ci: forward roll durable state on the core lane, without packaging

Durable-state decoders read what an already-installed build wrote, and nothing
in the core lane exercised them that way — retiring a persisted operation grant
stayed green while workspaces holding an older credential could no longer
start. The released State Root qualification is the check that would have
caught it, but it only ran behind CLI packaging, for changes to that packaging.

Select it from the test planner instead, on the decoders themselves, and run it
in the core job against the workspace already built there. A measured run of
the packaged lane put the qualification at ~1m16s behind ~9m22s of Rust addon
and tarball builds; none of that packaging changes whether the compiled
decoders can read released state, so the core lane skips it and keeps only the
part that proves something.

The source stays an exact published Nightly, resolved and integrity-checked the
same way the release lane does: what must be real is the state being read, not
the build reading it. Reports from a workspace target say so rather than
carrying a tarball digest, so this run is never mistaken for evidence about a
release. The release lanes are untouched and still qualify exact published
tarballs end to end.

The planner matches sqlite-*-schema.ts by shape: a new schema file is exactly
the kind of change that must select this lane on the commit introducing it.

Generated-by: Claude Code (Opus 5)

Author: Astro-Han

.github/workflows/ci.yml

@@ -127,13 +127,13 @@ jobs:
           restore-keys: electron-${{ runner.os }}-
 
       - name: Install Linux runtime dependencies
-        if: steps.plan.outputs.runtime_sandbox == 'true'
+        if: steps.plan.outputs.runtime_sandbox == 'true' || steps.plan.outputs.state_root_compat == 'true'
         run: sudo apt-get update && sudo apt-get install -y ripgrep bubblewrap
 
       # Ubuntu 24.04 hosted runners gate unprivileged user namespaces through
       # AppArmor, which otherwise makes bwrap fail while configuring loopback.
       - name: Enable bubblewrap user namespaces
-        if: steps.plan.outputs.runtime_sandbox == 'true'
+        if: steps.plan.outputs.runtime_sandbox == 'true' || steps.plan.outputs.state_root_compat == 'true'
         run: |
           if [[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]]; then
             sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
@@ -251,6 +251,51 @@ jobs:
         if: steps.plan.outputs.runtime_host == 'true'
         run: npm --workspace @maka/runtime-host run test:dist
 
+      # A durable-state decoder reads what an already-installed build wrote,
+      # with no peer present to negotiate a version, so nothing but a real
+      # forward roll exercises it the way a user's upgrade does. The published
+      # Nightly supplies the state; the workspace built above opens it. Release
+      # packaging is deliberately not in front of this: it takes minutes, and
+      # none of it changes whether the compiled decoders can read that state.
+      # The release lanes still qualify exact published tarballs (#4427).
+      - id: forward-roll-baseline
+        name: Resolve the published forward-roll baseline
+        if: steps.plan.outputs.state_root_compat == 'true'
+        run: node scripts/release-cli-publication.mjs resolve-nightly-predecessor "$GITHUB_OUTPUT"
+
+      - name: Download the forward-roll baseline
+        if: steps.plan.outputs.state_root_compat == 'true'
+        env:
+          SOURCE_URL: ${{ steps.forward-roll-baseline.outputs.tarball_url }}
+          SOURCE_INTEGRITY: ${{ steps.forward-roll-baseline.outputs.integrity }}
+        run: |
+          set -euo pipefail
+          source_path="$RUNNER_TEMP/forward-roll-source.tgz"
+          curl --fail --location --max-filesize 67108864 --proto '=https' --tlsv1.2 "$SOURCE_URL" --output "$source_path"
+          node - "$source_path" "$SOURCE_INTEGRITY" <<'NODE'
+          const { createHash } = require('node:crypto');
+          const { readFileSync } = require('node:fs');
+          const bytes = readFileSync(process.argv[2]);
+          const actual = `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+          if (actual !== process.argv[3]) throw new Error('Forward-roll baseline integrity mismatch');
+          NODE
+          {
+            echo "FORWARD_ROLL_SOURCE=$source_path"
+            echo "FORWARD_ROLL_SOURCE_SHA256=$(sha256sum "$source_path" | cut -d ' ' -f 1)"
+          } >> "$GITHUB_ENV"
+
+      - name: Qualify durable state against the published baseline
+        if: steps.plan.outputs.state_root_compat == 'true'
+        env:
+          MAKA_QUALIFICATION_BWRAP_USE_SUDO: '1'
+        run: |
+          set -o pipefail
+          npm run --silent release:cli:qualify-state-root -- \
+            --source "$FORWARD_ROLL_SOURCE" \
+            --source-sha256 "$FORWARD_ROLL_SOURCE_SHA256" \
+            --target-workspace "$PWD" \
+            | tee "$RUNNER_TEMP/durable-state-report.json"
+
       - name: Ensure xvfb
         if: steps.plan.outputs.e2e == 'true'
         run: command -v xvfb-run >/dev/null 2>&1 || { sudo apt-get update && sudo apt-get install -y xvfb; }

