sync: upstream main 2026-10-11b (105 commits → v1.4.224 line)

.gitattributes

@@ -19,7 +19,6 @@
 # .version, which names the immutable remote install dir. A CRLF checkout makes a
 # Windows-built client disagree with a mac/Linux-built one on the same release,
 # so one host ends up with two relay trees (#17886 review).
-/config/relay-assets/** text eol=lf
 # Pin the bytes so a patch reads and diffs identically on every host. It is NOT
 # what makes the hash right: pnpm hashes a patch LF-normalized, so a CRLF checkout
 # cannot change it. Believing otherwise put a hand-computed raw digest in the

.github/actions/prepare-windows-cli-launcher/action.yml

@@ -0,0 +1,39 @@
+name: Prepare the orcad Windows CLI launcher
+description: Compiles native/windows-cli-launcher for each requested arch into .build/windows-cli-launcher/<arch>/orca.exe.
+
+inputs:
+  arches:
+    description: Space-separated Windows architectures (x64, arm64).
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Cache the Windows CLI launcher builds
+      if: runner.os == 'Windows'
+      uses: actions/cache@v5
+      with:
+        path: |
+          .build/windows-cli-launcher
+          native/windows-cli-launcher/target
+          ~/.cargo/registry
+        key: orcad-windows-cli-launcher-${{ runner.arch }}-${{ inputs.arches }}-${{ hashFiles('native/windows-cli-launcher/**', 'config/scripts/build-windows-cli-launcher.mjs', 'resources/build/icon.ico', 'package.json') }}
+
+    # Why explicit: a runner image without cargo would otherwise fail inside the orcad build.
+    - name: Build the launcher for each architecture
+      if: runner.os == 'Windows'
+      shell: pwsh
+      env:
+        ARCHES: ${{ inputs.arches }}
+      run: |
+        if (-not (Get-Command cargo -ErrorAction SilentlyContinue)) {
+          rustup toolchain install stable --profile minimal
+          rustup default stable
+        }
+        $triples = @{ x64 = 'x86_64-pc-windows-msvc'; arm64 = 'aarch64-pc-windows-msvc' }
+        foreach ($arch in ($env:ARCHES -split ' ' | Where-Object { $_ })) {
+          rustup target add $triples[$arch]
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          node config/scripts/build-windows-cli-launcher.mjs --arch $arch --output ".build/windows-cli-launcher/$arch/orca.exe"
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        }

.github/workflows/ci-cache-warmup.yml

@@ -24,7 +24,6 @@ on:
       - 'pnpm-workspace.yaml'
       - '.npmrc'
       - '.pnpmfile.cjs'
-      - 'config/tsconfig*.json'
       - 'config/scripts/ensure-native-runtime.mjs'
       - 'config/scripts/rebuild-native-deps.mjs'
       - 'config/scripts/node-pty-job-ownership.cjs'
@@ -86,19 +85,6 @@ jobs:
 
       - uses: ./.github/actions/prepare-git-compatibility
 
-      - name: Cache TypeScript incremental state
-        id: typecheck-cache
-        uses: actions/cache@v5
-        with:
-          path: config/*.tsbuildinfo
-          key: tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-${{ github.sha }}
-          restore-keys: |
-            tsbuildinfo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', 'config/tsconfig*.json') }}-
-
-      - name: Refresh TypeScript state for this commit
-        if: steps.typecheck-cache.outputs.cache-hit != 'true'
-        run: pnpm run typecheck
-
   warm-linux-arm:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10

.github/workflows/cloud-bootstrap-relay-staging-capacity.yml

@@ -544,7 +544,6 @@ jobs:
               --capacity-service-account "${CAPACITY_SERVICE_ACCOUNT}" \
               --capacity-cell-id "${cell_id}" \
               --director-cells-json "${desired_cells_json}" \
-              --min-instances 0 \
               --prune-revisions true \
               --release-id "bootstrap-${cell_id}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}")"
             echo "${director_result}"

