedicated guide - [WebGPU on Safari](/quest/m1/webgpu-safari.md) - the WebGPU renderer is verified on Safari 26 for macOS and iOS - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - `rs/moq-e2ee` leaves the workspace and release config now that its final release points to moq-crypto -- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - maintainer action: every published crate gets a trusted publisher for `release-rs.yml` -- [Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked - [Main is no slower than release](/quest/m1/release-perf/README.md) - every benchmark where main is slower than release is fixed or accepted with a reason, checked by a final paired run before the cut - [Calibrate the paired nightly benchmarks](/quest/m1/bench-ci.md) - A/A and deliberately slowed Nightly runs set the paired comparison's threshold, so its regression alerts can be trusted - [moq-json's table/deltas bench measures the same work every iteration](/quest/m1/bench-json-deltas.md) - the `table/deltas/1%` cases stop flipping between snapshot and delta timings, so their trend history is usable diff --git a/quest/m1/audio-jitter-target/native-stretch.md b/quest/m1/audio-jitter-target/native-stretch.md index fc024d27efa..69461a8e24b 100644 --- a/quest/m1/audio-jitter-target/native-stretch.md +++ b/quest/m1/audio-jitter-target/native-stretch.md @@ -88,39 +88,19 @@ nightlies on `main` read 160 to 280 ms. So the ceiling stays as it is, as `test/audio-quality/budgets.json`'s note budgets startup holds as measured, until the seven-nightly calibration below. +Listened 2026-11-05 (maintainer, /quest-unblock): the stretch is inaudible +in all four runs on `kixtop` at `main` `7e621623a8`, two minutes each of +`say` speech from `LICENSE-APACHE` over Opus 128 kb/s, the relay at +`test/audio-quality/relay.toml`, and the shaper's `bursty` profile, seed 7. +The player's metrics confirm the stretch was active: media per render second +was 1.0020 (fast, direct) and 1.0018 (fast, shaped) against a 1.002 +publisher, and 0.9981 and 0.9979 against 0.998; the shaped runs raised the +target delay from 120 to 260 ms. Each direct run stalled once at startup, +none in steady state. This settles the perceptual check; the calibration and +bench waits below remain. + ## Waiting -- Maintainer: listen for the stretch on `kixtop` and record whether it is - audible. Recommend this check before claiming the perceptual goal; - automated amplitude tests cannot decide it. - Run it in `~/work/moq` on `kixtop`, with its speakers or headphones as - the default output, on `main`, where - [moq-dev/moq#7856](https://github.com/moq-dev/moq/pull/7856) landed. The - source is - macOS's `say` voice reading `LICENSE-APACHE`, about ten minutes of - continuous speech, so nothing is downloaded (an archive's speech file - returned 403): - - ```bash - nix develop - mkdir -p .tmp/listen && say -v Samantha -o .tmp/listen/speech.aiff -f LICENSE-APACHE - # Terminal 1: the relay, and a shaper in front of it replaying the audio-quality `bursty` path. - cargo run -p moq-relay -- test/audio-quality/relay.toml & - cargo run -p moq-shaper -- --listen 127.0.0.1:4500 --target 127.0.0.1:4443 --seed 7 --profile bursty - # Terminal 2: publish 2 ms/s fast (accelerate); rerun with -readrate 0.998 for 2 ms/s slow (preemptive expand). - ffmpeg -hide_banner -v error -readrate 1.002 -stream_loop -1 -i .tmp/listen/speech.aiff \ - -ac 2 -c:a libopus -b:a 128k -f mp4 -movflags cmaf+separate_moof+delay_moov+skip_trailer -frag_duration 1000 - | - cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang import fmp4 - # Terminal 3: two minutes direct (drift alone), then two through the shaper (the measured expansions). - cargo run -p moq-cli --features play -- --connect http://127.0.0.1:4443 --broadcast speech.hang \ - play --video off --metrics .tmp/listen/drift.ndjson - cargo run -p moq-cli --features play -- --connect https://127.0.0.1:4500 \ - --connect-tls-fingerprint "$(curl -s http://127.0.0.1:4443/certificate.sha256)" \ - --broadcast speech.hang play --video off --metrics .tmp/listen/bursty.ndjson - ``` - - Record, for each of the four runs (fast/slow × direct/shaped), whether the - stretching is audible, and attach the `.ndjson` files. - moq-dev/moq: collect seven scheduled native nightly rows for this implementation, then apply the existing calibration rule. Keep the current provisional budgets until those artifacts exist. diff --git a/quest/m1/bench-publish.md b/quest/m1/bench-publish.md index 97026b1709d..8bd6259e384 100644 --- a/quest/m1/bench-publish.md +++ b/quest/m1/bench-publish.md @@ -50,9 +50,9 @@ crate, like CONTRIBUTING's bench-only backport. Otherwise skip it, say so in the PR, and moq-bench publishes at the cut. The first publish goes out by token, so add moq-bench to the -[crates.io trusted publisher](/quest/m1/crates-trusted-publisher.md) +[crates.io trusted publisher](/quest/m2/crates-trusted-publisher.md) `Waiting` list (done in this planning PR). ## Related -- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish +- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - moq-bench needs a trusted publisher after its first publish diff --git a/quest/m1/cluster-routing/routes/README.md b/quest/m1/cluster-routing/routes/README.md index 72a12885f5e..c3369242f93 100644 --- a/quest/m1/cluster-routing/routes/README.md +++ b/quest/m1/cluster-routing/routes/README.md @@ -158,7 +158,9 @@ the bullets below are the contract it carries. losing one of two uplinks under one key (`scoped_delivery_through_two_uplinks_reaches_one_key`). - Decided 2026-11-04 (maintainer): a scoped peer's routing identities are - keyed by the route key the peer proves, from a shared key file + keyed by the route key the peer proves, so relays configured with the same + key file fail over as one; a scoped peer that proves no key, such as one on + qmux, gets a per-session key ([session integration](/quest/m1/cluster-routing/routes/session.md), [Scoped peers prove a route key](/quest/m1/cluster-routing/routes/proof.md)). The router takes the key from the caller (`Scope::qualify`). diff --git a/quest/m1/moq-e2ee-remove.md b/quest/m1/moq-e2ee-remove.md index e56d075fdff..1a8a05ceba0 100644 --- a/quest/m1/moq-e2ee-remove.md +++ b/quest/m1/moq-e2ee-remove.md @@ -4,15 +4,23 @@ `rs/moq-e2ee` leaves the workspace, along with any release or version config that names it, so release-plz stops tracking a crate whose final release is -out. moq-e2ee 0.0.21, the final no-code release pointing users to moq-crypto, -is on crates.io (published 2026-11-03). +out. moq-e2ee 0.0.22, the final no-code release pointing users to +moq-crypto, is on crates.io. ## Plan Decided 2026-11-05 (maintainer, /quest-audit): ✅ retire the stub before -[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md), so the +[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md), so the crate never needs a trusted publisher. +Published 2026-11-05 (maintainer, /quest-unblock, by an agent at the +maintainer's request): moq-e2ee 0.0.22 from `main`'s stub, with only the +version raised from 0.0.11 locally, since 0.0.21 on crates.io (2026-11-03) and +on `release` is still the full implementation. A 0.0.x caret requirement never +resolves to the next patch, so no dependent upgrades into the stub +unasked. Not chosen: publishing it through the m2 cut; deleting the crate +with no final release. + - Delete `rs/moq-e2ee` (the workspace's `rs/*` glob picks it up) and its `Cargo.lock` entry. - Search release-plz, `version.json`, workflows, and docs for `moq-e2ee` and diff --git a/quest/m2/README.md b/quest/m2/README.md index a66a330cb67..764a707aea7 100644 --- a/quest/m2/README.md +++ b/quest/m2/README.md @@ -35,9 +35,10 @@ lite-07; bitrate enforcement is not part of this release. - [JS announced coalescing](/quest/m2/js-announced-coalesce.md) - `@moq/net`'s `Announced` keeps one pending event per path, like Rust - [An audio