forked from heavy-duty/box
58 lines
2.3 KiB
Markdown
58 lines
2.3 KiB
Markdown
|
# box 0.9.0 — release drill
|
||
|
|
|
||
|
|
**WAIVED. No drill was run for this release.**
|
||
|
|
|
||
|
|
Waived by the maintainer (@danmt) on 2026-07-21. This file exists because the
|
||
|
|
gate requires a *record*, not a passing result — so a skip is a line in a diff
|
||
|
|
somebody reviewed, rather than the silence that let 0.7.0, 0.8.0 and every
|
||
|
|
release before them ship unproven.
|
||
|
|
|
||
|
|
## Why
|
||
|
|
|
||
|
|
The drill harness is not in a state to produce a trustworthy run. box has the
|
||
|
|
only real harness in the family (`drill/drill.sh`, ~85 probes), but the
|
||
|
|
procedure around it — standing up the substrate, pinning the release
|
||
|
|
candidates, capturing the result — was undocumented and assembled by hand.
|
||
|
|
rig and cast have no harness at all. A run improvised under those conditions
|
||
|
|
produces numbers nobody should rely on, and `drills/` is worth nothing if it
|
||
|
|
fills with records like that.
|
||
|
|
|
||
|
|
Deferred deliberately, and tracked: #155.
|
||
|
|
|
||
|
|
## What this release therefore does NOT prove
|
||
|
|
|
||
|
|
Stated plainly so it is not rediscovered as a surprise:
|
||
|
|
|
||
|
|
- **The VM trust boundary.** `ci.yml` says it in its own words: *"What
|
||
|
|
container mode canNOT validate is the VM trust boundary itself; that stays a
|
||
|
|
real-hardware ritual."* That is exactly the delta a release drill adds, and
|
||
|
|
it is exactly what is missing here.
|
||
|
|
- **The isolation contract on real hardware** — egress, the sibling drop, DNS
|
||
|
|
enumeration, IPv6 off, inbound drop — as measured by `drill/drill.sh` against
|
||
|
|
real VMs rather than containers.
|
||
|
|
- **The combination users receive.** A released box still resolves `RIG_REF` to
|
||
|
|
`main` (#150), so even a passing drill would have proven a pair that drifts
|
||
|
|
the moment rig's main moves.
|
||
|
|
|
||
|
|
## What CI did prove on this tree
|
||
|
|
|
||
|
|
Not nothing, and worth recording so the gap is precise rather than total:
|
||
|
|
|
||
|
|
| Job | Result |
|
||
|
|
|---|---|
|
||
|
|
| `rehearsal` — multi-user tier on a real Incus | pass |
|
||
|
|
| `scope` | pass |
|
||
|
|
| `reconcile` | pass |
|
||
|
|
| `test/cli.sh` | 653 passed, 0 failed |
|
||
|
|
| `test/release.sh` | 173 passed, 0 failed |
|
||
|
|
| `test/labels-reconcile.sh` | 72 passed, 0 failed |
|
||
|
|
| `shellcheck -x bin/* **/*.sh` | clean |
|
||
|
|
|
||
|
|
The tier's semantics are covered. The boundary is not.
|
||
|
|
|
||
|
|
## The commitment
|
||
|
|
|
||
|
|
The next release carries a real drill record at `drills/<version>.md` — what
|
||
|
|
ran, on what host, the pinned refs and SHAs, the numbers, and what failed. A
|
||
|
|
failed drill is a valid record; another waiver is not. Tracked in #155.
|