Update (2026-09-25): hosted CI is now enabled and green. GitHub Actions was re-enabled at the repository level, and
wire-certify.ymlexecuted real steps for the first time that day. On the current tree it is green: all 26 jobs passed (run36083085187). TheCIworkflow is 4/4 green (run36083085188) andBuild and Deploy Docsis green too. That first hosted run caught two genuine bugs, both the same root cause — an unpinnedmcpdependency resolving to 2.x, whose API renamedFastMCP→MCPServerand droppedServer.list_tools(fixed inbd771db,d6764ec). This is day one of hosted certification, not a long track record. This file, andmake ci-local, remain useful and are kept up — but from here on they are a complement to hosted runs, not a substitute for them. The status note immediately below is preserved as the historical record of why local attestation was the sole certification path of record up to that point.
Update (2026-09-25, DCF-Minecraft branch
feat/dcf-minecraft, PR #32): hosted CI is green on the branch — Wire Certification run36101123986(28 jobs,certify-minecraftincluded), CI36101124002, CMake36101123956, Docs36101123987. Before that, the newcertify-minecraftjob and the jobs it touches were run locally withmake ci-local(parity guard OK after adding the previously missingcertify-exsecutorentry) and the fullmake certify(ALL CERTS PASS):
Job / check Status How certify-minecraft ✅ PASS vectors regenerated == both committed copies; 5 Python suites ( test_minecraft_{vectors,datapack,sidecar,cli},test_bedrock_ws, 30 tests, 5/5 repeated runs green);minecraft/build.shcore (JDK 21) + Paper plugin (Nix-store JDK 25) jars;CoreSelfTestloopbackcertify-java ✅ PASS + GameCertify,TextCertify,MinecraftCertifycertify-medium ✅ PASS unchanged codecs; mc:now a known scheme (Python-only; C/Rust/Go/Node exit 3, verified per binary)certify-exsecutor ✅ PASS fasmg from nix; 246/246 Fabric mod ✅ built Gradle 9.7.1 + JDK 25 (Loom 1.18), Yarn 1.21.11+build.6, jar 65 KB Nix ✅ PASS nix build .#dcf-python .#dcf-minecraft-core .#dcf-minecraft-paper .#dcf-minecraft-datapack; Sphinx docs build (pip venv) links the specReal Paper 26.2 round trip ✅ PASS minecraft/tools/devserver_test.py: Oligarchy's dev runner (Paper 26.2-121 + Geyser 2.11.2 + Floodgate 2.2.5, headless) with the plugin in datapack mode:dcf:selftest→ barrels → comparators → wires → latch → plugin → UDP (proto) = golden frame; UDP → plugin →dcf:rx_commit→ words + barrel 0 verified over the stdin consoleOligarchy .#test-minecraft-server✅ PASS NixOS VM gate (KVM): jars, datapack, rendered config, sidecar unit on the console FIFO, :19134listening, every port rule scoped towg0Human-run, not repeated here:
prism_test.pyon a Prism client (it provisions + tails; the user opens the world), Bedrock/connecton a real client.
Status note (2026-09-24): hosted GitHub Actions have never executed a real job for this repository. All 57
wire-certify.ymlruns (2026-06-10 → 2026-06-21) failed at startup within seconds (an account billing lock; no step ever ran), and no run was triggered by any later commit. Separately, the workflow file itself was invalid YAML from commit70beec5(committed 2026-08-16; an unquotedrun:one-liner in the Lua transport step) until this fix, so it could not have run even with billing cleared. Until the owner clears the billing lock,make ci-local(.github/ci-local.sh) and the dated attestations in this file are the certification path of record.workflow_dispatchis now enabled onwire-certify.yml,ci.ymlandcmake-multi-platform.yml, so a manual hosted run can be triggered as soon as Actions is unblocked.
Correction (2026-10-03): the note above is superseded. The cause was not a billing lock: GitHub Actions was disabled at the repository level, and it was re-enabled on 2026-09-25 (
Documentation/DCF_CODE_REVIEW.mdR1). Hosted runs onmainat09866ca(2026-09-26):Wire Certificationrun36275105961,CIrun36275105998andCMake on multiple platformsrun36275106001all passed. The attestations in this file stay as dated local records.
The Wire Certification workflow (.github/workflows/wire-certify.yml) was executed
locally, job-for-job, instead of on GitHub Actions. Toolchains not installed on
the host were supplied hermetically with Nix (nix shell nixpkgs#…), exactly the
versions CI would provision. This file is a dated attestation, not a substitute for
the hosted run.
- Date: 2026-07-25
- Commit:
790ebae(Phase 4 certification pass) - Host toolchains: Python 3, Rust (cargo), GCC, Go 1.25, GHC 9.10 (host)
- Nix: Determinate Nix 3.16 (supplied jdk, kotlin, ghc, sbcl, swift)
This refresh targets the four languages whose tier changed (Haskell/Kotlin/Swift/
Lisp) plus the new/changed jobs (spa, c-sdk-unit, lisp full-vector). The host-native
adapter jobs (python/rust/c/go/…) are unchanged from the 394731f run below and were
not re-executed here.
