rosett-ai 1.5.9 → 1.5.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29a816be5fea64d709f477070a052b5b595a13f74c1f77507a17f7f175a87972
-  data.tar.gz: ca13bcf8795e23edb27c19c27f2b5f90355159f1688f5a40c05e88c45331afd9
+  metadata.gz: 9fc2d403485de8a1af9034d9f7bf19e7545620406b691b0c917e6e360ad9e56b
+  data.tar.gz: 89a8c039303808bed9f592e0f17d4478ffc87d34f129006a5981651c80bf82ac
 SHA512:
-  metadata.gz: fa098e5c74b48e50337278e7a6e8f59a37c4a26d916466d573426882e5aa8b139680d68d9e5d48e5975bfba36f016b6d684716cf829d910fdc85698469f6774a
-  data.tar.gz: 4951940f5dc9d20cd28f0dc648a2f004c69c7ec8bce406191c91819736e8faae92a51b6393d881fc9a1b511ef555fb77dc3181c65273aedaa866cdb8f731e535
+  metadata.gz: 0254e2ea9ea0e3261863ec052e8987e8c45a645de615e9fd266a0ce6d861f90ce04f3c1b3f08ad4c9adc9e17fec951b026c4d01a24446dc69b6597aa7c97f7ed
+  data.tar.gz: c201357a747fa445901851484a17bbd5398b3be363bbbecaf8791a120768974a12b34c1a5cedc4173f6990b3ef470418c4ad818168537fdf176f2c2efda3f57e

data/CHANGELOG.md

@@ -6,6 +6,21 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.5.10] - 2026-07-08
+
+### Security
+
+- **publish:gem CI gate hardened** — `publish:gem` now declares `needs:` on
+  `audit:artifact`, `package:smoke-test`, and `package:gem-smoke-test` in
+  addition to the existing `audit:gem` gate. Gem publication is blocked until
+  both the `.gem` and `.deb` artifact audits pass and the install-parity smoke
+  tests succeed. Closes the DAG gap that allowed v1.5.9 to publish the gem
+  past failing audit and smoke-test jobs.
+
+- **publish:deb-push-aptly CI gate hardened** — adds `package:smoke-test`
+  to the existing `needs:` list so `.deb` publication is also blocked until
+  the postinst smoke test passes.
+
 ## [1.5.9] - 2026-07-06
 
 ### Security
@@ -13,7 +28,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - **audit:gem CI gate** — adds a standalone `audit:gem` job (allowlist,
   denylist, PII scan, gitleaks) wired as a `needs:` dependency of
   `publish:gem`. Closes the DAG gap that let v1.5.8 publish without any
-  security verification (WP#3248).
+  security verification.
 
 ### Added
 
@@ -22,8 +37,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   subcommands load without `LoadError` or `NameError`.
 
 - **test:mutant:full** — full-suite mutant gate on `v*` tag pipelines;
-  `allow_failure:true` until surviving mutants are resolved (WP#3248 P1
-  baseline ~596 survivors).
+  `allow_failure:true` until surviving mutants are resolved
+  (baseline ~596 survivors).
 
 - **sec_016 behaviour rule** — codifies the requirement that every publish
   job targeting a public registry must declare both an artifact-audit gate

data/lib/rosett_ai/thor/tasks/build.rb

@@ -89,7 +89,7 @@ module RosettAi
           '.project', '.rosett-ai',
           # Dev-only documentation (not needed at runtime)
           'doc/api', 'doc/reference', 'doc/context', 'doc/issues',
-          'doc/decisions', 'doc/changes',
+          'doc/decisions', 'doc/changes', 'doc/design',
           # Security advisories — internal, never ship publicly
           'doc/security',
           # Design docs — carry internal WP refs, not runtime-required
@@ -444,13 +444,24 @@ module RosettAi
         # -- gem installation --------------------------------------------------
 
         def install_gems!
-          spinner = build_spinner('Installing gems (deployment mode)...')
+          spinner = build_spinner('Installing gems into embedded gem home...')
+          ruby_abi = query_embedded_ruby('RbConfig::CONFIG["ruby_version"]')
+          gem_home = staging_embedded.join('lib', 'ruby', 'gems', ruby_abi)
+          FileUtils.mkdir_p(gem_home)
           embedded_bundle = staging_embedded.join('bin', 'bundle').to_s
 
