* File format families: drawings share the design format's versioning (#3890)
The format code works for a family of files: its own tag, its own numbers and
its own folder of change files, with one reading of a file's format, one
refusal of a file a newer build saved and one upgrade for every family. Designs
(solidcraft/N) are one family and keep everything they had: FORMAT and FORMATS
are as they were, and pending_names, format_string, version_of and read mean
what they did. Drawings (solidcraft-drawing/N) are the other, with format 1 as
their first record and each later change one file in
crates/doc/src/drawing/format/pending/, as design changes are. Nothing saved
changes.
A design tag never reads as a drawing's or the other way round, and a file that
names no format is a design from before format strings, never a drawing. Every
refusal names its family; a design's read word for word as before. A design
listing a pending change this build doesn't have is now refused as a newer
build's before its content is checked, as a newer number already was, so a
newer build's fields never read as damage. The list reader is
take_names(v, key, noun), the shape #4811 uses for its own list.
For the maintainer, the release step changes: scripts/fold-format-pending.sh
now folds every family that crates/doc/build.rs lists (FAMILIES), each into
its own next number: designs into crates/doc/src/format/v<N>/ as before,
drawings into crates/doc/src/drawing/format/v<N>/ from 2. With nothing pending
in a family it says so and moves nothing. Its test folds a drawing change into
v2 beside the design changes. docs/releasing.md, CONTRIBUTING.md and AGENTS.md say so.
build.rs lists each family's changes from its own folder, each folder's
versions contiguous from its own base.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drawing record: format 1 of the drawing family (#3890)
A drawing is now a record of its own (crates/doc/src/drawing.rs): its name,
the designs it draws (sources: an id and the design file's path, relative to
the drawing's folder as a linked design's is), its properties under the design
metadata's rules, its units (each design's own, or one length unit of the
expression unit table), its content language (a BCP 47 tag) and its sheets.
A sheet holds its paper, a copy of its drawing border's profile, the
resolution its pictures are rendered at (300 dpi unless it says, 25 to 2400),
the component it documents and whether it is left out of the sheet count or
of printing. This is format 1 of the drawing family; each later kind of
record adds one file in crates/doc/src/drawing/format/pending/.
The rules: one id counter for every object, raised above the largest id when
a file is read and never rewound; every reference is an id that must resolve,
or the file is damaged and refused, never patched; 1 to 1,000 sheets, at most
64 sources, names of 1 to 256 bytes, paths of 1 to 4,096 bytes without NUL.
The same drawing always saves as the same bytes.
Drawing::from_json reads at most 16 MiB of text, then runs the family's format
check, the number check, the upgrade, the typed record (unknown fields refused
everywhere) and Drawing::validate. The number check is now one function every
family calls, Family::check_numbers, told which field holds other tools' data;
a design's refusals read as before.
Nothing saves or opens a drawing yet: the container is the next step.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drawing ids: random and collision-free from format 1 (#3890)
A drawing's objects now take random ids, the form jyviko chose on #3890 from
#1017: no counter, so objects added on two branches never share an id and
never edit one line. The allocator is one module for drawings now and designs
later (#626 Phase 3), crates/doc/src/ids.rs: an IdSource gives nonzero u64s by
splitmix64 from a seed, each checked against the ids in use and drawn again
when it is one, or when it is 0. A run never draws a number twice, so at most
one draw per id in use comes before a free one, and a seeded run over a file
the same seed made still gets a new id. IdSource::seeded gives the same ids
for tests and replays; IdSource::from_entropy seeds a session from the
standard library's hash keys, the time and a count, with no new dependency.
In a file an id is 13 characters of Crockford base32, lowercase
(0000000000001 to fzzzzzzzzzzzz): ids::encode writes it and ids::decode reads
only that spelling, case-sensitive, so an id has one form to search for.
Anything else, 0 included, makes the drawing damaged. The drawing loses
next_id (a file that holds one is refused), and Drawing::new and allocate_id
take the IdSource. Messages name ids as the file writes them. The component a
sheet documents stays its design's own number until designs move over.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drawing record: a drawing too large to reopen isn't saved (#3890)
from_json reads at most MAX_DRAWING_BYTES (16 MiB), but to_json had no limit. Other tools'
properties are kept as they came, and indenting them can grow a drawing read in at about 4 MB
past 16 MiB (two million zeros in one array), so the next read refused what the save had just
written. 0xlillith found it in review of #3891.
to_json now returns a Result and refuses JSON longer than a read takes ("drawing too large to
save (at most 16 MiB)"), so every drawing saved opens again. Nothing writes drawing files yet, so
the error reaches the future file writer before it publishes anything.
