Skip to content

Workflow status is tracked in GitHub: https://github.com/emulebb/emulebb/issues/48. This local document is retained as an engineering spec/evidence record.

CI-035 - Final current-head RC proof and fresh package hashes

Summary

Run and record the final RC proof on the selected reviewed main commit after all RC-blocking items are closed or explicitly accepted. This item owns the fresh command evidence, package hashes, and final tag-readiness record for the active 0.7.3 candidate. It is closed by the stable 0.7.3 publication plus the explicit 2026-07-05 operator waiver for the remaining stable live, soak, and Windows-VM proof rows.

Current Proof

Stable closeout decision (2026-07-05): the operator accepted the remaining stable live, soak, and Windows-VM proof rows as waived and authorized shipping 0.7.3 without additional local evidence. The rows are recorded as waived, not passed. Stable package assets were generated and published by the GitHub release workflows from the selected heads: app 9402251c, aMuTorrent 2da7c19, and emulebb-build d9cf587.

Final published stable evidence is authoritative for 0.7.3. Earlier RC proof and local candidate package hashes remain historical context only.

Prepared - emulebb-v0.7.3 stable (2026-07-05)

The stable target is app 9402251c, nine commits after emulebb-v0.7.3-rc.3. The delta contains diagnostics-oracle alignment for MFC/Rust parity, README install-command sync to the published RC3 bootstrapper, and shutdown/socket guards for BUG-152 and BUG-153.

The aMuTorrent companion target remains 2da7c19, published for RC3 as amutorrent-v3.8.8-emulebb-v0.7.3-rc.3. Upstream aMuTorrent commit e6b4946 ("Per-instance category sync toggle") is intentionally deferred post-0.7.3 to avoid adding controller behavior risk during stable closeout.

Stable package publication uses GitHub Actions Publish release workflows with release_version=0.7.3. Final stable SHA-256 and SBOM hashes are recorded in the published section below.

Published - emulebb-v0.7.3 stable (2026-07-05)

The stable app release is published as emulebb-v0.7.3: https://github.com/emulebb/emulebb/releases/tag/emulebb-v0.7.3. Workflow run 28752898974 built x64 and ARM64 packages, the diagnostics packages, the suite bootstrapper, generated artifact attestations, created the annotated tag, and published the release after release environment approval. The tag peels to app 9402251c2dc986dfc2346e5c80046e22d5c7e3d6; the release was published at 2026-07-05T20:14:01Z.

Final published app artifact SHA-256:

  • emulebb-0.7.3-x64.zip: c7a0238e36619e34acebf0687ff3ba9ab8b366be160c6f53ef72ba02d2235db9
  • emulebb-0.7.3-arm64.zip: d61baffe96aa4110c9b7a7550d2d744d5c51d654f6276d545e2a4ecb6bd301cd
  • emulebb-0.7.3-diagnostics-x64.zip: 41f383f4e0d9b429211f0a23e7415da68fb06c9b4f70f86ee84db080765d5795
  • emulebb-0.7.3-diagnostics-arm64.zip: f74c4180b06e6c00a8e33373a284ca6261d1a16d573396a05dc804adcc96d2f3
  • Bootstrap-eMuleBBSuite.ps1: 05a94d71993efc8df4bdf34b90c6250dd5cf0ebd4652c78b972918d2f674c0ed
  • Bootstrap-eMuleBBSuite.ps1.sha256: 56bfa42479c66dca46f2a1805e2b1c232101e0833185f78c2e2f55891e1835bd

SPDX SBOM SHA-256: x64 93e73132f2b3ff4208c42b7d24c1dfa68bf5fbb674ca0a0f32fe29751d426269, arm64 77375a2c598f1e7b240de9fefbece9a0ed58a9b9ad4ff6fcf94a4ff64eb828b8, diagnostics-x64 1ffecf0dcda47035d06d5952a8ff3ceaf708b326425201f69237e3a99bacf3a8, and diagnostics-arm64 12caa2343fd74d32fb9a23794fa9cf6c60043ee4b61b05c8e94acf7771784b73.

Manifest SHA-256: x64 c7aa4fcb319148ba51bda6736fb86a8d6a70e0d46c5e515628aa055c8000abdb, arm64 32ce7d4a5eeb3fe287df5fed88d5e821247923216b2580c90daba3bbd576b315, diagnostics-x64 a0e6e27e2da5cf5d4df4ab06d1d2f0840ce0f32e3f08a289ca1b09fc6a0c98cc, and diagnostics-arm64 a23826f38fff5a784704d6498cc9dfdfd98c85277bf432866f1393bd69359e90.