.github/workflows/cloud-deploy-relay-production-director.yml

@@ -18,6 +18,17 @@ on:
         required: true
         default: preserve
         type: string
+      reserve-placement:
+        description: Preserve step-5 reserve placement, or set it; turning it off is refused while any cell is reserve
+        required: true
+        default: preserve
+        type: choice
+        options: [preserve, 'off', dry-run, 'on']
+      shadow-seat-feed-cells:
+        description: Preserve the step-3 shadow seat-feed cells, or set all or a comma list of cell ids; dropping a reserve cell is refused
+        required: true
+        default: preserve
+        type: string
       prune-incompatible-revisions:
         description: Retain only the newly verified serving and rollback revisions
         required: true
@@ -68,6 +79,8 @@ jobs:
       IMAGE_DIGEST: ${{ inputs.image-digest }}
       REGIONAL_PLACEMENT_MODE: ${{ inputs.regional-placement-mode }}
       REGION_CORRECTION_COHORT_PERCENT: ${{ inputs.region-correction-cohort-percent }}
+      RESERVE_PLACEMENT: ${{ inputs.reserve-placement }}
+      SHADOW_SEAT_FEED_CELLS: ${{ inputs.shadow-seat-feed-cells }}
       PRUNE_INCOMPATIBLE_REVISIONS: ${{ inputs.prune-incompatible-revisions }}
       # Floor the served revision must keep, matching relay_min_instances in
       # environments/production.tfvars. This gate only fails a bad deploy; Terraform
@@ -228,7 +241,9 @@ jobs:
             --prune-revisions "${PRUNE_INCOMPATIBLE_REVISIONS}" \
             --release-id "${RELEASE_ID}" \
             --regional-placement-secret-version "${target_version}" \
-            --region-correction-cohort-percent "${REGION_CORRECTION_COHORT_PERCENT}"
+            --region-correction-cohort-percent "${REGION_CORRECTION_COHORT_PERCENT}" \
+            --reserve-placement "${RESERVE_PLACEMENT}" \
+            --shadow-seat-feed-cells "${SHADOW_SEAT_FEED_CELLS}"
           echo "REGIONAL_PLACEMENT_ENABLED=${desired}" >> "${GITHUB_ENV}"
           echo "REGIONAL_PLACEMENT_VERSION=${target_version}" >> "${GITHUB_ENV}"
 

.github/workflows/cloud-deploy-relay-staging.yml

@@ -7,6 +7,46 @@ on:
         description: Exact checked-in production Relay sha256 digest to deploy
         required: true
         type: string
+      reserve-placement:
+        description: Preserve step-5 reserve placement, or set it; turning it off is refused while any cell is reserve
+        required: true
+        default: preserve
+        type: choice
+        options: [preserve, 'off', dry-run, 'on']
+      expected-rehome-generation:
+        description: Exact durable regional-rehome generation; it must remain disabled
+        required: true
+        type: string
+      bootstrap-runtime-identity:
+        description: One-time move from the stamped-cell identity to the director identity
+        required: true
+        default: false
+        type: boolean
+      predecessor-image-digest:
+        description: Bootstrap only. Exact immutable serving predecessor digest
+        required: false
+        type: string
+      capacity-cell-id:
+        description: Register this cell's reviewed staging.tfvars cap and bound with the director
+        required: true
+        default: none
+        type: choice
+        options: [none, staging-gce-c1, staging-gce-c2, staging-gce-c3, staging-gce-c4]
+      min-instances:
+        description: Director floor; preserve keeps the serving revision's, so a reserve run's 2 survives
+        required: true
+        default: preserve
+        type: choice
+        options: [preserve, '0', '2']
+      confirmation:
+        description: BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY for a bootstrap
+        required: false
+        type: string
+      shadow-seat-feed-cells:
+        description: Preserve the step-3 shadow seat-feed cells, or set all or a comma list of cell ids; dropping a reserve cell is refused
+        required: true
+        default: preserve
+        type: string
 
 permissions:
   contents: read
@@ -34,13 +74,38 @@ jobs:
       IMAGE_NAME: relay
       EXPECTED_IMAGE_DIGEST: ${{ inputs.expected-image-digest }}
       CAPACITY_SERVICE_ACCOUNT: ${{ vars.STAGING_GCP_RELAY_CAPACITY_SERVICE_ACCOUNT }}
+      # The director must trust the identity every staging Relay workflow authenticates as.
+      DEPLOY_SERVICE_ACCOUNT: ${{ vars.STAGING_GCP_RELAY_DEPLOY_SERVICE_ACCOUNT }}
       ASIA_PROOF_SERVICE_ACCOUNT: ${{ vars.STAGING_GCP_RELAY_ASIA_PROOF_SERVICE_ACCOUNT }}
       REGIONAL_PLACEMENT_SECRET: orca-cloud-relay-regional-placement-enabled
+      DIRECTOR_RUNTIME_SERVICE_ACCOUNT: orca-cloud-staging-relay-dir@onorca-cloud-staging.iam.gserviceaccount.com
+      PREDECESSOR_RUNTIME_SERVICE_ACCOUNT: orca-cloud-staging-relay@onorca-cloud-staging.iam.gserviceaccount.com
+      REHOME_AUDIENCE: https://relay-staging.onorca.dev/v1/admin/host-drain
+      EXPECTED_REHOME_GENERATION: ${{ inputs.expected-rehome-generation }}
+      BOOTSTRAP_RUNTIME_IDENTITY: ${{ inputs.bootstrap-runtime-identity }}
+      PREDECESSOR_IMAGE_DIGEST: ${{ inputs.predecessor-image-digest }}
+      CAPACITY_CELL_ID: ${{ inputs.capacity-cell-id }}
+      MIN_INSTANCES: ${{ inputs.min-instances }}
     steps:
       - uses: actions/checkout@v4
 
