Skip to content

fix(release): clear sanitizer and binary handoff blockers - #344

Merged
localai-bot merged 5 commits into
mainfrom
row/ENG-RELEASE-SANITIZER-BLOCKERS
Aug 11, 2026
Merged

fix(release): clear sanitizer and binary handoff blockers#344
localai-bot merged 5 commits into
mainfrom
row/ENG-RELEASE-SANITIZER-BLOCKERS

Conversation

@localai-bot

Copy link
Copy Markdown
Collaborator

Summary

  • make borrowed BF16/u16 loads unaligned-safe, including Laguna graph staging and direct-upload tests
  • make AsyncLLM stat-logger detach a synchronous lifetime barrier and preserve safe destruction order
  • isolate downloaded release artifacts under release-assets so repository assets cannot contaminate the handoff
  • structurally validate release shell commands, control lists, substitutions, publisher roots, and immutable byte-bound handoff

Closes #321.
Closes #322.

Verification

  • fresh immutable review: PASS at 7ec5094b1d2709f3fb67d56858c960d2d60cef8a
  • python3 -m unittest tests.scripts.test_release_pipeline: 24/24
  • python3 scripts/check-release-workflow.py: PASS
  • normal + ASan/UBSan Laguna odd-offset and AsyncLLM detach regressions: PASS
  • reviewer mutation matrix: 15 executable bypasses rejected, 8 inert forms accepted, 9 publisher-binding attacks rejected
  • scripts/agent-preflight.sh: all gates green

Hosted failure evidence

Repairs the sanitizer failures from run 31440144513 and the aggregate artifact collision observed in dry run 31435201833. After rebase-merge, a new eight-tuple release dry run will verify the final merged SHA before tagging v0.0.2.

mudler added 5 commits August 11, 2026 01:54
Ground the borrowed-mmap alignment failures, AsyncLLM metrics lifetime race, and tracked-assets release handoff collision before implementation.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Codex:GPT-5 [OpenAI]
Use defined arbitrary-address tensor reads, make async metrics detach a quiescence barrier, and isolate generated release assets from the checkout while preserving exact immutable handoffs.

Refs #301, #321, #322.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Codex:GPT-5 [OpenAI]
Route both Laguna embedding paths through byte-addressed staging and bind every release handoff root to its exact job, artifact, and consumer step.

Refs #301, #322.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Codex:GPT-5 [OpenAI]
Bind each named release consumer to one structurally parsed shell command and exact option map so comments, inert strings, duplicate options, and unrelated steps cannot compensate.

Refs #322.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Codex:GPT-5 [OpenAI]
Split executable shell segments and fail closed on active nested execution so direct gh release commands cannot hide behind control operators, groups, pipelines, substitutions, or backticks.

Refs #322.

FOLLOWING_AGENTS_PROTOCOL

Following-Agents-Protocol: true
AI-Assisted: true
Assisted-by: Codex:GPT-5 [OpenAI]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Release handoff collides with tracked checkout assets directory AsyncLLM output thread outlives metrics logger and uses freed PromRegistry

2 participants