Test: that case is refused, and a smaller compact drawing saves and reopens unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Drawing files: a drawing saved as a container or as plain JSON, never read as a design (#3890)
K3 of the drawing storage plan (W11.2): the file a drawing is saved in. Nothing writes one from a
command yet; opening and saving come with K5.
- A drawing container is a design container holding `drawing.json` (Deflate, as `document.json`)
in place of `document.json`, and `container.json` says so:
{"content": "drawing", "format": "solidcraft-container/1"}. A design's `container.json` is as it
was, with no `content`. The plain JSON form is the drawing's own text. Both give the same bytes
every save, so a drawing can live in version control as text.
- `io::file_kind` tells a design from a drawing by `container.json` or by the JSON's format. The
design reader refuses a drawing ("this file is a SolidCraft drawing, not a design: open it as a
drawing") and the drawing reader a design; plain JSON only asks when it isn't a design, so
reading a design costs nothing more. A container's content this build doesn't know, or a drawing
container that also holds a design's `document.json`, is refused.
- `read_drawing` (bytes, either form), `read_drawing_file` (one seekable handle, the design
reader's checks) and `write_drawing_container`; `DRAWING_EXT` (`scdwg`) and
`is_drawing_path` beside the design's.
- The container writer's set-up and finish, the file opening and the container sniffing move into
one function each, which designs and drawings both use. The container's own checks (budgets,
entries, the ZIP directory) are the design container's, word for word.
Tests: a drawing round-trips through both forms byte for byte, and the container holds exactly
`container.json` and `drawing.json`; `file_kind` on both forms of both kinds; each reader refuses
the other's file; unknown content, a stray `document.json`, a missing drawing, an unknown
container version and a damaged drawing refused; both forms from disk, and a directory refused;
mutation fuzz of both forms (an error or a drawing, never a panic).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
While a new geometry kernel is evaluated, a workflow labels new issues, pull
requests and discussions about kernel work kernel-paused, so a maintainer finds
them and answers in person. A pull request counts when it changes
crates/kernel/ or vendor/truck*, anything else when its title names a kernel
operation. Crash and data-loss reports and anyone who can push are left alone.
CONTRIBUTING.md says so.
Claude-Session: https://claude.ai/code/session_01LGeCa5jWWdroMWvXxN3LLM
Co-authored-by: jyviko <2501648+jyviko@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Spike: typed parameter contracts and JSON Schemas for solid.box and solid.extrude
The schema RFC's spike (plan/schema-spike.md). solid.box and solid.extrude get
typed contracts with generated JSON Schemas (2020-12), checked in front of the
unchanged handlers by a per-session level: off (the default, which changes
nothing), warn (the call runs and gains param_warnings) or strict (the call is
refused and the design left alone). Also engine.describe and the MCP tool
describe_command, `solidcraft-cli mcp --param-check off|warn|strict`, a
FeatureResult type for feature replies, and an env-var audit recorder
(SOLIDCRAFT_PARAM_AUDIT) used to check the contracts against every test.
Local spike branch; not for upstream as is (see the results report).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Parameter contracts: put the audit recorder behind a feature; drop two ignored test keys
The audit recorder is now on only in a build with the engine's `param-audit` feature
and `SOLIDCRAFT_PARAM_AUDIT` set. Its code is still compiled, linted and tested without
the feature. `scripts/param_audit.py` summarises a test run's audit logs, and the schema
module's docs give the steps for converting a further command.
Two tests passed keys their command ignores, which the audit found: `position` on
`solid.box` (`hole_face_tests.rs`) and `symmetric` on `solid.extrude` (`face_tests.rs`).
Both are removed, so the tests build what they always did. Comments no longer call
the contracts a spike.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: bherbruck <brennen.herbruck@gmail.com>
From the review: git patch-id --stable ignores whitespace, so a conflict resolution that only
respaced the change (inside a string, or Python indentation) counted as no change and was
carried; --verbatim compares every byte. And a passing run is now taken only from this pull
request (by number, or for a fork, where GitHub lists none on the run, by head repository and
branch), not from another pull request with the same head commit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
From the review of this PR:
- What counts as code lives only in scripts/ci/affected.py now: nothing selected and not full
means no code changed, on pull requests and pushes to main alike. The untested bash copy in
Select checks disagreed with it. Root files and folders a crate embeds now select that crate
(the licence texts and NOTICE: the engine; skills/: the MCP server's tests), where before a
change to them ran no test at all. Other workflows and the bots' scripts select nothing.
- A push to main skips the native jobs only when nothing a build reads changed since the last
push to main whose run passed. Comparing with the push just before was unsafe: a newer push
cancels a waiting run, so that commit may never have been tested.