track's final flush joins its open group](/quest/m2/audio-flush-group.md) - a zero-`delay.max` subscriber gets the tail, not `Old` - [Release execution](/quest/m2/release/README.md) - publication, installed-artifact proof, cleanup, and downstream adoption after m1 -- [Release tags substitute from nix.moq.dev](/quest/m2/release-nix-cache.md) - the first tag after the cut substitutes on a clean machine, bucket sizes hold, and Cachix is retired - [Release pull requests read the R2 Rust cache](/quest/m2/mbx-r2-release-cache.md) - a release PR's `Check the cache` step reports effective read-only once the cut brings the cache to `release` - [Binary release publishers run on their tag](/quest/m2/release-tag-publishers.md) - brew, Go and Swift releases stop running through `workflow_run` on main, once the cut brings the workflows to `release` +- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - maintainer action: the crates the cut first-publishes by token get a trusted publisher for `release-rs.yml` +- [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) - release-plz publishes with trusted publishing and `CARGO_REGISTRY_TOKEN` is revoked - [One policy for oversized container metadata](/quest/m2/import-metadata-policy.md) - fMP4 and MKV refuse or stream huge metadata by one documented rule - [Wire fuzz coverage](/quest/m2/wire-fuzz-coverage.md) - the cmsg walks in moq-sock and moq-uring have invariant fuzz targets, and the unsafe peer input reaches runs under Miri - [VA-API renderer tests](/quest/m2/vaapi-render-tests.md) - the VA-API renderer, decode, and transcode tests run in `just rs gpu` on AMD and Intel and fail instead of skipping, and hosted CI reports them ignored diff --git a/quest/m1/crates-trusted-publisher.md b/quest/m2/crates-trusted-publisher.md similarity index 77% rename from quest/m1/crates-trusted-publisher.md rename to quest/m2/crates-trusted-publisher.md index 7c5828c6168..23d1e883246 100644 --- a/quest/m1/crates-trusted-publisher.md +++ b/quest/m2/crates-trusted-publisher.md @@ -4,12 +4,12 @@ Every crate that `release-rs.yml` publishes has a crates.io trusted publisher for `moq-dev/moq`, workflow `release-rs.yml`, and environment `publish`, so -[Rust releases publish through OIDC](/quest/m1/release-rs-oidc.md) can start. +[Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) can start. Delete this quest once every crate has one. ## Waiting -- Maintainer: after the next `main` to `release` cut publishes kio-macros, moq-c, +- Maintainer: after [the cut](/quest/m2/release/cut.md) publishes kio-macros, moq-c, moq-congestion, moq-crypto, moq-ice, moq-quic, and moq-rtsp by token (and moq-bench, whenever [its first publish](/quest/m1/bench-publish.md) lands), add their trusted publishers the same way. Settings pages need a crates.io @@ -17,6 +17,14 @@ Delete this quest once every crate has one. ## Plan +Decided 2026-11-05 (maintainer left the choice to the agent, /quest-unblock): +✅ move this quest and [Rust releases publish through OIDC](/quest/m2/release-rs-oidc.md) +to m2 behind [the cut](/quest/m2/release/cut.md). The seven crates the cut +first-publishes by token cannot get a trusted publisher before it, and the cut +runs after m1, so neither quest could finish inside m1. Not chosen: keeping +both in m1 and treating the cut as part of finishing m1. + + Moved from m2 to m1 on 2026-10-29 (maintainer): after [moq-dev/moq#7166](https://github.com/moq-dev/moq/pull/7166) moved publish secrets into the `publish` Environment, `CARGO_REGISTRY_TOKEN` is the @@ -48,3 +56,7 @@ Decided 2026-11-05 (maintainer, /quest-audit): moq-e2ee, published but retired in favor of moq-crypto, gets no trusted publisher; [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) takes it out of the workspace instead. + +## Required + +- [Cut the release](/quest/m2/release/cut.md) - the cut first-publishes the seven crates by token diff --git a/quest/m2/release-nix-cache.md b/quest/m2/release-nix-cache.md