The aMuTorrent x64 controller companion is published as amutorrent-v3.8.8-emulebb-v0.7.3: https://github.com/emulebb/amutorrent/releases/tag/amutorrent-v3.8.8-emulebb-v0.7.3. Workflow run 28752899013 built and published the package from 2da7c19313c44fe2ed29bf8d24eec4cca3eeeb8d; the release was published at 2026-07-05T19:57:39Z.

Final published aMuTorrent artifact SHA-256:

  • emulebb-0.7.3-amutorrent-x64.zip: 47fa82c254b62bdb786fe848f66d31d5616254a39b0d5b45553492f77a6c732e
  • emulebb-0.7.3-amutorrent-x64.sbom.spdx.json: 9618f94190aaa2aefe89b1a42daf74c549d03dd3f2be45fdd96677b4c15be110
  • emulebb-0.7.3-amutorrent-x64.manifest.json: f2cac268bc68fb92c10b32dbeeadf69935ab9a3c71e39d4e1c58c9e685bd00e7

Published - emulebb-v0.7.3-rc.3 (2026-06-21)

Operator approved the release environment; the Publish release workflow (run 27909074408, dispatched with release_version 0.7.3-rc.3, target_sha fd17a04, build_ref main) built x64+ARM64 clean and published the prerelease. The 3 out-of-scope emulebb-rust cert failures are accepted for shipped scope, matching the rc.2 disposition.

This is a re-publish: the first publish (run 27905947687, 14:45Z) shipped a bootstrapper that called GitHub's /releases/tags/<tag> endpoint, which then started flapping HTTP 504 and broke the install. The release was deleted and re-published from build_ref=main carrying the hardened, by-tag-free bootstrapper (resolves from the /releases list with retry); the Pages install.ps1 wrapper was hardened the same way. The rebuild produced fresh package hashes (the first publish's hashes are superseded).

Annotated tag emulebb-v0.7.3-rc.3 peels to app fd17a04; GitHub prerelease https://github.com/emulebb/emulebb/releases/tag/emulebb-v0.7.3-rc.3 (re-published 2026-06-21T15:52Z). Final published artifact SHA-256 (authoritative; supersede the first-publish and local candidate hashes):

  • emulebb-0.7.3-rc.3-x64.zip: 0a10276a690aeb7b603a6cb3c864b0328be72d6f6645679b8fe7ec8b0c7e4d53
  • emulebb-0.7.3-rc.3-arm64.zip: f571eca7f8179dd4794fec8f98c49a82597ed9a032c821b6eeca63912e81b8e6
  • emulebb-0.7.3-rc.3-diagnostics-x64.zip: 6d3c0cf8f420608b54bdb4b11321ff12cf7dd85596aebe8e890a2573553b762f
  • emulebb-0.7.3-rc.3-diagnostics-arm64.zip: a8ce7a91ddf9e1bb700766debb4c8adf8db63043a04d78cd7039d649911f01be
  • Bootstrap-eMuleBBSuite.ps1: edf901f4362639bb842d3fa8278a96fe35b76a57d8a6a2ec3da6701ecfb28429 (matches published .sha256 sidecar)

SPDX SBOM SHA-256: x64 c53762f1197953abc507fd520bbe04f3bed0a72b0edbe9f70e31931e0832f000, arm64 e7baba2c542ab8307f468186f37e3713017de8adebc289e381f46b52c8998d56, diagnostics-x64 27619fc2013aecb7b805baa2fc140403efc7383a10881d909658f1a4ed28b613, diagnostics-arm64 962d89af6c9050acaa7485a9d21b5aa628c7d892460ea3b4726da54bf65de3a4. Each ZIP also ships its .manifest.json plus GitHub artifact attestations.

The aMuTorrent x64 controller companion is published as amutorrent-v3.8.8-emulebb-v0.7.3-rc.3 (built deterministically against pinned Node 24.16.0): https://github.com/emulebb/amutorrent/releases/tag/amutorrent-v3.8.8-emulebb-v0.7.3-rc.3. Final published emulebb-0.7.3-rc.3-amutorrent-x64.zip SHA-256: 3e7aaf65c570361fa8ef6fcf52bc21b041bb9dda793ac4a85fa2eccaefee897d (with .manifest.json + SPDX SBOM + attestation).

2026-06-21 - RC3 fast certification proof (shipped scope)

Binding RC3 proof on the current main heads (relaxed gate, 2026-06-12); this is the rc.3 candidate proof and supersedes the rc.2 certification run.

