The rules lived only in the local commit-msg hook, which CI and other clones do not have, so autorun could only check a subject's shape there. scripts/commit_rules.py now holds them, the hook calls it, and autorun checks every job subject with it when the job list loads.
Written by campaign.py from its rule table: six upper-case .BIN names the core opened for scph5501.bin, and evidence for hle_fallback, with the record ids of measurements/beetle_psx.jsonl.
First real pass of campaign.py: the libretro PlayStation profiles with an hle_fallback claim (beetle_psx through mednafen_psx and mednafen_psx_hw, pcsx_rearmed and swanstation nightlies, pcsx1 built from its pinned commit), each run on Bust-A-Move 2 - Arcade Edition (USA) with and without scph5501.bin, under bubblewrap. Every core reached the game without the BIOS.
Host git only fetches into bare mirrors no sandbox ever sees, https only, with no user or system config and overrides emptying hooks, fsmonitor, ssh and proxy commands and every filter driver the mirror defines. Each build is a git archive of the commit and of each submodule commit from its own mirror. Old working-tree clones are deleted. The core copied out must be a regular file inside the build folder, opened without following links.
make runs on a git archive export of the commit and its submodules, the clone and its .git never bound into the sandbox. Host-side git runs with no user or system config, no hooks, no fsmonitor and the file and ext transports refused.
Without a working bubblewrap the pass is refused and nothing third-party runs, probes require the sandbox and builds are refused, unless --allow-unsandboxed is given. A job report holding an alert raises an autorun alert.
bwrap now binds only /usr, the /lib* and /bin links and the files of /etc the loader, fonts, TLS, the clock and user lookups read. Home, /tmp and /mnt are empty, the core, content and staged system directory read-only, the scratch folder the one writable path, every namespace unshared. --require-sandbox refuses to run without it. The worker imports nothing from the repository.
Values a run produced (core output, romfetch errors, profile names) are written as character references inside <code> or as plain text, so backticks, MDX braces and HTML stay text.
core_probe starts its worker with only the --env values, the worker clears its own environment before loading the core, and a working bubblewrap runs it with a read-only tree, no network and the user's credentials masked. The record names the isolation used. A timeout kills the whole process group. campaign.py starts core_probe, git, make and romfetch with the allowlist, make inside the same sandbox. --record refuses a folder that is not a checkout root.
Every step, gate and recomputation runs with an allowlisted environment (PATH, HOME, LANG, LC_*, TZ, TMPDIR and the variables its env: key names). Names holding TOKEN, SECRET or PASS are dropped and refused in the registry. Only the push and the gh calls that read CI get GITHUB_TOKEN.
With COMMAND_AUTH_DEVICE and COMMAND_GET_AUTH reading CR2, beetle_saturn 2ce77e2 authenticates the Video CD Card on Lunar - Silver Star Story MPEG: MPEG.AuthState is 02 with the HSS-0119 and the MK-80310 images, 00 with no file. The full machine state differs between two identical repetitions, the authentication state does not.
campaign.py takes buildbot nightlies (or a build of the pinned commit), the test content of tests/campaign/content.yml through romfetch, and runs core_probe for the files, boot, path, alias, variants and bench checks. A fixed rule table settles hle_fallback, required, path and aliases with the record ids as evidence, the rest goes to measurements/findings.jsonl. Resumable state, load, disk and budget guards, retries, content reference counting with an LRU cap, and an autorun job after the nightly.
The copy shipped first was the European MK-80310 Video CD card (its header reads VIDEO CD PLAYER PAL MK-80310, version 1.105). Lunar Silver Star Story MPEG, the Saturn game that needs a card, names the Movie Card, so the Japanese HSS-0119 (V1.102) now leads and the MK-80310 stays as a variant. No emulator tested reads the card's content today (records in measurements/beetle_saturn.jsonl), and no platform pins a hash for this file. Issue 85.
The runner carried its own copy of the refused vocabulary, which put those words in a tracked file. It now runs the commit-msg hook on each job's subject when the job list loads, and checks only the shape where no hook exists.