-      - name: Require the expected immutable image
-        run: '[[ "${EXPECTED_IMAGE_DIGEST}" =~ ^sha256:[a-f0-9]{64}$ ]]'
+      - name: Require the expected immutable image and identity request
+        shell: bash
+        env:
+          CONFIRMATION: ${{ inputs.confirmation }}
+        run: |
+          set -euo pipefail
+          [[ "${EXPECTED_IMAGE_DIGEST}" =~ ^sha256:[a-f0-9]{64}$ ]]
+          [[ "${EXPECTED_REHOME_GENERATION}" =~ ^(0|[1-9][0-9]*)$ ]]
+          [[ "${BOOTSTRAP_RUNTIME_IDENTITY}" =~ ^(true|false)$ ]]
+          [[ "${MIN_INSTANCES}" =~ ^(preserve|0|2)$ ]]
+          if test "${BOOTSTRAP_RUNTIME_IDENTITY}" = true; then
+            [[ "${PREDECESSOR_IMAGE_DIGEST}" =~ ^sha256:[a-f0-9]{64}$ ]]
+            test "${CAPACITY_CELL_ID}" = none
+            test "${CONFIRMATION}" = BOOTSTRAP_RELAY_DIRECTOR_REHOME_IDENTITY
+          else
+            test -z "${PREDECESSOR_IMAGE_DIGEST}"
+          fi
 
       - uses: hashicorp/setup-terraform@v3
         with:
@@ -68,6 +133,16 @@ jobs:
           test "${IMAGE}" = \
             "${GCP_REGION}-docker.pkg.dev/${GCP_PROJECT_ID}/${REPOSITORY_ID}/${IMAGE_NAME}@${EXPECTED_IMAGE_DIGEST}"
           echo "IMAGE=${IMAGE}" >> "${GITHUB_ENV}"
+          if test "${CAPACITY_CELL_ID}" != none; then
+            # The deploy script refuses any topology change beyond this one cell's cap and bound.
+            DESIRED_CELLS_JSON="$(terraform -chdir=infra/terraform console \
+              -var-file=environments/staging.tfvars \
+              <<< 'local.relay_director_cells_json' | jq -er '.')"
+            jq -e --arg cell "${CAPACITY_CELL_ID}" \
+              'any(.[]; .id == $cell and .connectionHardCap != null)' \
+              <<< "${DESIRED_CELLS_JSON}" >/dev/null
+            echo "DESIRED_CELLS_JSON=${DESIRED_CELLS_JSON}" >> "${GITHUB_ENV}"
+          fi
 
       - uses: google-github-actions/setup-gcloud@v2
 
@@ -87,12 +162,37 @@ jobs:
           test "${DIGEST}" = "${EXPECTED_IMAGE_DIGEST}"
 
       - name: Deploy director blue/green
+        env:
+          # An image change reads every cell's admit mode before the traffic move.
+          ORCA_RELAY_ADMIN_ID_TOKEN: ${{ steps.google-auth.outputs.id_token }}
+          RESERVE_PLACEMENT: ${{ inputs.reserve-placement }}
+          SHADOW_SEAT_FEED_CELLS: ${{ inputs.shadow-seat-feed-cells }}
         run: |
           regional_version="$(gcloud secrets versions describe latest \
             --project "${GCP_PROJECT_ID}" --secret "${REGIONAL_PLACEMENT_SECRET}" \
             --format='value(name)' | awk -F/ '{print $NF}')"
           [[ "${regional_version}" =~ ^[1-9][0-9]*$ ]]
           RELEASE_ID="${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}-${GITHUB_SHA:0:8}"
+          identity_args=()
+          if test "${BOOTSTRAP_RUNTIME_IDENTITY}" = true; then
+            identity_args=(
+              --bootstrap-runtime-identity true
+              --predecessor-runtime-service-account "${PREDECESSOR_RUNTIME_SERVICE_ACCOUNT}"
+              --predecessor-image-digest "${PREDECESSOR_IMAGE_DIGEST}"
+            )
+          fi
+          # Omitted, the deploy script inherits the serving revision's floor.
+          floor_args=()
+          if test "${MIN_INSTANCES}" != preserve; then
+            floor_args=(--min-instances "${MIN_INSTANCES}")
+          fi
+          topology_args=()
+          if test "${CAPACITY_CELL_ID}" != none; then
+            topology_args=(
+              --capacity-cell-id "${CAPACITY_CELL_ID}"
+              --director-cells-json "${DESIRED_CELLS_JSON}"
+            )
+          fi
           node dev/scripts/deploy-relay-blue-green.mjs \
             --project "${GCP_PROJECT_ID}" \
             --region "${GCP_REGION}" \
@@ -101,9 +201,20 @@ jobs:
             --role director \
             --max-instances 2 \
             --capacity-service-account "${CAPACITY_SERVICE_ACCOUNT}" \
+            --deploy-service-account "${DEPLOY_SERVICE_ACCOUNT}" \
             --asia-proof-service-account "${ASIA_PROOF_SERVICE_ACCOUNT}" \
             --regional-placement-secret-version "${regional_version}" \
-            --min-instances 0 \
+            "${floor_args[@]}" \
+            --runtime-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
+            "${identity_args[@]}" \
+            --rehome-director-service-account "${DIRECTOR_RUNTIME_SERVICE_ACCOUNT}" \
+            --rehome-audience "${REHOME_AUDIENCE}" \
+            --rehome-control-origin https://relay-staging.onorca.dev \
+            --expected-rehome-generation "${EXPECTED_REHOME_GENERATION}" \
+            "${topology_args[@]}" \
+            --admin-audience https://relay-staging.onorca.dev/v1/admin/drain \
+            --reserve-placement "${RESERVE_PLACEMENT}" \
+            --shadow-seat-feed-cells "${SHADOW_SEAT_FEED_CELLS}" \
             --release-id "${RELEASE_ID}"
 