- Fail fast applies to pull requests only. On main, nightly and Run workflow the test build and
the shards run regardless of the repository checks, so the action matrix and property tests
that hang off Build tests keep their signal. Doc tests (main and nightly only now) no longer
wait for the checks.
- tests/robustness/ turns on the goldens, so a change to goldens.json runs the seed tests.
- tests/oracle/ no longer selects the kernel, which never reads it.
- The workflow header and CONTRIBUTING describe what main and pull requests now run.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
A change that merged main twice in a row ran the full set on every other push: the change before
the second merge was itself a carried run, its shards skipped, so it had no passing shards to
carry. The script now walks down the first parents through consecutive merges of main that kept
the change's patch (each equal to the next), at most 10, to the run where the shards ran.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
Merging main into a pull request (Merge branch 'main', or GitHub's Update branch) restarted the
whole run. Over three days 1,241 such merges started 966 runs and about 21,000 runner-minutes, and
872 of the merges brought in nothing that touched the pull request's files. Select checks now
recognises the case (scripts/ci/main_merge.py): HEAD is a merge whose other parent is on main, the
change's own patch is unchanged (git patch-id), and a ci.yml run of the change before the merge
passed with its test shards. Then only the repository checks run, the ci job names the passing run
in its summary, and main tests the merged result after it lands. Anything else, or any doubt,
runs the full set as before.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
- Pushes to main use the same code/no-code rule as pull requests (`touches_code` in Select
checks): a push changing only documentation, packaging, other workflows or the bots' scripts
runs the repository checks only. With the merge queue off, every push to main ran the full suite
and the Windows jobs, docs-only ones included.
- affected.py: test data under tests/ selects the packages that read it (robustness, hole matrix,
projection, taper: solidcraft-engine; oracle: the CLI, the kernel, xtask; action matrix: the
CLI, the engine, xtask), and a vendored crate the packages that use it (truck: the kernel and up;
egui-wgpu: the UI and the apps), instead of the whole workspace. tests/tools and unknown vendored
crates still select everything.
- Docker (the web app image) skips pushes touching only docs, test data or bot scripts; Pages skips
test data and bot scripts; Generated files runs only when the manifests, lockfile, command
registry, CLI or xtask change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
assets/locales/ belongs to no crate, so affected.py selected the full
workspace (every crate, all four test shards) for a catalog-only PR. Only
solidcraft-ui-egui embeds the catalogs and xtask checks them; map the folder
to those two packages and their dependents.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
On the self-hosted-fast runners /proc/meminfo isn't readable, so awk exited 2 and failed every
job the sizing step runs in (Doc tests on #2509 and #2510, on minisforum-fast-2 and -3) before
compiling anything. Sizing is an optimisation: without a readable memory figure (meminfo or a
numeric cgroup limit) the script now sets nothing and Cargo keeps its default. Also drops
`set -e`, so no other probe can fail the job.
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
Co-authored-by: jyviko <2501648+jyviko@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Build tests on the untrusted runners (fork PRs, gVisor on shared boxes) fail intermittently with
rustc killed mid-crate ("exit status: 2", no diagnostic) on the biggest crates: solidcraft-engine,
ui-egui. Nothing limits Cargo's parallelism, so it starts one rustc per core the sandbox reports.
scripts/ci/build-jobs.sh sets CARGO_BUILD_JOBS from the memory available (and the cgroup limit,
where lower) at 3 GB per job, capped at nproc, and logs the numbers it saw.
Claude-Session: https://claude.ai/code/session_01QWhMwdqJYQKQq8RCLSL1LT
Co-authored-by: jyviko <2501648+jyviko@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Clippy, the doc tests and test shards 1-2 of pushes to main and merge-queue
groups run on the self-hosted runner, alongside GitHub's runners for
everything else. Pull requests, the nightly run and Run workflow stay on
GitHub's runners. Clippy and the doc tests keep warm build directories
outside the checkout (scripts/ci/warm-target.sh).
The test archive is still built on GitHub's runners: the self-hosted
machine has a newer glibc, so binaries built there don't start on
ubuntu-24.04.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Comment /claim on an issue to be assigned and get the in progress label; /unclaim releases it. A daily sweep frees claims with no PR after 72 h or with a PR idle for 14 days.
A PR that saves something new adds crates/doc/src/format/pending/<name>.rs (a note, and an upgrade step if older designs must be rewritten). The build writes the next format number while changes are pending and lists them in format_pending; scripts/fold-format-pending.sh fixes them as v<N>/ at release time. Formats 23 and 24 move into v23/ and v24/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Clippy, the test archive and the test shards cover the packages a PR changes plus their dependents. Main, nightly and manual runs stay full.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
CamWight