Runs the jobs of automation/jobs.yml under one host lock, with load and disk guards, one idle retry on a host misread, artifacts computed twice, explicit-path commits in .cache/autorun/worktree, an opt-in push (--push) and a CI circuit breaker. First jobs: nightly refresh chain, large-files asset dry run, disk cleanup and check, weekly bios integrity. install-timers writes systemd user units without enabling them.
Rehashes every file database.json names. A confirmed mismatch on a committed file git sees as unmodified is restored from its HEAD blob after the blob is checked, then hashed again. Gitignored files are flagged only.
Uploads the large-files assets check_release_assets reports out of date, only when the SHA-1 read twice equals database.json. Dry run by default, the release description is never edited.
Tracked form of the private worktree and tmp cleanup: busy, recent and modified worktrees are kept, branches stay, tmp/acquire and bundles stay, and an entry holding a worktree is left to the worktree rule. Exit 1 under --alert-gb free.
--findings FILE takes a check_freshness.py --json report written earlier, kept to the --only areas, so one full check can drive a refresh of a few areas.
The TERM probe test answers the setup question, first-install keeps
its button name on one line and under 400 words, and --page of the
installer doc script is named on the page.
Each line of measurements/<emulator>.jsonl now holds the whole run:
every repetition, core logs, per-frame hashes and raw timings. The gzip
data files, the data schema and the split and join code are gone, and
core_probe --record appends one line. record_version moves to 3.
The seven records are rewritten once: each new line equals its old line
joined with its data file, and rebuilds the first-layout file its id
hashes.
Answers code_audit_16 and tui_audit_9: share drives give their bios
folder, card markers stop at mount points, a model finds its family,
the folder question quits on q, pages move by the rows drawn, and a
folder the installer proposed is created without the guard.
scripts/generate_installer_doc.py rewrites the marked tables of
wiki/installer.md: options from build_parser(), events from EVENT_KEYS,
exit codes from the sys.exit calls, RETROBIOS_PAD values and the keys of
each route from TUI_ROUTES, the one table the bar, the help and the stop
line now read. Prose cells are kept, a row the code gains stops the
script until its text is written, and --check runs in the tests. The
site drops the markers.
The full screen falls back to the line questions where the terminal's
terminfo moves no cursor the ANSI way (vt52, glass terminals), and --tui
names why. The line mode draws no escape code with TERM unset, dumb or
such a terminal. Ctrl-Z typed on the screen stops the run as SIGTSTP
does, the terminal handed back and redrawn on fg. A window too small
names 40x12 and its own size.
Pty tests check the modes, the cursor and the main screen after Ctrl-C,
Ctrl-D, SIGTERM, SIGHUP and Ctrl-Z then fg. Tests from a mutmut run over
the device filter, the card bounds and the WSL paths raise its score
from 62/71 to 71/71. The parser lists its options in the page's order,
with NAME, PATH, NAMES and N as arguments.
The site compiles the index and the SQLite files from measurements/
instead of a pinned clone. The pin, the sync script, the CI clone steps,
the freshness area and its refresh handler are gone. core_probe --record
writes into measurements/ of the checkout by default, and a test fails
when a line or data file HEAD holds changed or vanished.
The seven core probe records move from Abdess/retrobios-measurements at
75e878143687 into this repository, copied byte for byte: one .jsonl per
emulator and a gzip data file per record. merge=union lets two branches
that each add a line merge.
First install says where a device name is typed. The key table gives each
pad route its buttons, the --plain claims match the parity work, and the
error event, exit code and --dest rows name the card refusals.
Line mode finds mounted cards, shows its menu and names the folder for a
pack, asks the folder instead of taking a default, and lists setups in the
screen's order. Devices have one spelling each, matched without case,
spaces or punctuation, and a device several systems run lists them all.
--tui --dest reads a card as --plain does. Card boundaries read every
parent up to a mount point from mountinfo. --offline with --yes counts the
files it leaves out as pending, never as failed. The P3 points of
code_audit_15 and tui_audit_8 follow.
Abdessamad Derraz