Skip to content

chore(fleet): re-cascade to resolve wheelhouse lock-step mismatch - #1506

Merged
John-David Dalton (jdalton) merged 1 commit into
mainfrom
jdalton/fleet-lockstep-resync
Aug 22, 2026
Merged

chore(fleet): re-cascade to resolve wheelhouse lock-step mismatch#1506
John-David Dalton (jdalton) merged 1 commit into
mainfrom
jdalton/fleet-lockstep-resync

Conversation

@jdalton

@jdalton John-David Dalton (jdalton) commented Aug 21, 2026

Copy link
Copy Markdown
Collaborator

The fleet-pack release and the cascaded template SHA had drifted out of lock-step, which blocked scripts/fleet from materializing locally. Re-cascading fixes it and pulls in a few soaked catalog bumps along the way.

VerificationI ran the sync-scaffolding cascade with --fix, then ran pnpm install to confirm the lockfile resolves cleanly.

Note

High Risk
Touches CI checkout, toolchain install, artifact/cache clients, and integrity verification for downloaded binaries. A bug here can break installs, skip quality gates on backup refs, or ship unverified tools.

Overview
Re-cascades the fleet pack (bundle.ref / cascadeShad5cde643…) so local scripts/fleet can materialize again, and pulls soaked tool bumps (pnpm 11.21.0, uv 0.12.4, sfw 1.15.0) plus Windows platform keys (win32-*) and explicit origin fields.

Supply-chain / CI: Toolchain installs (Chrome, rustup, Go) now resolve pinned assets, SRI-verify bytes, then live-check publisher checksums and pin age before extract. Workflows drop actions/checkout, setup-go, cache, and upload-artifact in favor of first-party fleet composites (checkout, setup-go-toolchain, cache restore/save, upload-artifact / download-artifact). pnpm install always passes --frozen-lockfile or --no-frozen-lockfile so CI cannot silently freeze a half-hydrated tree.

Local/dev: Statusline prefers a native binary with Node fallback. Vitest worker count scales with cores (cap 24). New git-hook helpers block non-cascade edits of fleet-canonical paths and skip quality gates on wip/ / worktree/ backup pushes. ci:local moves off @redwoodjs/agent-ci to run-local-ci.

Reviewed by Cursor Bugbot for commit c598f02. Configure here.

The pinned fleet-pack release and the cascaded template SHA had
drifted out of lock-step, blocking scripts/fleet from materializing
locally. Re-cascading pulls in catalog bumps (oxlint, oxfmt, taze,
chrome-devtools-mcp, and others past their soak window) and syncs the
drifted fleet scaffolding to the current template.
@socket-security

This comment has been minimized.

@socket-security

This comment has been minimized.

cursor[bot]

This comment was marked as resolved.

@jdalton
John-David Dalton (jdalton) merged commit 3afb6f2 into main Aug 22, 2026
15 checks passed
@jdalton
John-David Dalton (jdalton) deleted the jdalton/fleet-lockstep-resync branch August 22, 2026 03:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant