Repository navigation
Release v2.117.0 - Rhythm Raccoon - #15767
Merged
Merged
Conversation
…e106fbbdb80feea24554da22b9e1024497b2a7034313de125dc4750 chore(release): synchronize v2.116.0 - Steady Otter into development
Use uv 0.13.6 for FastVideo, MLX-Gen and MiniMax H3 bootstrap tools. This includes the compromised CA removal and wheel entry-point, RECORD, ZIP and TAR validation fixes. Guard all bundled pins against falling below the patched release floor.
Update client build, icon and testing tools, align Playwright with the server, and refresh shared ws, redirect, query parsing and glob overrides. Regenerate all four npm lockfiles while preserving transitive major-version compatibility.
…updates-mwatgxoj/agent-fcc3f2c8 fix: update dependencies and patch bundled uv vulnerabilities
…mages (#15656) A new Runtime image security workflow (weekly, on demand, and on PRs touching the recipes; not part of CI Gate) builds or pulls the pgvector and SuperCollider images on native amd64 and arm64 runners, generates a syft SBOM and a grype scan including OS packages, and uploads both with provenance (image, digest, recipe hash, commit, architecture, scanner and DB identity). Scanner errors or empty or malformed output fail the run instead of reading as zero findings. The inline Rapier npm pin is scanned too; the externally built eidoverse render parent and its deno.lock are reported as unavailable with the owning project. The scheduled dependency-updates prompt (v11) now consumes this evidence or names the gap.
…e patched uv (#15654) Prompt Guard and jev now install a complete hash-pinned closure (new shared lock, CPython 3.11+ because filelock's security fix needs it) instead of four direct pins. The Reactor runtime installs its hash-pinned lock and bootstraps uv 0.13.6 instead of 0.12.10. Generic package repair dispatches to a locked Apple Silicon profile (mflux, or the new mflux + mlx_video + mlx_vlm lock) and reports an unsupported profile before installing anything else, rather than solving an unpinned graph. The legacy INSTALL_VIDEO path in the image/video setup script follows the same rule. PortOS-owned uv use (package installs, FLUX.3 runtime) now runs a private, version-checked uv 0.13.6 bootstrapped under ~/.portos/tools, never the uv on PATH. Refs #15654
GitHub rejected the workflow file because the runner context is not available in job-level env.
…heckpoint (#15652) Lyric alignment no longer installs torch 2.2.2/2.8.0. Its private venv now installs a universal, hash-pinned lock (torch 2.14.1, torchaudio 2.11.1, numpy, every transitive package) with pip --require-hashes --no-deps --only-binary, resolved with a seven-day cutoff and checked against OSV. The alignment sidecar owns its CTC Viterbi and token merge instead of torchaudio's forced_align, and loads MMS_FA weights itself: the checkpoint bytes must match a pinned SHA-256 before torch.load(weights_only=True) sees them. A substituted cache or download is rejected without deserializing it, and a genuine older torch.hub copy is reused. Intel Macs and macOS before 14, which have no patched PyTorch build, are refused before anything installs; Apple Silicon requires an arm64 Python 3.11-3.14.
…audio after namesake removal (#15654) Review round 1: install uv from a hash-pinned lock (python, Reactor-style verification) in both the Node and shell bootstraps; skip package install when cancelled during uv bootstrap; force-reinstall mlx-video-with-audio's own files after removing the wrong mlx_video namesake; fail INSTALL_VIDEO=1 on Intel Macs. Refs #15654
Google stores all-day events as offset-less midnight and Outlook stores them as UTC midnight. Agenda, voice, and daily review compare those strings with Date on the UTC server, so a non-UTC user sees the neighboring day's all-day event and all-day touchpoints close at UTC midnight. Anchor those instants in the user timezone and treat the all-day end as exclusive.
…ivately (#15652) Packages are only installed into a cleared venv, and a stamp of the lock's SHA-256 decides reuse, so nothing outside the hash lock survives an upgrade. A genuine shared torch.hub copy is copied into the private cache while it is hashed instead of being loaded in place, and a verified file is published with one atomic replace so concurrent first runs cannot remove each other's cache.
Adding hours to local midnight used the midnight offset for the whole day, so a daily-review bound on a daylight-saving transition day included the next morning or dropped the last hour. All-day touchpoints also kept the raw UTC midnight, which Tribe records as the previous local day.
chore: publish quality snapshot
feat: add SBOM and vulnerability scans for pinned runtime container images
On an x64 host the installer launches the private uv through /usr/bin/arch -arm64, so the uv-binary assertion only held on arm64.
Outlook stamps an all-day midnight with Z. Ambient and the day grid parsed that as an absolute instant, so a July 4 all-day event ended at UTC midnight and also occupied the previous local day.
fix: move lyric alignment to patched PyTorch with a digest-verified MMS_FA checkpoint
fix: install Python runtimes only from hash-pinned locks and a private patched uv (#15654)
…lt-app-bugs-mwautr16/agent-0575229e fix: place all-day calendar events on the user's local day
This was referenced Nov 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release v2.117.0 - Rhythm Raccoon
Frozen candidate with new creative backends, improved full-song lyric and beat timing, reproducible local media tools, character comparison sheets, and calendar/Suno reliability fixes.
