Skip to content

catalogue: batch mysql 9.7.1 + didit 1.0.0 + orthogonal 0.1.1 + smol tombstone (supersedes #356–#359)#360

Closed
Alexgodoroja wants to merge 1 commit into
mainfrom
catalogue/batch-mysql-didit-orthogonal-smoltombstone
Closed

catalogue: batch mysql 9.7.1 + didit 1.0.0 + orthogonal 0.1.1 + smol tombstone (supersedes #356–#359)#360
Alexgodoroja wants to merge 1 commit into
mainfrom
catalogue/batch-mysql-didit-orthogonal-smoltombstone

Conversation

@Alexgodoroja

@Alexgodoroja Alexgodoroja commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Why one PR

All four open catalogue PRs modify the same two files — catalogue/catalogue.json and the single-line detached signature catalogue/catalogue.json.sig. Merging any one makes the other three genuinely conflict on the signature line, and the branch-protection setting dismiss_stale_reviews_on_push then wipes their approvals on the required rebase. Result: N merges = N re-reviews.

This PR combines all four so the shared catalogue is regenerated and signed once, reviewed once. It supersedes and closes:

PR Change Source of truth here
#359 add io.pilot.mysql 9.7.1 entry + apps/io.pilot.mysql/metadata.json taken verbatim from the PR branch
#358 add io.pilot.didit 1.0.0 entry + apps/io.pilot.didit/metadata.json verbatim
#356 update io.pilot.orthogonal → 0.1.1 entry + apps/io.pilot.orthogonal/metadata.json verbatim
#357 io.pilot.smolmachines → io.pilot.smol tombstone + pilotctl redirect catalogue tombstone entry, deleted metadata, README.md, cmd/pilotctl/* (incl. appstore_rename_test.go) verbatim

Verification

  • catalogue.json regenerated by taking each app entry verbatim from its reviewed branch; diff vs main touches only io.pilot.mysql, io.pilot.didit, io.pilot.orthogonal, io.pilot.smolmachines (+ updated_at). Every other entry is byte-identical.
  • Re-signed once with the release catalogue key; derived pubkey matches the embedded catalogtrust.publicKeyB64 and .sig verifies against the exact committed bytes.
  • All three metadata_sha256 pins verified against the committed metadata.json bytes.
  • go build ./cmd/... passes; #357 rename/tombstone tests pass.

🤖 Generated with Claude Code

@claude
catalogue: batch mysql 9.7.1 + didit 1.0.0 + orthogonal 0.1.1 + smol …
54279ec 
…tombstone

Supersedes #356, #357, #358, #359 in a single PR so the shared
catalogue.json / catalogue.json.sig are signed once and reviewed
once, instead of each merge invalidating the others' signatures.

Combined, verbatim from each reviewed branch:
- add io.pilot.mysql 9.7.1        (#359)
- add io.pilot.didit 1.0.0        (#358)
- update io.pilot.orthogonal 0.1.1 (#356)
- tombstone io.pilot.smolmachines -> io.pilot.smol + pilotctl
  redirect code, README, rename test (#357)

catalogue.json regenerated and re-signed once with the release
catalogue key (matches embedded catalogtrust pubkey). All three
metadata_sha256 pins verified against committed bytes; go build
and the rename tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@Alexgodoroja
Alexgodoroja requested a review from TeoSlayer as a code owner July 8, 2026 00:45
This was referenced Jul 8, 2026
Closed
Closed
Closed
Closed
@Alexgodoroja
Alexgodoroja enabled auto-merge (squash) July 8, 2026 00:47
Alexgodoroja pushed a commit that referenced this pull request Jul 16, 2026
catalogue: consolidate — demos for all 23 installable apps + smol tom…
d1054b5 
…bstone (signed once)

Fold the six sibling catalogue PRs into this one so the catalogue is signed and
deployed once instead of seven times:

- Product demos for the 4 apps that still lacked one — cosift, primitive,
  wallet, slipstream — authored against each app's real method set (validated by
  internal/demo). All 23 installable apps now carry a product_demo.
- Consistency fixes: wallet's metadata had NO methods array (now its 16 methods);
  slipstream had NO metadata page at all (created one). Every installable entry
  is now schema_version 1 with methods + a demo whose skill == the app id.
- Demos for agentphone / bowmark / didit / docker / duckdb (PRs #390–#394) are
  already present here — byte-identical — with main's richer entry metadata kept
  (the sibling PRs carried unenriched entries that would have regressed it).
- Smol rename collapse (from #360): io.pilot.smolmachines replaced with a
  tombstone (renamed_to io.pilot.smol, hidden), its detail page removed, and the
  "Renaming an app" convention documented in catalogue/README.md.
- Every metadata_sha256 recomputed; catalogue.json re-signed once. Verified: all
  23 metadata_url entries' shas match, the tombstone is well-formed, and the
  signature validates against the catalogue trust anchor.
@Alexgodoroja

Alexgodoroja commented Jul 16, 2026

Copy link
Copy Markdown
Collaborator Author

Consolidated into #398 (single signed catalogue). Verified present in #398: the smol rename collapse — io.pilot.smolmachines replaced with the exact tombstone from this PR (renamed_to: io.pilot.smol, hidden: true), its detail page removed, and the "Renaming an app" convention added to catalogue/README.md. The mysql / didit / orthogonal apps carry their product demos in #398 too, on top of main's current enriched entries.

Intentionally NOT applied from this PR (it has no merge base with current main and predates it): the removal of insforge/tldr/primitive (added to the catalogue since), the unenriched entry fields, and a stray pilot-protocol → TeoSlayer fork URL in the README. #398 keeps all three apps and main's enriched metadata. Closing so the catalogue is signed and deployed once.

auto-merge was automatically disabled July 16, 2026 19:32

Pull request was closed

Alexgodoroja added a commit that referenced this pull request Jul 16, 2026
@Alexgodoroja
catalogue: backfill product demos into all 19 apps (signed) (#398)
926b4be 
* catalogue: backfill product demos into all 19 apps' metadata (signed)

Inject the example-driven `product_demo` (authored in the app-template
submissions, app-template#88) into each app's store-page metadata.json, so that
`pilotctl appstore install` (pilotprotocol#395) prints the usage banner and the
website renders the "Full usage demo". This is the DATA half of the feature —
#395 is the renderer and is inert until this lands.

- 18 apps: product_demo appended to the existing catalogue/apps/<id>/metadata.json
  (byte-preserving append; only the new key is added).
- io.telepat.ideon-free had no rich metadata page (no metadata_url); created one
  from its submission via BuildMetadata, and added metadata_url + metadata_sha256
  to its catalogue entry.
- io.pilot.sixtyfour's demo is injected here at the metadata layer (its
  third-party-owned app-template submission is under the update gate and could
  not carry the demo).
- catalogue.json: every touched app's metadata_sha256 recomputed; catalogue.json
  re-signed (catalogue.json.sig) with the catalogue key. Verified: every
  metadata_url entry's sha matches its file and the signature validates.

Additive + non-breaking: product_demo is an optional metadata field; clients
that don't render it ignore it. Merging deploys instantly (metadata_url is raw
main).

* catalogue: consolidate — demos for all 23 installable apps + smol tombstone (signed once)

Fold the six sibling catalogue PRs into this one so the catalogue is signed and
deployed once instead of seven times:

- Product demos for the 4 apps that still lacked one — cosift, primitive,
  wallet, slipstream — authored against each app's real method set (validated by
  internal/demo). All 23 installable apps now carry a product_demo.
- Consistency fixes: wallet's metadata had NO methods array (now its 16 methods);
  slipstream had NO metadata page at all (created one). Every installable entry
  is now schema_version 1 with methods + a demo whose skill == the app id.
- Demos for agentphone / bowmark / didit / docker / duckdb (PRs #390–#394) are
  already present here — byte-identical — with main's richer entry metadata kept
  (the sibling PRs carried unenriched entries that would have regressed it).
- Smol rename collapse (from #360): io.pilot.smolmachines replaced with a
  tombstone (renamed_to io.pilot.smol, hidden), its detail page removed, and the
  "Renaming an app" convention documented in catalogue/README.md.
- Every metadata_sha256 recomputed; catalogue.json re-signed once. Verified: all
  23 metadata_url entries' shas match, the tombstone is well-formed, and the
  signature validates against the catalogue trust anchor.

