The full gate runs in a Nix-based container where true resolves into /nix/store, which is group-writable and therefore never root-controlled, so the two trusted_path tests failed there. They now take the first root-controlled os.defpath directory and skip when there is none. A sticky group-writable ancestor stays refused: on multi-user Nix any user can have the daemon build root-owned store content (skeptic round 7); the README says to pin an absolute path on Nix.
🎯 Fix: 92 %
💥 Break: 1 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 91
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pkgmgr gc --report lists each linked worktree and orphaned .claude/worktrees/agent-* dir with its size and last activity, the changes a cleanup would keep, the biggest children of every --root, ELF core dumps, docker system df with --docker, and free versus attributed space per filesystem; --json prints the same as JSON. It deletes and writes nothing and refuses --apply. git run() gains input_text for cat-file --batch-check.
🎯 Fix: 90 %
💥 Break: 2 %
💸 Cost: new
⏱️ Time: new
🛡️ Security: 100 %
🏆 Score: 88
🚦 Gate: cost new, time new: cleared by the operator's commit word for pkgmgr gc --report (2026-11-07)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
pkgmgr worktree up and down create and release a branch worktree with its own slot and run the operator-pinned worktree-init and worktree-fini hooks; branch gc removes merged worktrees, now also patch-merged ones (git cherry), and the hooks of each repository run only from worktree_hooks pins of a managed repository whose git directory is its own. Removal walks to the worktree without following a symbolic link and skips paths that are not their own realpath. A bare-name hook program resolves once to a root-controlled file on a root-controlled PATH: root is uid 0 only in the initial user namespace and the overflow uid elsewhere, nosuid mounts never count on the host, and the hook runs the resolved file with only those PATH entries, stdin closed and a timeout over its process group.
🎯 Fix: 93 %
💥 Break: 3 %
💸 Cost: 114 %
⏱️ Time: 129 %
🛡️ Security: 100 %
🏆 Score: 61
🚦 Gate: cost 114 % and time 129 %: accepted by the operator for B (2026-11-07) after skeptic round 6 found no hole and MEDUSA reached 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Every image build now carries <version> and the immutable
<version>.<unix-ts>; latest goes to the newest release on main, each
prefix (2, 2.3) to the newest release starting with it, and stable to the
release the git tag stable marks, which "Mark stable commit" sets only
after all tests passed.
publish-containers.yml runs daily at 03:00 UTC and on workflow_dispatch.
A rebuild publishes the newest release and, when the git tag stable sits
on an older one, that release too, so both get base-image security
updates. compute-publish-container-info.sh emits the release list with
each release's moving tags; image.sh takes them as --aliases instead of
--stable.
A platform build whose installed package set equals the published
<version> pushes nothing, and a merge whose image index equals the
published one only moves the tags not yet on it, without a new stamp.
Only vX.Y.Z tags count as releases; v2.4.0-rc1 no longer moves 2 or 2.4.
The build scripts come from the release commit: releases tagged before
this change keep the old scripts until a newer release replaces them.
tests/integration: 22 tests for release choice, aliases, the stable
rebuild, the push skip and the triggers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
scripts/docker/slim.sh survived the removal of the stage that copied and ran
it, and nothing else referenced it.
The README still offered a `Virgin` image type with `pkgmgr-arch-virgin` as its
example, which is no longer published. Its second row was wrong independently
of that refactor: the image does not contain Nix, it runs `make install`, which
is scripts/installation/init.sh, and neither that nor entry.sh installs it. The
section now states the tags compute_publish_tags() actually pushes, including
the unsuffixed alias the default distribution gets, and points at base-images
for the clean environment the virgin image used to serve. A missing blank line
before a horizontal rule had also been rendering the paragraph above it as a
heading.
Three comment blocks explained what the repository used to do rather than what
it does, in the Dockerfile, in scripts/build/publish.sh and in the Makefile.
That belongs in the history, which is where it already is.
Verified: markdownlint-cli2 on the README goes from 21 findings to 10, all
remaining ones pre-existing and outside this section; `bash -n` on publish.sh
and `make -n build` pass.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Simplify *Why PKGMGR* into concise prose and add Docker images as reproducible system baselines linked to Infinito.Nexus
* Condense Features into a single, readable overview without command lists
* Clean up Architecture section and keep diagram metadata consistent
* Reorganize Installation with clear download, dependencies, install and setup modes
* Introduce a unified *Run PKGMGR* section differentiating Nix, Docker and venv usage with consistent examples
Refactor CI to clearly separate virtualenv-based container tests from pure Nix flake tests across all distros (arch, debian, ubuntu, fedora, centos).
Introduce dedicated test-env-nix workflow and Makefile targets, rename former container tests to test-env-virtual, and update stable pipeline dependencies.
Improve Nix reliability in containers by fixing installer permissions and explicitly validating nix availability and version during image build and tests.
Expanded and modernized the README to reflect PKGMGR's purpose as a
multi-distro development and packaging orchestrator. Added explanations for
Nix-based cross-distro workflows, clarified installation steps, documented the
full CLI capabilities, and embedded the architecture diagram.
Also replaced the verbose CLI DESCRIPTION_TEXT with a concise summary suitable
for `--help` output.
Included updated `assets/map.png`.
https://chatgpt.com/share/693b1d71-ca08-800f-a000-f3be49f7efb5
- Add dev runner main.py that prefers local src/ over installed pkgmgr
- Move Arch/Debian/Fedora packaging files under packaging/* and update build scripts
- Adjust .gitignore/.dockerignore for new packaging paths and src/source/
- Improve config defaults discovery to support src/ layout and installed packages
- Update architecture diagram and add TODO overview for TAGS/MIRROR/SIGNING_KEY
https://chatgpt.com/share/693a76a0-e408-800f-9939-868524cbef4d
- Split virgin tests into separate root and user GitHub Actions workflows
(test-virgin-root, test-virgin-user) and adjust Arch container flows
- Introduce scripts/installation/venv-create.sh and reuse it from
scripts/installation/main.sh with separate root/system and user/dev paths
- Add PKGMGR architecture & setup map (assets/map.png) and section in README
with link to the up-to-date master page
- Simplify README by removing outdated Docker quickstart, usage examples,
and AI footer
- Extend .gitignore to exclude src/source artifacts
https://chatgpt.com/share/6939bbfe-5cb0-800f-8ea8-95628dc911f5
