loot
v0.4.24[ key ]
dbf3dbe6…/lootpublic metadata

Changes touching this path

  • Liveness: one loot-core home for live/superseded/divergent/parked + the head partition (#216); CONTEXT.md vocabulary; rides along: cargo-dist release config (dist-workspace.toml, release workflow, 0.1.0 manifests) from the install-prototype session (loot-site map, #206) 3630469b · dbf3dbe6…
  • chore(release): attestations + unified sha256.sum + Linux smoke leg (#258) Prep for cutting the real v0.1.0 release (spec §5-6): - dist-workspace.toml: github-attestations = true (GitHub Artifact Attestations, #221 integrity, verifiable via `gh attestation verify`) + checksum = sha256 (unified sha256.sum on the Release). - release.yml regenerated by cargo-dist 0.32.0: adds attestations/id-token permissions + the actions/attest step; the six target archives, both installers, the unified sha256.sum and dist-manifest.json are unchanged. - smoke-install.yml (standalone, so `dist generate` never clobbers it): on release published it installs via the Linux `curl | sh` one-liner on a clean ubuntu runner and resolves `loot --version`. loot-cli is already 0.1.0. Firing the tag (`loot-first tag v0.1.0`) is a separate, deliberate step. Refs #258. 924bda35 · dbf3dbe6…diff
  • chore(release): drop Windows ARM64 from the v0.1.0 target matrix (#258) The v0.1.0 tag's first release run built five of six triples clean and died on aarch64-pc-windows-msvc, taking host/announce with it — so no Release published. dist 0.32 cross-builds that triple in a Linux container via cargo-xwin, where ring's ARM assembly won't compile: cc-rs hands clang MSVC-style `/imsvc` include flags and clang reads them as positional paths (`no such file or directory: '/imsvc'`), failing before loot.exe exists. That's an upstream cc-rs/xwin interaction, not a loot defect, and working around it in-tree would cost a full CI cycle per attempt. Ship the five proven triples instead of blocking the release on the least critical desktop target. Windows ARM64 is not stranded: dist already maps it onto loot-cli-x86_64-pc-windows-msvc.zip in the ps1 installer, so the one-liner still installs and runs under Windows' x64 emulation — native arm64 is a follow-up. release.yml needs no regeneration: the build matrix is computed at CI time by `dist plan` from this file, not baked into the workflow. Refs #258. af3f5562 · dbf3dbe6…diff
  • Catch up to git main 809ddfe: #260 smoke default, #271 arm64 build, loot diff (#1), ADR 0034 dock retirement (#253) 587684dd · dbf3dbe6…diff
  • Turn off release attestations: unavailable on a private repo, and going public is gated (#652) 52ac7c00 · dbf3dbe6…diff
  • the repo never goes public, so the anonymous download path moves to R2 (#652) #652 recorded a gate: flipping this repo public discloses sealed docs/pitch/zk-host.md through PR #161 surviving refs/pull/161/head, verified live 2026-07-30. Re-swept today across 321 PR head refs (up from 242), two ways -- still exactly one carrier, unchanged. But the gate own remedy needs GitHub Support, is not self-service, and has no date. ADR 0045 stops waiting. The repo stays private permanently, and the anonymous artifact path moves to Cloudflare R2 at dl.millerbyte.com instead. Attestations are out rather than deferred; sha256 is the integrity story by decision. Build: #806 DNS zone move, #807 R2 artifacts, #808 installer retarget and the smoke test back on, #809 the Install page attestation claim. ADR 0037 is superseded in two places and docs/specs/loot-site.md in three, marked in place with dated blocks. The comments that called #652 a temporary gate now say permanent, and CONTEXT.md no longer calls the GitHub mirror public. 9a04ab6f · dbf3dbe6…diff
  • publish-r2: mirror release artifacts to Cloudflare R2 for anonymous download (#807) The repo is private permanently (ADR 0045), so Release assets 404 for an unauthenticated fetch — which is what broke `curl | sh`. This adds the anonymous path that replaces them: every asset the Release publishes is mirrored to dl.millerbyte.com/<tag>/, served from R2 with no credentials. The bucket, its scoped credential and the dl.millerbyte.com custom domain are provisioned by scripts/setup-artifacts.js (scripts @ 736f6e8), and the anonymous fetch is already proven live against that bucket. A *publish* job, not post-announce, and the ordering is load-bearing: publish jobs run after `host` uploads the Release and `announce` waits for them, so R2 is populated before the post-announce smoke test. Listed post-announce instead, #808's `curl | sh` gate would race the very artifacts it fetches. The job body is hand-owned in its own file so `dist generate` cannot clobber it — the same shape as smoke-install.yml (#258). It carries a workflow_dispatch tag input so it can be exercised against an existing release rather than first running during a real one, verifies every mirrored asset anonymously against the Release's own sha256, and warns (not fails) if the edge is not caching. ⚠ dist-workspace.toml also documents that it must be edited with `dist generate`, never `dist init` — init rewrites the config from its own defaults and strips every comment, which today destroyed the #270 native-ARM64-runner rationale and the whole ADR 0045 attestations block before they were restored. 5b710e89 · dbf3dbe6…diff
  • a PR no longer uploads a cache nothing reads, and a daily sweep keeps the artifact budget under its own alarm (#835) 2a1e459e · dbf3dbe6…diff
  • a tag stops firing a workflow that can only fail: the GitHub release pipeline retires, and every live pointer to it says where publishing went (#1025) f9a18c18 · dbf3dbe6…diff
  • the public bucket stops shipping a private repo's source: dist's source-tarball default goes off at the root, the publish path stops naming the archive, and ADR 0060 makes the published set an allowlist so the next asset cannot arrive by default (#1054) fb358f42 · dbf3dbe6…diff
  • the docs gate themselves: a land refuses a link that resolves to nothing, five rotted ADR cross-links are fixed, every amended ADR warns in its status, and the artifact sweep retires with its producer 586e3260 · dbf3dbe6…diff
  • every compiled-in and current-tense loot host moves to loot.build (map #2412, ADR 0099): loot --help names security@loot.build and https://loot.build/trust, ALPHA_PROMISE_URL is https://loot.build/install and the telemetry DEFAULT_ENDPOINT https://loot.build/api/telemetry, so the next release carries them; the site install one-liners, R2_BASE and HOP_BASE (https://dl.loot.build, https://loot.build/dl), the metrics SITE_SCOPE and own-host referrer, the disclosure links on trust, terms, privacy and known-issues, and the install, quickstart and guides pages follow, with the privacy and terms markers moved to 25 September 2026 and re-pinned since readers see the new address; README, CONTEXT.md (the forge door now forge.loot.build), the release checklist, site CI and test fixtures follow, and the two specs carry a note instead of a partial rewrite. the destination census gains build in WEB_TLDS, without which security@loot.build would be invisible to its bare-host clause, and exempts the two shipped lines that tld makes read as hosts (state.build, r.build()) by their exact text; ADR 0074 section 9 says twelve-entry to match. 37 lines still name millerbyte.com outside ADR bodies, evidence, research and scratch, each kept on purpose: dated history, millerbyte.com the site and its @millerbyte/ui tokens, the two noted specs, and relay-era tooling with no successor host, filed as #2438. census red with build dropped from WEB_TLDS, restored; site gate 819 passed and within budget; workspace suite 4559 passed over 142 binaries, 13 ignored (#2418) c5663115 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.