scripts/ci-test-plan.mjs

@@ -75,6 +75,20 @@ const RELEASE_CONTRACT_FILES = new Set([
   'scripts/windows-package-source-closure.test.mjs',
 ]);
 
+// Decoders whose input is durable state an already-installed build wrote. No
+// peer is present to negotiate a version there, so the only check that
+// exercises them the way a user's upgrade does is a real forward roll from a
+// published release onto this tree.
+const DURABLE_STATE_DECODER_FILES = new Set([
+  'packages/runtime-host/src/server/access-authority.ts',
+  'packages/runtime-host/src/server/access-credential-store.ts',
+  'packages/storage/src/operational-state-store.ts',
+  'packages/storage/src/root-authority.ts',
+  'packages/storage/src/state-root-composition.ts',
+  'scripts/qualify-released-cli-state-root.mjs',
+  'scripts/released-cli-state-root-fixture.mjs',
+]);
+
 const TYPECHECK_ONLY_FILES = new Set([
   'biome.jsonc',
   'components.json',
@@ -350,6 +364,7 @@ export function planTests(changedFiles, options = {}) {
       full: true,
       releaseContract: true,
       runtimeSandbox: graph.dirs.includes('packages/cli'),
+      stateRootCompat: true,
       // A complete functional suite is still the default release/main gate.
       // Stress multipliers and native child-process lock probes run only when
       // their owning storage seam changes; making --full imply stress turned
@@ -421,6 +436,14 @@ export function planTests(changedFiles, options = {}) {
     // the cli workspace runs in the dependency closure, not only for direct
     // cli/runtime edits (e.g. a storage-only change still selects cli via runtime).
     runtimeSandbox: workspaces.includes('packages/cli'),
+    // The SQLite schemas are matched by shape rather than named one by one:
+    // a new sqlite-*-schema.ts is exactly the kind of file that must select
+    // this lane on the commit that introduces it.
+    stateRootCompat: files.some(
+      (path) =>
+        DURABLE_STATE_DECODER_FILES.has(path) ||
+        /^packages\/storage\/src\/sqlite-[^/]*schema[^/]*\.ts$/u.test(path),
+    ),
     storageStress,
     // Storybook build + smoke: catalog/harness only. Not every desktop/ui/core
     // PR — product ship gates are typecheck, unit, and Electron e2e. See
@@ -441,6 +464,7 @@ export function formatGitHubOutputs(plan) {
     `runtime_host=${plan.runtimeHost}`,
     `runtime_sandbox=${plan.runtimeSandbox}`,
     `release_contract=${plan.releaseContract}`,
+    `state_root_compat=${plan.stateRootCompat}`,
     `storage_stress=${plan.storageStress}`,
     `storybook=${plan.storybook}`,
     `standard_workspaces=${plan.standardWorkspaces.join(',')}`,