Proof run: python -m emule_workspace test certification --profile fast --test-network offline on heads app fd17a04d (origin/main), emulebb-build a7e1aa4, emulebb-build-tests 3254fab, emulebb-tooling ed4527b (aMuTorrent 2da7c19). validate and every build step passed (app x64 Debug/Release, app ARM64 Release, build-tests Debug/Release, 0 warnings). python-harness ran 1439 tests: 1436 passed; the only 3 failures are emulebb-rust preview tests (test_amutorrent_adapter_drives_rust_controller, test_emulebb_rust_local_search_download_flow, test_emulebb_rust_peers_exchange_files_via_local_goed2k_sources) - all "rust REST API did not become ready" because rust is not built in the fast profile, being out of ship scope; accepted out of RC3 scope. Report: emulebb_out/reports/certification/20260621T105130Z-fast/certification-result.json.

Two pre-proof blockers were cleared first: stray repos/amutorrent node_modules (generated artifacts under repos/, removed so the artifact audit passes) and a stale test_master_source_parity crash-dump label check - the Capture-Full-Crash-Dump Tweaks label was localized to GetResString(IDS_TWEAKS_CAPTURE_FULL_CRASH_DUMP) + LocalizeItemText(...), so the check was updated to the localized pattern (emulebb-build-tests 3254fab).

Clean-worktree audit passed (check-clean-worktree.py). Candidate rc.3 packages (x64/ARM64 standard + diagnostics, aMuTorrent x64) are rebuilt from these heads with --release-version 0.7.3-rc.3; local candidate ZIP hashes are non-reproducible and are NOT final - the definitive published SHA-256/SBOM hashes are captured at tag time from the publish-release CI.

2026-06-19 - RC3 scope narrowed to MFC PowerShell bundle

Operator direction for RC3/final: ship the existing PowerShell MFC suite with aMuTorrent still bundled, and move the public Pages one-liner back to the GitHub Release Bootstrap-eMuleBBSuite.ps1 path. qBittorrentBB is parked outside RC3/final, alongside emulebb-rust, TrackMuleBB, uv, and the Python setup CLI.

The RC3 proof delta therefore adds Pages-wrapper parse/dry-run evidence and an absence check: the default Full bundle must not install or launch qBittorrentBB and public release copy must not claim it as part of 0.7.3.

2026-06-12 - relaxed gate; fast certification proof passed (shipped scope)

Operator relaxed the RC2 proof gate on 2026-06-12: the shipped app is stable, so a passing test certification --profile fast is sufficient to gate the RC. The full live-network quick release-campaign is downgraded from a hard blocker to operator-accepted/non-blocking, and emulebb-rust (lab/preview, not shipped in RC2) is out of ship scope, so its tests do not gate the ship.

The candidate then advanced with operator-promoted app work (FEAT-015 broadband upload tuning, FEAT-027 diagnostics flush, with matching build-tests coverage), so the proof was re-run on the advanced heads; that run is the binding proof and supersedes the earlier 20260612T144045Z-fast run on app 78d5250e.

Proof run: python -m emule_workspace test certification --profile fast --test-network offline --platform x64 --config Release on heads app 38827709, emulebb-build fefff3f, emulebb-build-tests 2f936c9, emulebb-tooling 7996733 (aMuTorrent 8259273, CI Package aMuTorrent green). validate and every build step passed (app x64 Debug/Release, app ARM64 Release, build-tests Debug/Release). python-harness ran 1387 tests: 1385 passed (including the new FEAT-015/FEAT-027 coverage); the only 2 failures are emulebb-rust preview local tests (resume-manifest.json write and a local goed2k swarm exchange) - accepted out of RC2 scope and untouched by RC2 work. Report: emulebb_out/reports/certification/20260612T194324Z-fast/certification-result.json.

Clean-worktree audit passed (check-clean-worktree.py); CI is green on all candidate heads. Candidate packages (x64/ARM64 standard + diagnostics, aMuTorrent x64) are rebuilt clean from the locked heads with the Node-24 build pin. Local candidate ZIP hashes are non-reproducible and are NOT final; the definitive published SHA-256/SBOM hashes are recorded below.

Published - emulebb-v0.7.3-rc.2 (2026-06-12)

Operator tag instruction given 2026-06-12. The first publish (run 27440850792, 2026-06-12T20:48:22Z) shipped BUG-017: the suite bootstrapper and installer declared a [ValidateSet] -UiLanguage parameter with no valid default, which fails only under the irm <url> | iex one-liner (the documented primary install path), never under & script.ps1. That broken release and tag were deleted and the release was rebuilt with the fix (emulebb-build 0fceae7) and re-published from the same app commit 38827709.

