feat(agent-image): make the entrypoint FOD hash and native-addon copy per-system (RIG-3749) - #1195
Open
rigel-mintaka wants to merge 3 commits into
Conversation
rigel-mintaka
added this pull request to stack #1196
September 12, 2026 23:53
|
Compass engineering docs preview: https://compass-native-rig-3749-entr.compass-eng-docs.pages.dev Deployed from |
… per-system (RIG-3749)
The agent container only built on x86_64-linux: `nodeModules.outputHash` was a
single x64 value, and the bundle copied `pi-natives-linux-x64`'s two AVX2
variants by name. An aarch64 build fails at the fixed-output hash, and again at
the `cp` — the x64 natives package is cpu-gated in bun.lock, so it is not
installed on arm64 at all.
Both the hash and the addon set now come from one per-system record keyed by
`pkgs.stdenv.hostPlatform.system`, following the shape of
`tools/toolchain/versions/bun.nix`. The addon list is generated, not a fixed
pair, because the file count differs by arch: x64 ships
`pi_natives.linux-x64-{modern,baseline}.node` (the loader picks by AVX2, which
is x86-only) while arm64 ships a single unsuffixed `pi_natives.linux-arm64.node`.
An unsupported system throws by name rather than falling back to a wrong hash.
x86_64-linux is unchanged in effect: same hash, and the generated copy shell is
byte-identical to the three lines it replaces.
The aarch64 hash is `lib.fakeSha256` in this commit. The arm64 build spike
reports the real value and it lands before this leaves draft.
Co-authored-by: Matt Wilkinson <matt@rigel.build>
The comment named a development task rather than the mechanism, which reads as stale once that task is merged. Describe what replaces the value instead. Co-authored-by: Matt Wilkinson <matt@rigel.build>
Replace the placeholder with the hash an aarch64 install actually produces. Measured on two hosts with different arch and bun version, each carrying a positive control that reproduces the committed x86_64 hash: x86_64-linux, bun 1.4.0 x64 sha256-JbgM44... (matches) / arm64 sha256-asK46R... aarch64-darwin, bun 1.3.13 x64 sha256-JbgM44... (matches) / arm64 sha256-asK46R... The arm64 tree carries one addon, pi_natives.linux-arm64.node, confirming the single-entry addon list. The x86_64 fixed-output derivation is the same store path before and after this change. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-native/rig-3749-entrypoint-per-system
branch
from
September 13, 2026 21:50
b867a88 to
46c9e16
Compare
rigel-mintaka
marked this pull request as ready for review
September 13, 2026 22:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 2 PRs:
mainThe agent container only built on x86_64-linux:
nodeModules.outputHashwas asingle x64 value, and the bundle copied
pi-natives-linux-x64's two AVX2variants by name. An aarch64 build fails at the fixed-output hash, and again at
the
cp— the x64 natives package is cpu-gated in bun.lock, so it is notinstalled on arm64 at all.
Both the hash and the addon set now come from one per-system record keyed by
pkgs.stdenv.hostPlatform.system, following the shape oftools/toolchain/versions/bun.nix. The addon list is generated, not a fixedpair, because the file count differs by arch: x64 ships
pi_natives.linux-x64-{modern,baseline}.node(the loader picks by AVX2, whichis x86-only) while arm64 ships a single unsuffixed
pi_natives.linux-arm64.node.An unsupported system throws by name rather than falling back to a wrong hash.
x86_64-linux is unchanged in effect: same hash, and the generated copy shell is
byte-identical to the three lines it replaces.
The aarch64 hash is
lib.fakeSha256in this commit. The arm64 build spikereports the real value and it lands before this leaves draft.
Co-authored-by: Matt Wilkinson matt@rigel.build