deleted file mode 100644 index cd0cca0cc3c..00000000000 --- a/quest/m2/release-nix-cache.md +++ /dev/null @@ -1,59 +0,0 @@ -# [S] Release tags substitute from nix.moq.dev - -## Goal - -The first release tag cut from `main` substitutes from `nix.moq.dev` on a -clean machine, both bucket sizes hold under the CI bucket's 30-day expiry, and -Cachix is retired. - -## Plan - -Decided 2026-11-05 (maintainer, /quest-audit, -[moq-dev/moq#7975](https://github.com/moq-dev/moq/pull/7975)): ✅ split from -[Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) and moved to -m2 behind [the cut](/quest/m2/release/cut.md), which brings `main`'s -`release-nix.yml` to `release` when it merges `main` into it. Not chosen: -moving the whole verification quest; merging `main` into `release` now, -which reverses the 2026-11-04 decision. - -Tags run `release`'s copies of the workflows. `release` still has -`cachix.yml` and `cache.yml` and no `release-nix.yml`, so every tag so far, -through `moq-relay-v0.17.9` and `moq-cli-v0.14.9` on 2026-10-28, pushed to -Cachix and never reached `nix.moq.dev`; -`gh run list --workflow release-nix.yml` stays empty until the cut. - -Once the cut lands: - -1. Record the first `moq-relay-v*` or `moq-cli-v*` tag's `release-nix.yml` - pushes from all three legs. -2. Record `nix run github:moq-dev/moq/#moq-relay --accept-flake-config` - substituting on a clean machine (`#moq` for a CLI tag), such as a fresh - container with only Nix installed. -3. Retire Cachix (decided 2026-10-29): that tag is the first release a - downstream user could fetch from `nix.moq.dev`. The cut also brings - `main`'s removal of `cachix.yml` to `release`. - -Public API: none. Wire: none. - -## Waiting - -- Maintainer: Record both bucket sizes no earlier than 2026-11-24, a month - after the first `cache.yml` push to `nix-ci-moq-dev` on 2026-10-24, against - the 30-day expiry in `infra/nix/lifecycle.json`. Sizes need a - `wrangler login` to the Cloudflare account, which agents lack. A path - expires 30 days after upload even while CI still reads it, and `nix copy` - re-uploads it on the next merge. Look for Nightly jobs that fell back to - source builds once paths expired (`building '/nix/store/...uniffi-bindgen` - in a job log), and refresh on a schedule or switch to a closure-aware - collector (niks3) if they recur. -- Maintainer: After step 2, delete the `CACHIX_AUTH_TOKEN` secret and the - `kixelated` Cachix cache; the Cachix account is the maintainer's, and - deleting the cache is irreversible. - -## Required - -- [Cut and publish the prepared breaking release](/quest/m2/release/cut.md) - brings `release-nix.yml` to `release`, where tags run it - -## Related - -- [Verify the Nix runtime cache](/quest/m0/ci/nix-cache-verify.md) - the same cache's `main` evidence diff --git a/quest/m1/release-rs-oidc.md b/quest/m2/release-rs-oidc.md similarity index 86% rename from quest/m1/release-rs-oidc.md rename to quest/m2/release-rs-oidc.md index 8992e5456a2..ac0b7ec9551 100644 --- a/quest/m1/release-rs-oidc.md +++ b/quest/m2/release-rs-oidc.md @@ -8,6 +8,11 @@ secret is removed and revoked. ## Plan +Moved to m2 on 2026-11-05 (/quest-unblock), with +[crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md), which +waits on the cut's first publishes. + + Moved from m2 to m1 on 2026-10-29 (maintainer): after [moq-dev/moq#7166](https://github.com/moq-dev/moq/pull/7166) moved publish secrets into the `publish` Environment, `CARGO_REGISTRY_TOKEN` is the @@ -30,4 +35,4 @@ authentication Action is needed. ## Required - [Remove the moq-e2ee stub](/quest/m1/moq-e2ee-remove.md) - release-plz stops tracking a retired crate that has no trusted publisher -- [crates.io trusts the workflow](/quest/m1/crates-trusted-publisher.md) - every published crate has the trusted publisher configured +- [crates.io trusts the workflow](/quest/m2/crates-trusted-publisher.md) - every published crate has the trusted publisher configured