scripts/ci-test-plan.test.mjs

@@ -820,3 +820,32 @@ function checkoutSteps(name) {
     []
   );
 }
+
+test('durable-state decoders select the published forward roll', () => {
+  // Each of these reads state an already-installed build wrote. Losing this
+  // selection is silent: the lane stops running and every check stays green,
+  // which is how a retired operation grant reached users.
+  for (const path of [
+    'packages/runtime-host/src/server/access-credential-store.ts',
+    'packages/runtime-host/src/server/access-authority.ts',
+    'packages/storage/src/root-authority.ts',
+    'packages/storage/src/operational-state-store.ts',
+    'packages/storage/src/state-root-composition.ts',
+    'packages/storage/src/sqlite-workflow-schema.ts',
+    'packages/storage/src/sqlite-session-metadata-schema.ts',
+    'scripts/qualify-released-cli-state-root.mjs',
+    'scripts/released-cli-state-root-fixture.mjs',
+  ]) {
+    assert.equal(planTests([path], { graph }).stateRootCompat, true, path);
+  }
+});
+
+test('ordinary changes do not pay for the published forward roll', () => {
+  for (const path of [
+    'docs/ci.md',
+    'apps/desktop/src/renderer/app.tsx',
+    'packages/storage/src/session-store.ts',
+  ]) {
+    assert.equal(planTests([path], { graph }).stateRootCompat, false, path);
+  }
+});

scripts/qualify-released-cli-state-root.mjs

@@ -51,6 +51,7 @@ export function parseQualificationArgs(argv) {
     '--target',
     '--source-sha256',
     '--target-sha256',
+    '--target-workspace',
     '--expect-epoch-relation',
   ]);
   const values = new Map();
@@ -65,13 +66,29 @@ export function parseQualificationArgs(argv) {
     values.set(name, value);
   }
   const source = requireAbsolutePath(values, '--source');
-  const target = requireAbsolutePath(values, '--target');
   const sourceSha256 = requireSha256(values, '--source-sha256');
-  const targetSha256 = requireSha256(values, '--target-sha256');
   const expectedEpochRelation = values.get('--expect-epoch-relation') ?? 'any';
   if (!['same', 'different', 'any'].includes(expectedEpochRelation)) {
     throw new Error('Expected epoch relation must be same, different, or any');
   }
+  // A pull request qualifies the built workspace rather than a packaged
+  // artifact: what decides whether durable state still opens is the compiled
+  // storage and Runtime Host code, and packaging only moves it. The release
+  // lanes keep naming an exact tarball, which is why identity stays required
+  // there rather than optional everywhere.
+  if (values.has('--target-workspace')) {
+    if (values.has('--target') || values.has('--target-sha256')) {
+      throw new Error('A workspace target cannot also name a tarball target');
+    }
+    return {
+      source,
+      sourceSha256,
+      targetWorkspace: requireAbsolutePath(values, '--target-workspace'),
+      expectedEpochRelation,
+    };
+  }
+  const target = requireAbsolutePath(values, '--target');
+  const targetSha256 = requireSha256(values, '--target-sha256');
   return { source, target, sourceSha256, targetSha256, expectedEpochRelation };
 }
 
@@ -135,7 +152,9 @@ export async function qualifyReleasedCliStateRoot(input) {
     assertCommandAvailable('/usr/bin/setpriv');
   }
   assertTarballDigest(input.source, input.sourceSha256, 'source');
-  assertTarballDigest(input.target, input.targetSha256, 'target');
+  if (!input.targetWorkspace) {
+    assertTarballDigest(input.target, input.targetSha256, 'target');
+  }
   const scope = mkdtempSync(join(tmpdir(), 'maka-released-state-root-'));
   try {
     const sandbox = prepareSandbox(scope);
@@ -145,12 +164,14 @@ export async function qualifyReleasedCliStateRoot(input) {
       scope,
       sandbox,
     });
-    const target = installArtifact({
-      role: 'target',
-      tarball: input.target,
-      scope,
-      sandbox,
-    });
+    const target = input.targetWorkspace
+      ? workspaceArtifact({ repoRoot: input.targetWorkspace, scope, sandbox })
+      : installArtifact({
+          role: 'target',
+          tarball: input.target,
+          scope,
+          sandbox,
+        });
     const epochRelation = assertExpectedEpochRelation(
       source.compatibilityEpoch,
       target.compatibilityEpoch,
@@ -353,6 +374,42 @@ function installArtifact({ role, tarball, scope, sandbox }) {
   return { role, prefix, packageRoot, cliPath, version, compatibilityEpoch: Number(epoch) };
 }
 