| Job | Status | How |
|---|---|---|
| certify-lisp | ✅ PASS | nix sbcl — full 109 encode + 137 syndrome + FEC vectors read from the canonical JSON (upgraded from the embedded subset; still no Quicklisp) |
| certify-java | ✅ PASS | nix jdk — Certify + SuperPackCertify + FECCertify (all 246 + FEC) |
| certify-kotlin | ✅ PASS | nix kotlin+jdk — Frame+SuperPack+FEC+Certify → run (109 encode + 137 syndrome + FEC) |
| certify-haskell | ✅ PASS | nix ghcWithPackages — Certify.hs (109 encode + 137 syndrome + 7 superpack) |
| certify-swift | ⏭️ CI-only | the Nix Swift-on-Linux wrapper's swift test did not finish within the local budget; the swift-actions runner is authoritative (unchanged from 394731f) |
| spa | ✅ PASS | host cargo (cargo test: token codec, §13 matrix, Python↔Rust cross-language) + python unittest |
| c-sdk-unit | ✅ PASS | host cmake — plain + ASan+UBSan + TSan (unit suite, regressions C4/H2/C6, streamdb C5) |
The certify-lisp job now certifies the entire golden certificate (not a hand-picked
subset) by reading Documentation/{golden,fec}_vectors.json through a small
dependency-free JSON reader added to lisp/src/wire.lisp. TSan's first run of the new
StreamDB C test found a real data race on the auto-flush running flag, now fixed.
- Date: 2026-06-18 · Commit:
394731f· Result: 15 PASS · 1 SKIP · 0 FAIL
| Job | Status |
|---|---|
| certify-python | ✅ PASS |
| certify-rust | ✅ PASS |
| certify-c | ✅ PASS |
| certify-cpp | ✅ PASS |
| certify-go | ✅ PASS |
| certify-perl | ✅ PASS |
| certify-audio | ✅ PASS |
| certify-game | ✅ PASS |
| certify-text | ✅ PASS |
| certify-node | ✅ PASS |
| certify-lua | ✅ PASS |
| certify-swift | ⏭️ SKIP (nix wrapper lacks swift-test) |
- Generated by
CI_LOCAL_REPORT=1 make ci-local(.github/ci-local.sh, job-for-job withwire-certify.yml; 26 of 26 jobs run). - Host: Linux x86_64; gcc 13.3.0; cargo 1.94.1 (29ea6fb6a 2026-03-24); go version go1.24.7 linux/amd64; node v22.22.2; openjdk version "21.0.10" 2026-01-20; Python 3.11.15; perl v5.38.2; nix: no.
- Result: 20 PASS · 6 SKIP · 0 FAIL
| Job | Status | Detail |
|---|---|---|
| certify-python | PASS | 12s; partial: wirelab_mcp --selftest not run (python 'mcp' package not installed) |
| certify-c | PASS | 4s |
| c-sdk-unit | PASS | 33s |
| certify-hydramodem | PASS | 180s |
| certify-rust | PASS | 0s |
| spa | PASS | 6s |
| certify-wasm | SKIP | no wasm-pack (CI installs it with the rustwasm installer) |
| certify-audio | PASS | 0s |
| certify-game | PASS | 1s |
| certify-text | PASS | 0s |
| certify-qkd | PASS | 0s |
| qkd-bridge | PASS | 6s |
| certify-sstv | PASS | 0s |
| certify-snake | PASS | 2s |
| certify-lua | SKIP | no lua5.4 on host and no nix |
| certify-go | PASS | 13s |
| certify-haskell | SKIP | no ghc/cabal on host and no nix |
| certify-java | PASS | 2s |
| certify-kotlin | SKIP | no kotlinc on host and no nix |
| certify-node | PASS | 0s |
| certify-perl | PASS | 1s |
| certify-cpp | PASS | 4s |
| certify-swift | SKIP | no swift on host and no nix |
| certify-lisp | SKIP | no sbcl on host and no nix |
| certify-medium | PASS | 7s |
| io-matrix | PASS | 18s |
Notes on this run (WP-CI-B):
- First job-for-job run.
ci-local.shnow has one function perwire-certify.ymljob, in workflow order, and refuses to drift (a job-list mismatch is reported asFAIL ci-local-parity). Earlier local runs covered a subset of the steps. - New jobs:
certify-medium(regeneratemedium_vectors.json+ diff both JSON copies andcodec/medium_vectors.gen.h; Python/C/Rust/Go/Node/C++ medium certs; 162 cases) andio-matrix(the fivepunctimCLIs x file/stdio/udp-proto/udp-bare/hydra/garbage: 140 pass, 0 fail, 0 skipped). JavaMediumCertify, Perlt/medium.tandhydra_symbols_certifyrun insidecertify-java/certify-perl/certify-hydramodem. - Latent workflow bug found and fixed:
certify-pythonranpython3 -m unittest python/tests/test_pipe.pyfrom the repo root, which cannot importdcf.pipe. It would have failed on the first hosted run; it now runs frompython/.certify-pythonalso byte-diffs everypython/MCP/*_vectors.jsonagainstDocumentation/(17 families, including golden/audio/pm_param, which were not checked before). - The SKIPs are missing toolchains on this host, which has no nix, lua, sbcl, ghc/cabal,
kotlinc, swift or wasm-pack. For the last nix-backed results see the 2026-07-25 section
(lisp/java/kotlin/haskell) and 2026-06-18 (lua).
certify-wasmhas never run locally. - Partial steps: numpy was pip-installed on the host for this run, as CI does. The
mcppackage could not be installed because of a conflict with Debian's PyJWT, so thewirelab_mcp --selfteststep did not run.certify-snakeskipped buildingsnake_source/snake_mixerbecauseDEMOD_IPC_INCLUDEis not set, which also happens on the CI runner. Durations of 0s come from warm cargo/go caches. - The tree had uncommitted changes because other work packages were landing at the same time (medium vectors 156→162, hydramodem comments, CMake option cleanup).