Repository navigation
Deliver the shared ARM64 Browser VM through normal setup - #307
Merged
Merged
Conversation
Keep the ownership-pipe writer in Runtime and forward its verified reader through Browser launchers. Reuse the update-controller pipe contract for VM, hosted, native and proof helpers, and flush the crosvm guest before VM termination. Verify parent loss for TERM, INT and KILL through the real helper spawn path, Runtime provider shutdown, and guest flush ordering. Targeted Rust, Node, product-data and formatting checks pass. Full control-socket and installed VM journeys require operator proof outside the sandbox.
…nux launches engines
…ocket length limit
Preserve the read-only seed while giving the owned VZ launch disk private write permissions before guest overlays. Recreate partial clone output before the copy fallback. Add a seed mode, inode and write isolation regression.
Retain Engine obligations when its owner is unavailable or its receipt is incomplete. Preserve partial native evidence across control-service reconciliation and restart. Add bound receipt, pending ownership, replacement/reset refusal and partial absence regressions. Validation: control-service settlement smoke, product-data/public-copy checks, Rust format checks and diff check pass. Compiled Rust and installed journey proof remain pending.
Acquire the existing profile sidecar lease before checking Runtime ownership. Retain trusted root/profile directory descriptors, reject linked or replaced profile paths, and keep the lease in the blocking unlink worker through cancellation. Preserve scoped Reset receipts and missing-disk idempotence. Validation: independent Mac/Linux source review, workspace formatting and diff check pass. Writer, link, replacement and cancellation regressions are prepared; compiled and installed proof remain pending.
Keep the single startup result inline and preserve all tested handle transfers. The scoped Clippy expectation documents its bounded use. Validation: independent usage and ownership review; executable source is byte-identical after removing the attribute.
Pass the validated Engine receipt into Runtime terminal retirement so first remote Close can persist exact cleanup proof and safely release its owner. Preserve native cleanup validation, authority checks and replay ordering. Verification: the cached prior signed Carrier case failed in 0.92 seconds; both exact signed Carrier and remote cleanup/replay/late-input tests pass after one targeted compile. Independent receipt and call-site review passed. Whitespace, workspace formatting and product-data checks pass.
Use an atomic sequence and exclusive directory creation so parallel tests cannot adopt or remove another fixture. Add a forced-collision regression that preserves the existing owner.
Verify the exact bytes consumed by tar for each payload before immutable publication. Keep source checks and ownership-aware publication cleanup. Verification: python3 -B scripts/package-browser-vm-image-test.py -v (7 passed); git diff --cached --check; independent producer review passed.
Validate every selected source before publishing helpers, retain owned output identity during cleanup, and require explicit handoff from native producers. Release wrappers use the managed Node component. Verification: python3 -B scripts/browser-host-release-test.py -v (20 passed); git diff --cached --check; independent admission and cleanup reviews passed. Complete role integration remains with #217 and #89.
16 tasks
# Conflicts: # elastos/crates/elastos-server/src/setup.rs
…ole-closure # Conflicts: # elastos/CHANGELOG.md
Contributor
Author
|
Independent development review: PASS for the Linux image layout repair, Browser startup status and Ubuntu Git compatibility. Runtime ownership and recovery remain intact; preparation copy matches Close behavior. |
Contributor
Author
|
The correction batch is published. Both full platform source gates and the two reported image tests pass. |
Contributor
Author
|
Independent development review: VERDICT PASS for the prepared host-helper verification repair. |
This was referenced Oct 10, 2026
This was referenced Oct 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Normal setup can obtain one admitted ARM64 Browser guest and matching helpers for Mac Apple Virtualization and Jetson crosvm/KVM. Both hosts use the same Chromium + Selkies + network-wrapper VM. Runtime owns admission, grants and lifecycle; Engine executes websites; Exit owns authorized website streams; Carrier carries delivery below Runtime authority.
This integrates #295's ownership changes through a normal merge. Linux uses the principal's persistent profile disk, keeps a single-writer lock through the guest writer's lifetime, and requires guest flush/unmount before crosvm stops. Setup checks KVM access and keeps Home usable when Browser preparation needs repair. Node and TURN use admitted helper paths. The installer supplies the explained one-time administrator command for Linux network/KVM access and its removal.
The guest recipe freezes authenticated Debian/security snapshots, exact Chromium payload hashes and a compatible Python dependency closure. Bootstrap requires Debian archive keys and forces signature validation. Release packaging accepts the shared image by CID through the existing bounded Carrier stream, with exact length/SHA-256 checks and the common idle-data deadline. Mac and ARM Linux consume the same admitted image set. The host-native namespace Engine, its privileged CI smoke and obsolete product instructions are retired; Playwright stays test-only.
Browser shows a plain startup status before its scripts run. A fresh Dock route opens the default page after Runtime confirms fresh-start ownership; retained sessions restore their existing display. Preparation and failure messages stay visible with an action, including missing Engine files and unavailable virtualization. The image verifier admits Linux guest kernel aliases and receipt-verified source-home paths separately from the capsule kernel, and cleanup tests check exact owned entries.
Startup tests cover deferred preparation, default-page opening, restored ownership and actionable failures. Chromium renders the status at desktop and phone widths; the existing behavior job uploads both screenshots. The pre-push gate checks all workspaces after complete package removal, preserves strict tests for changed inputs and supports Ubuntu Git.
Refs #217, #288 and #165. #217's acceptance record owns candidate identity, current checks and the image handoff. ARM64 guest production, signed admission, fresh Mac/Jetson journeys, crosvm lock retention after launcher death and profile survival through update remain acceptance work. Hardware, media, soak, manual UX and human gates remain open. OMP owns cross-family review, integration, signing and release publication; Irzhy reviews the integrated ownership part here.