Re-published via the Publish release workflow (run 27443714916, conclusion success; release environment approved). Annotated tag emulebb-v0.7.3-rc.2 peels to app 38827709 (build_ref 0fceae7); GitHub prerelease re-published 2026-06-12T21:36:15Z: https://github.com/emulebb/emulebb/releases/tag/emulebb-v0.7.3-rc.2. The published bootstrapper was verified to bind under irm | iex (param-block smoke passes).

Final published artifact SHA-256 (authoritative; supersede both the local candidate hashes and the deleted first-publish assets):

  • emulebb-0.7.3-rc.2-x64.zip: 4797367b9602b9312d29bd31e7fa1901685461947861df54fad12c64151ce86d
  • emulebb-0.7.3-rc.2-arm64.zip: 9d3b46a94ba2ced2786ee2203950114be2240e57227dbff9fb1ce728ff247f69
  • emulebb-0.7.3-rc.2-diagnostics-x64.zip: 335575b569a6f37ac07b3efa2249529690f0e1d48fee5f9182593a55c5d40bad
  • emulebb-0.7.3-rc.2-diagnostics-arm64.zip: c6d8234955b539416cac7ba6b111c943c9b3e410724f7631ab1f77b41eb46c47
  • Bootstrap-eMuleBBSuite.ps1: 961139479e451889a9f5f2c61c49ae5a6c8497bd4eed6e658b50897b6142ee1b (matches published .sha256 sidecar)

Each ZIP ships its .manifest.json and SPDX .sbom.spdx.json sidecars plus GitHub artifact attestations.

The aMuTorrent x64 controller package ships as the version-matched companion release amutorrent-v3.8.5-emulebb-v0.7.3-rc.2 (aMuTorrent 8259273, build_ref fefff3f), published 2026-06-12T20:58:14Z via the amutorrent Publish release workflow (run 27442445145, success): https://github.com/emulebb/amutorrent/releases/tag/amutorrent-v3.8.5-emulebb-v0.7.3-rc.2. Final published emulebb-0.7.3-rc.2-amutorrent-x64.zip SHA-256: f8a6130d236b59e224f1744fe22baa710370ecae7941a2aa205abda8b88d9206 (with .manifest.json + SPDX SBOM + attestation). Bootstrap-eMuleBBSuite.ps1 resolves it by the -emulebb-v0.7.3-rc.2 tag suffix (exact match, ahead of the rc.1 fallback) and downloads emulebb-0.7.3-rc.2-amutorrent-x64.zip + manifest; verified against the live releases API.

Acceptance Criteria

  • [x] python -m emule_workspace test certification --profile fast passes for the shipped scope on the selected release commit (2026-06-12, offline network lanes; emulebb-rust preview failures accepted out of scope).
  • [x] Quick release-campaign proof passes or records accepted external inconclusive conditions for live-network-only lanes (operator-accepted / downgraded to non-blocking on 2026-06-12).
  • [x] CI-038 records a passed current-head ui-resource-depth release-scope language/resource smoke.
  • [x] x64 and ARM64 RC packages are regenerated from current release-ready heads as candidate artifacts.
  • [x] Optional aMuTorrent x64 controller package is regenerated from current clean provenance inputs as a candidate artifact.
  • [x] Commits, certification report path, command summary, and clean-worktree result are recorded here and in the release checklist under operator acceptance (2026-06-12). Candidate package/SBOM paths exist; final published SHA-256/SBOM hashes are captured at tag time from the publish-release CI (local candidate hashes are non-reproducible and not final).
  • [x] Main app package manifests and per-file hashes confirm that legacy template-based eMuleBB/webserver payload is absent from candidate RC assets.
  • [ ] Pages install.ps1 resolves the release Bootstrap-eMuleBBSuite.ps1, verifies the sidecar hash when present, and forwards existing bootstrapper parameters.
  • [ ] qBittorrentBB is absent from the RC3/final suite manifest, install defaults, lifecycle proof, package list, and public release claims.
  • [x] The annotated tag target was confirmed and the operator gave the tag instruction; emulebb-v0.7.3-rc.2 is tagged on app 38827709 and published (re-published with the BUG-017 fix). rc.2 is SHIPPED.

Validation

Use RELEASE-0.7.3-CHECKLIST as the command source of truth.

The full dated proof, package-hash, VM, and reset trail (including superseded heads and the RC1 tag record) is preserved in the CI-035 RC1 proof evidence log.