* catalogue: fold aegis rev2 bundle (argv fix) from #396/#389 into the consolidated catalogue

aegis 0.1.3's live bundle has the cli.args argv bug that killed 6 of 7 methods.
Adopt the rev2 rebuild: bundle_url -> .../0.1.3/rev2/..., new bundle_sha256/size
and per-platform bundles map, metadata size updated, aegis metadata_sha256
recomputed, catalogue re-signed. Verified all 3 rev2 platform bundles resolve
(HTTP 200) and their sha256 match. The aegis product_demo (already present) is
byte-identical to #389/#396. Consolidates the aegis catalogue content of #389
(demo + go-live) and #396 (rev2 fix).

* catalogue: fix ground-truth mistakes in cosift/wallet/slipstream metadata

Reviewed the 4 hand-authored demos against each app's real API. Fixes:
- cosift: params were wrong — search/answer/research take "q" (not "query")
  and contents takes "url"/"urls" (not "id"). Verified against the
  cosift-app adapter (cmd/cosift-app/main.go methodTable) + cosift docs/API.md.
- wallet: it exposes NO wallet.help method — removed the phantom method from the
  metadata list (15 real methods) and from the demo's next. wallet.balance takes
  {"asset":"USDC"}. Method summaries corrected against pkg/walletipc source.
- slipstream: replaced hand-written method summaries with the authoritative ones
  from the live slipstream.help (installed + queried the app); demo args ({})
  confirmed valid (all list params optional).
- primitive: verified clean (all 5 demo methods exist, take no required params).
Recomputed the 3 metadata_sha256 and re-signed the catalogue.

* catalogue: add next_steps dependency graphs to all 19 apps (re-signed)

Folds the dynamic-context dependency graphs into this consolidated catalogue PR
so the whole rollout is one signature, not a second re-sign after a separate
merge. Each app's next_steps is copied verbatim from its app-template
submission (the same object BuildMetadata would emit) into
catalogue/apps/<id>/metadata.json, its metadata_sha256 re-pinned, and
catalogue.json re-signed.

18 apps gain next_steps here; io.telepat.ideon-free already carried a matching
graph. Purely additive to each metadata.json (+next_steps, nothing else
touched); aegis's rev2 argv-fix bundle pin is unchanged.

Verified: every metadata_sha256 pin matches its file bytes, every graph equals
its submission source, and the re-signed catalogue.json.sig verifies against the
embedded catalogue public key (and rejects tampering).

* catalogue: add next_steps graphs to the 5 first-party apps (re-signed)

Completes dynamic-context coverage: cosift, wallet, sixtyfour and slipstream
gain a next_steps graph here (authored from each app's own source + live testing
where free — cosift's flow was exercised end-to-end; sixtyfour used help only,
no metered calls; wallet/slipstream from their repos/metadata). Every step is a
full `pilotctl appstore call ...` command.

io.pilot.smolmachines is intentionally NOT covered: it is a hidden, non-installable
tombstone (renamed_to io.pilot.smol) with no metadata.json, so there is nothing to
attach a graph to and nothing can call it. That leaves 23/24 catalogue entries
with a graph — every real, installable app.

Each metadata.json gains only next_steps; metadata_sha256 re-pinned and
catalogue.json re-signed. Verified: all pins match, signature valid.

* catalogue: fix io.pilot.postgres links (object -> array) so `appstore view` parses

Pre-existing data bug, surfaced while verifying that the added product_demo/next_steps
fields don't break parsers: postgres's `links` was a JSON object
{"documentation":...,"psql_reference":...} but appMetadata.Links is []{label,url}
(the shape every other app uses). `pilotctl appstore view io.pilot.postgres` failed
to unmarshal the detail metadata on BOTH the released client and this one — unrelated
to next_steps. Converted to the array form; re-pinned + re-signed.

Authoritative typed-parse over all 23 metadata files now passes; product_demo and
next_steps parse cleanly everywhere (Go ignores unknown fields — no client strictness).

---------

Co-authored-by: Alexgodoroja <alex@vulturelabs.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TeoSlayer TeoSlayer Awaiting requested review from TeoSlayer TeoSlayer is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Alexgodoroja