Frozen identities
main; publication branch:release.c99a8e71e4d84f1f62b54c715c3f02a63efee285.33dc1ebf7271125bb20f9b9ec03a8dde6252d7ed.v2.116.0, peeled commit33dc1ebf7271125bb20f9b9ec03a8dde6252d7ed.codex/release-agent-c1aea064.a92217f7a39b496a7a0069183ea0ab9ff7be45fc.2.117.0 - Rhythm Raccoon.mainwas merged or rebased into this candidate..changelog/v2.117.0.md.Candidate amendments
The amendments below address evidenced candidate validation failures and confirmed partial reviewer leads. These exact commits are the only exceptions to release preparation; all will be forward-ported through the normal post-publication synchronization PR.
c02f08bb1802b04ff6679832c9f0ae1fbc9716d89b2a774f9d7781ee5e56e0ddb80333af7012ede681d8788f7499fc9e1ae06ff2a43044c3e396ba117d9a8ecca0521a8dfe66e8d7ab808d4297192619c055d8a771c333bbde847ef5acd60e4091acd4a61ab22e4acfdb.status; the prior flat parser rejected every real scan.6ea2472cc5e3f6d226a0a92217f7a3Review outcome
Configured reviewer:
codex[gpt-6.1-terra]~opt~max=2~effort=highonly. Ran 1 of 2 permitted rounds at56ce1c687bac6dd40b9acd1c98e276c991a45ce8. The aggregate returnedok:false,REVIEW_CONTEXT_CAPACITY, so its status is INCONCLUSIVE, with no approval or completed-review attribution claimed. It covered 462 of 465 files in 25 calls; three indivisible large files exceeded the bridge's bound: the runtime image disposition ledger and the AuK/mflux-video lockfiles. Private raw response, exact diff and reviewed SHA are retained.Its partial leads were investigated: 23 confirmed leads are fixed above, 7 rejected below. All confirmed partial review leads are addressed. No extra reviewer was substituted and no second call was spent repeating the same known capacity refusal. Full validation and hosted merge gates remain mandatory.
torch>=2.14.0; the pinned pair satisfies it. The frozen runtime guide records native imports, pip check, Install/Repair and textured export.readStorevalidates/projects records before persistence. An empty object requires unsupported manual store corruption. Applied migration remains unchanged.Validation
a92217f7a39b496a7a0069183ea0ab9ff7be45fc(tree6e26f27097f80070dc6c75c766e0c8e40e9d941c), finished2026-11-11T17:06:43.210Z. Test-memo evidence is reused where every input is unchanged.npm run setup:db:testand the complete isolatedportos_testsuite passed. The separate post-diagnostic DB run passed 95 files / 867 tests / 1 existing skip; all focused regressions are listed in the amendment ledger..github/workflows/ci.yml, requiring bothCI GateandFull CI Gate) and Runtime image security (.github/workflows/runtime-image-security.yml, because scanned recipes changed). Manual-dispatch-only diagnostics are excluded by their triggers. Exact-head hosted verification passed all 26 checks, including both CI gates: CI, Runtime image security.Deferred to the next release
Unrelated issues, dependency updates, in-flight PRs (including the preloaded #15753), and development commits after the cutoff remain in development. No backlog sweep or dependency queue merge was performed. The required post-publication quality snapshot is a development update.
Decisions for operator review
Use a minor bump, 2.117.0, because the frozen range contains new user-visible features.
Name this release Rhythm Raccoon for the lyric/beat timing improvements.
Refuse unsupported anchored-frame/reference-audio combinations instead of silently dropping selected inputs.
Preserve the validated compatible Torch lock and the existing license, placement and disposable-checkout policies.
Treat incomplete optional review coverage honestly as inconclusive; fix confirmed partial leads and rely on required CI for admission.
Match the film-look browser fixture to the renderer navigation lifecycle, retaining every strict pixel assertion and timeout.
Forward-port candidate fixes and version metadata through the owned synchronization PR after workflow-verified publication.
Preserve existing test contracts while fixing repeated scanner work and child-process lifetime; keep unexplained historical fixture exits explicit in Diagnose intermittent collection fixture exits before SIGTERM readiness #15779.
Verified publication and synchronization
a344eb1e2f0a29926bc0112f4617c10dca55214f. Release workflow 43067157518 successfully created the tag and published v2.117.0 - Rhythm Raccoon. The tag tree matches the validated candidate tree.187ebe4dfbb962f679fcfe82867c044aaf439a51. Development contains the candidate, the published promotion and all newer development work. Package and root lockfile versions agree on2.117.0.bcd6ea47bc678510edf53e3855065377f30271e4: 22 successful checks and four normal planner skips; the required CI Gate passed.8a4578c6f333bff14e18a41696c2172b137cab33. Its two accepted findings were fixed inad5f008c116df384e86f072485cf44c5d9eac777andbcd6ea47bc678510edf53e3855065377f30271e4and merged through chore: synchronize v2.117.0 Rhythm Raccoon into development #15794. These post-publication development follow-ups are for the next release; the published tag is unchanged. The final fixes were not re-reviewed after the 2/2 round budget was spent.npm run quality:snapshotsucceeded after synchronization withno-changes; the development snapshot already contains the available local measurements. No provider calls or live-checkout edits were made.The repository delivery verifier independently confirms all eight delivery and quality obligations against the merged synchronization and development snapshot. This inspection does not persist synchronization receipts or claim a clean local review of unreviewed fixes. The only pending obligations are active-process settlement and service-owned checkout retirement after this run exits.