-          env = embedded_env
+          # Install runtime deps directly into the embedded Ruby's own gem home.
+          # The embedded ruby finds them by default (via GEM_HOME) with no wrapper
+          # env vars or bundler/setup at runtime — proving genuine self-containment.
+          env = clean_env.merge(
+            'PATH' => "#{staging_embedded.join('bin')}:#{HERMETIC_SYSTEM_PATH}",
+            'BUNDLE_GEMFILE' => staging_app.join('Gemfile').to_s,
+            'GEM_HOME' => gem_home.to_s,
+            'GEM_PATH' => gem_home.to_s,
+            'LD_LIBRARY_PATH' => staging_embedded.join('lib').to_s
+          )
+
           cmds = [
-            [env, embedded_bundle, 'config', 'set', '--local', 'deployment', 'true'],
-            [env, embedded_bundle, 'config', 'set', '--local', 'path', 'vendor/bundle'],
             [env, embedded_bundle, 'config', 'set', '--local', 'without', 'development test build desktop engines'],
             [env, embedded_bundle, 'config', 'set', '--local', 'jobs', jobs_count.to_s],
             [env, embedded_bundle, 'install']
@@ -462,8 +473,8 @@ module RosettAi
             spinner.error(Rainbow(' failed').red)
             log_bundle_debug(env, embedded_bundle)
             abort_build(<<~MSG.chomp)
-              Gem installation failed.
-                The embedded Ruby bundler could not resolve or install gems.
+              Gem installation into embedded gem home failed.
+                The embedded Ruby bundler could not install gems into #{gem_home}.
                 This usually means Bundler environment variables from the parent
                 process leaked into the build. Check the build log for details.
             MSG
@@ -492,8 +503,8 @@ module RosettAi
         end
 
         def collect_build_artifacts
-          Dir.glob(staging_app.join('vendor', 'bundle', '**', '{gem_make.out,mkmf.log}')) +
-            Dir.glob(staging_app.join('vendor', 'bundle', '**', 'ext', '**', 'Makefile'))
+          Dir.glob(staging_embedded.join('lib', 'ruby', 'gems', '**', '{gem_make.out,mkmf.log}')) +
+            Dir.glob(staging_embedded.join('lib', 'ruby', 'gems', '**', 'ext', '**', 'Makefile'))
         end
 
         def remove_artifact(path)
@@ -523,15 +534,6 @@ module RosettAi
         # 1. Unsets all Bundler/RubyGems vars inherited from `bundle exec`
         # 2. Sets PATH to prefer the embedded Ruby
         # 3. Points BUNDLE_GEMFILE at the staging app's Gemfile
-        def embedded_env
-          env = clean_env.merge(
-            'PATH' => "#{staging_embedded.join('bin')}:#{HERMETIC_SYSTEM_PATH}",
-            'BUNDLE_GEMFILE' => staging_app.join('Gemfile').to_s
-          )
-          log_to_file("embedded_env: #{env.inspect}")
-          env
-        end
-
         # Strips all Bundler/RubyGems variables. When passed to system(),
         # nil values cause the variable to be unset in the child process.
         def clean_env

data/lib/rosett_ai/version.rb

@@ -5,5 +5,5 @@
 
 module RosettAi
   # @return [String] Current version of the rosett-ai gem.
-  VERSION = '1.5.9'
+  VERSION = '1.5.10'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rosett-ai
 version: !ruby/object:Gem::Version
-  version: 1.5.9
+  version: 1.5.10
 platform: ruby
 authors:
 - Hugo Antonio Sepulveda Manriquez