+// The workspace already carries the compiled packages the fixture loads: npm
+// workspaces link node_modules/@maka/* at the repository root, which is the
+// same shape an installed tarball presents. Nothing is installed, so the
+// packaging chain in front of this check is skipped entirely.
+function workspaceArtifact({ repoRoot, scope, sandbox }) {
+  const cliPath = join(repoRoot, 'packages/cli/dist/cli.js');
+  const protocolPath = join(repoRoot, 'node_modules/@maka/runtime-host/dist/protocol/index.js');
+  for (const required of [cliPath, protocolPath]) {
+    if (!existsSync(required)) {
+      throw new Error(`The workspace target is not built: ${required} is missing`);
+    }
+  }
+  const epoch = readFileSync(protocolPath, 'utf8').match(
+    /RUNTIME_HOST_COMPATIBILITY_EPOCH\s*=\s*(\d+)/u,
+  )?.[1];
+  if (!epoch) throw new Error('The workspace target has no compatibility epoch');
+  const versionResult = spawnSync(process.execPath, [cliPath, '--version'], {
+    cwd: scope,
+    env: sandbox.environment,
+    encoding: 'utf8',
+    maxBuffer: MAX_OUTPUT_BYTES,
+    timeout: PROCESS_TIMEOUT_MS,
+  });
+  if (versionResult.status !== 0) {
+    throw new Error(`The workspace CLI version check failed: ${versionResult.stderr}`);
+  }
+  return {
+    role: 'target',
+    kind: 'workspace',
+    packageRoot: repoRoot,
+    cliPath,
+    version: versionResult.stdout.trim(),
+    compatibilityEpoch: Number(epoch),
+  };
+}
+
 export function qualificationSandboxArgs({ innerInputPath, sandbox, scope }) {
   return [
     '--die-with-parent',
@@ -589,6 +646,16 @@ function restoreGolden(locations) {
 }
 
 function artifactEvidence(artifact, sha256) {
+  // A workspace target has no published identity to pin, and saying so keeps
+  // this report from reading as evidence about a release it never touched.
+  if (artifact.kind === 'workspace') {
+    return {
+      version: artifact.version,
+      compatibilityEpoch: artifact.compatibilityEpoch,
+      kind: 'workspace',
+      sha256: 'not_applicable',
+    };
+  }
   return {
     version: artifact.version,
     compatibilityEpoch: artifact.compatibilityEpoch,

scripts/qualify-released-cli-state-root.test.mjs

@@ -209,3 +209,39 @@ test('durable state covers the control namespace, not only the State Root', () =
     assert.ok(!golden.startsWith(`${live}/`), 'a golden copy must not nest inside its live path');
   }
 });
+
+test('a workspace target replaces tarball identity instead of weakening it', () => {
+  const source = resolve(tmpdir(), 'source.tgz');
+  const repo = resolve(tmpdir(), 'checkout');
+  assert.deepEqual(
+    parseQualificationArgs([
+      '--source',
+      source,
+      '--source-sha256',
+      SHA_A,
+      '--target-workspace',
+      repo,
+    ]),
+    { source, sourceSha256: SHA_A, targetWorkspace: repo, expectedEpochRelation: 'any' },
+  );
+  // The source stays an exact published artifact either way: the point of the
+  // run is that state written by a real release still opens.
+  assert.throws(
+    () => parseQualificationArgs(['--target-workspace', repo]),
+    /--source must be an absolute path/u,
+  );
+  assert.throws(
+    () =>
+      parseQualificationArgs([
+        '--source',
+        source,
+        '--source-sha256',
+        SHA_A,
+        '--target-workspace',
+        repo,
+        '--target-sha256',
+        SHA_B,
+      ]),
+    /cannot also name a tarball target/u,
+  );
+});