rdmpw3275m-changelog-20260911-1821-tyrell-build19-canary-launched
rdmpw3275m-changelog-20260911-1821-tyrell-build19-canary-launched
Tyrell Build 19 was independently reviewed, signed, notarized, and
launched only on the designated rdmbair15m5 canary under a
corrected physical-footprint gate and exact Build 15 rollback
protection.
Scope
- Coordinator and independent verification host:
rdmpw3275m. - Canonical source, signing, integration, and release owner:
rdmsm4x. - Designated canary:
rdmbair15m5only. - Fleet expansion: not started and not authorized by the canary guard.
- Local
agyexecution: unchanged; no process was launched.
Source and issue state
ISSUE-20260905-23remains the existing Tyrell high-memory issue.- Distinct release-gate defect
ISSUE-20260911-15records the incorrect use of aggregate RSS as the charged-memory pass/fail field. - Exact Build 18 replay and clean-versus-dirty controls showed that high RSS can be dominated by reclaimable allocator and SQLite backing while physical footprint remains much lower. Build 18 remains rejected and was not retroactively accepted.
SyncEngine.sync()loaded up to ten million records before an unchanged/no-missing early return. Commite14041amoved that idle fast path ahead of full materialization while preserving outstanding-blob retry.- Build 19 source commit
ec036973cff969447292c1fb7ebef9916dfcb14cmerged via PR 29 ata34089e. - Physical-footprint gate commits
f47d51a,da9e082, and06cec6dmerged via PR 30 at canonical/fleet/backupmaincommitb661740687f8a2d7aafcbd0a971bd210c06d1f8e.
Independent verification
- Fresh coordinator rerun: 11 pure memory-gate tests, 3 synthetic guard-flow tests, 3 dependency-packaging tests, and the real staged dependency preflight all passed.
- The corrected gate rejects missing/nonfinite measurements, sample gaps greater than 90 seconds, changed PID, same-PID process-start reuse, executable/path/hash drift, endpoint loss, stale permission data after warm-up, descriptor drift, charged-memory bounds, and growth limits.
- Delayed rollback rechecks the pinned dependency closure; exact 300 MiB, 400 MiB, and 0.20 MiB/min values are read from the reviewed policy.
- All six executable dependencies existed and matched their recorded SHA-256 values.
- Independent review accepted the final gate package for canary use only. This did not confer runtime or fleet acceptance.
Canary state
- Stage:
/Users/richh/.tyrell/build19-canary-20260911-ec03697onrdmbair15m5. - Guard PID:
69716. - Daemon PID:
69804. - Process start:
Fri Sep 11 18:18:18 2026. - Guard start epoch:
1789165099.8843231. - Earliest six-hour-after-warm-up gate: epoch
1789187299.8843231, approximately2026-09-12 00:28:19 EDT. - Required 24-hour boundary: epoch
1789251499.8843231, approximately2026-09-12 18:18:19 EDT. - Exact daemon SHA-256:
03e365cec1b8219b3d4cc12384b42313936b850748a97727366e6595f4ee390bat/Users/richh/Library/Application Support/Tyrell/releases/daemon-03e365cec1b8/tyrelld. - Exact app executable SHA-256:
cfb51c67602f9cf6047e4b6bf609ee1a5e24fe99d907269fcf0548d7c5c2c072; combined CDHash933b995d29644a80e6e3b40721a98fb0f2984e07f9db70f978ed8064f16f6563; bundle build19. - Deployment wrapper exited
0. - Authenticated app functional probe passed current fleet usage plus
chat send/page/command; evidence SHA-256
3c4e5b3408b352513640d355e45a5700332e7cb0a0ac52ee0d8f6e1ed0d51ed7. - Initial retained warm-up sample: physical footprint
358434256bytes, peak554419712bytes, RSS677792 KiB, CPU27.8%, 43 lsof rows, 2 TCP descriptors, both status planes HTTP 200, and all 16 permission probes HTTP 200. - A later direct check found the same daemon at about 55 MiB physical footprint with both status planes HTTP 200. Startup observations are retained but excluded from steady-state slope/bound calculations under the predeclared policy.
Rollback and undo
- Exact signed universal Build 15 daemon SHA-256
dbc440bd54b85a54dd6c4150b23b3e508bff7d8d8080687d81b9ba7ac2cbbcf0and the prior Build 17 app are snapshotted in the canary stage. - Any real guard breach automatically restores those exact predecessors and records a fail-closed state.
- Do not manually stop the guard or reinstall Build 18. A deliberate rollback must first verify the exact stage-owned guard command and avoid racing the guard.
- No other fleet host received Build 19.
Durable coordination
- Monitoring takeover acknowledgement: fleet-bus message
20260911-181951-D303D56F. - Independent gate acceptance receipt:
20260911-181659-4D43EC36. - Canonical tickets
ISSUE-20260905-23,ISSUE-20260909-12,ISSUE-20260911-01,ISSUE-20260911-15, andTASK-20260911-01were updated with bounded evidence. - Heartbeat automation
finish-tyrell-build-16was renamed and updated to follow Build 19 through the six-hour and 24-hour boundaries while continuing the localagyreceipt monitor.
Outstanding work
- Maintain exact same-PID, same-process-start, exact-artifact, endpoint, permission, physical-memory, RSS/category, CPU, descriptor/socket, and inventory evidence through the 24-hour gate.
- Require one complete inventory and an unchanged repeated inventory before acceptance.
- After a passing 24-hour state, independently reproduce the receipt, run a fresh app functional canary, and prove stable-path continuity across a coordinated reboot.
- Only after those gates may the exact accepted Build 19 artifacts be
installed on
rdmpw3275munder rollback protection and considered for a staged fleet rollout. - Continue monitoring completed local
agyparents for explicit canonical accept/reject/integration receipts; do not rerun them without a genuinely unfinished parent or a real provider quota-reset event.