       - name: Smoke director health

.github/workflows/cloud-operate-relay-production-cell-flags.yml

@@ -15,18 +15,26 @@ on:
         description: Exact cell id, e.g. production-gce-c26
         required: true
         type: string
-      readiness-local:
-        description: /ready answers from the cell alone (local readiness)
-        required: true
-        default: 'false'
-        type: choice
-        options: ['false', 'true']
-      ticket-check:
-        description: Shadow-check the director's assignment lease on host hellos
+      break-glass:
+        description: >-
+          Only for a dead or unreachable reserve cell, with set admitMode=default. Typed as
+          BREAK GLASS <cell-id>; records db without the cell's read-back
+        required: false
+        default: ''
+        type: string
+      confirm-reserve:
+        description: Required for admitMode=reserve, typed as RESERVE <cell-id>
+        required: false
+        default: ''
+        type: string
+      set:
+        description: >-
+          Switches to change, e.g. readinessLocal=true,admitMode=reserve (key=default removes a
+          key). Every other switch keeps its current value. Known: readinessLocal, ticketCheck,
+          admitMode, intakePerSec, reserveDryRun, rejectionFence, readTimeoutMarginMs,
+          reregisterInFlight
         required: true
-        default: 'off'
-        type: choice
-        options: ['off', 'shadow']
+        type: string
       expected-generation:
         description: Exact current object generation from a dry run, or 0 if none exists
         required: true
@@ -55,15 +63,17 @@ jobs:
   operate:
     if: ${{ vars.ORCA_CLOUD_OPERATIONS_ENABLED == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # A flip back waits for the cell to lease every control: 8-50 minutes, scaled to its controls.
+    timeout-minutes: 60
     environment: production
     env:
       MODE: ${{ inputs.mode }}
       CELL_ID: ${{ inputs.cell-id }}
-      READINESS_LOCAL: ${{ inputs.readiness-local }}
-      TICKET_CHECK: ${{ inputs.ticket-check }}
+      FLAG_CHANGES: ${{ inputs.set }}
       EXPECTED_GENERATION: ${{ inputs.expected-generation }}
       CONFIRMATION: ${{ inputs.confirmation }}
+      CONFIRM_RESERVE: ${{ inputs.confirm-reserve }}
+      BREAK_GLASS: ${{ inputs.break-glass }}
       GCP_PROJECT_ID: onorca-cloud
     steps:
       - uses: actions/checkout@v4
@@ -95,7 +105,9 @@ jobs:
             --mode "${MODE}" --cell-id "${CELL_ID}" \
             --cell-origin "https://${CELL_ID#production-gce-}.relay.onorca.dev" \
             --project-id "${GCP_PROJECT_ID}" \
-            --readiness-local "${READINESS_LOCAL}" --ticket-check "${TICKET_CHECK}" \
+            --set "${FLAG_CHANGES}" \
+            --director-origin "https://relay.onorca.dev" --confirm-reserve "${CONFIRM_RESERVE}" \
+            --break-glass "${BREAK_GLASS}" \
             --expected-generation "${EXPECTED_GENERATION}" --confirmation "${CONFIRMATION}" \
             | tee "${RUNNER_TEMP}/relay-cell-flags.jsonl"