Menu

#330 release: fold dashboard into Tauri + self-contained DMG + in-process capture (pre-main → main)

closed
nobody
None
2026-06-24
2026-06-24
Anonymous
No

Originally created by: Akarsh-Hegde

Summary

Promotes pre-mainmain: the culmination of the Next-fold and the self-contained-DMG / setup re-platform initiative. Meridian moves from a Node-server + external-screenpipe-process topology to a single self-contained Tauri .app — the dashboard runs inside the webview as a static export, every /api route is ported to Rust, capture runs in-process, and the MLX runtime is provisioned/supervised by the tray.

This bundles 13 already-reviewed feature PRs (#298, [#314]–#329) plus post-merge review + CI fixes.

Metric Value
Commits 186
Files changed 223 (83 added, 49 deleted)
Diff +25,162 / −8,814
New shared crate meridian-core — 23 files, ~6,050 LOC
Commit types 72 feat, 49 fix, 11 chore, 9 refactor, 8 docs, 7 build, 6 test, 6 ci
Resulting version v1.64.0 (minor — see Versioning)
DMG size 19.6 MB (Meridian.app.tar.gz 19.3 MB)
Release build ~5 min (macOS runner: build + sign + notarize-ready + package)
Tests 516 Rust + 7 JS/TS suites — all green

Architecture changes

The core shift: delete the Node UI server and the external screenpipe process; collapse everything into one signed .app where the tray owns capture + the embedded dashboard, the daemon owns ETL, and meridian-core is the shared data layer both link against.

Before (v1.63.0)

  • screenpipe runs as its own launchd process → writes ~/.screenpipe/db.sqlite; the daemon reads it cross-DB.
  • A standalone Next.js Node server (com.meridiona.ui launchd agent) serves the dashboard and ~32 /api/* routes, reading meridian.db over better-sqlite3.
  • The tray polls those /api routes over HTTP.

After (v1.64.0)

  • The tray captures in-process (forked screenpipe-screen + screenpipe-a11y) → writes capture_frames / capture_ui_events into meridian.db. No screenpipe DB / process / pool.
  • The dashboard is a static export embedded in the tray binary; the frontend reaches Rust only via Tauri invoke / events through ui/lib/bridge.ts. No Node server, no /api routes.
  • DB reads live in meridian-core/src/readers/ (shared by daemon + tray); file/env/process actions are tray commands. The four SSE streams became Tauri events off the tray poll loop.

    :::mermaid
    flowchart TB
    subgraph BEFORE["BEFORE — v1.63.0 (multi-process)"]
    direction TB
    sp1[screenpipe process]:::ext --> spdb[(~/.screenpipe/db.sqlite)]:::ext
    spdb --> d1[meridian daemon · ETL]
    d1 --> mdb1[(meridian.db)]
    node[Next.js Node server
    com.meridiona.ui]
    :::ext --> mdb1
    node -->|serves| dash1[Dashboard + /api routes]
    tray1[Tauri tray] -->|HTTP poll /api| node
    mlx1[MLX Python server]:::py --> d1
    end

    subgraph AFTER["AFTER — v1.64.0 (single self-contained .app)"]
    direction TB
    subgraph app["Meridian.app"]
    cap[Tray · in-process capture
    screenpipe-screen/-a11y]
    :::new
    core[[meridian-core
    shared readers + commands]]:::new
    webview[Embedded dashboard
    static export]
    :::new
    d2[meridian daemon · ETL]
    end
    cap -->|capture_frames / capture_ui_events| mdb2[(meridian.db)]
    d2 -->|reads capture tables| mdb2
    d2 -->|app_sessions| mdb2
    webview -->|Tauri invoke / events| core
    core --> mdb2
    mlx2[MLX Python server
    provisioned + supervised by tray]
    :::py --> d2
    end

    classDef ext fill:#fde,stroke:#b66;
    classDef new fill:#dfe,stroke:#6b6;
    classDef py fill:#eef,stroke:#66b;


Features implemented

1. Next-fold — dashboard into Tauri, /api → Rust (#298, [#314])

  • Dashboard now runs only inside the Tauri webview as a static export (output: 'export') — no Node server.
  • All ~32 /api/* routes ported: DB reads → meridian-core/src/readers/ (re-exported by the daemon), file/env/process → tray/src-tauri/src/commands/.
  • Health / notices / notifications / log streams converted from SSE → Tauri events emitted by the tray poll loop.
  • Retired the standalone Node-UI release machinery (com.meridiona.ui plist, ui-start.sh, pinned Node + better-sqlite3 ABI dance). Dashboard now ships embedded in the tray binary.

2. Self-contained DMG + setup re-platform (#315, [#318], [#319], [#320], [#321], [#326])

  • Backend bundled into the .app — daemon + a11y staged to stable ~/.meridian/bin/, plists rendered, launchctl bootstrap (#321).
  • MLX runtime: download-and-provision on first run (#315), tray-side supervision (#318), CI provisioning (#319), integrity verification (#320).
  • First-run onboarding wizard + meridian setup commands + native setup UI (#315, [#326]).
  • New meridian uninstall [--purge] [--dry-run] [--yes] command for clean teardown.

3. In-process capture — screenpipe forked at MIT (#323, [#324])

  • screenpipe pinned/forked at its last-MIT commit (#323); capture runs in-process in the tray, writing capture_frames / capture_ui_events into meridian.db.
  • Daemon ETL reads those tables — no screenpipe DB/process/pool anymore (run_etl(meridian) instead of run_etl(screenpipe, meridian)).

4. Tray popover redesign (#327)

  • Reworked popover UI. Two known limitations deferred for the MVP (timer drift; pending-drafts amber dot).

5. Auto-update + release engineering (#328, [#329])

  • tauri-plugin-updater staging channel wired into the release pipeline (#328); staging private-fork auth fix (#329). Minisign trust, independent of Apple Dev ID. Proven end-to-end (ad-hoc bundle relaunch).

6. Post-merge review + CI fixes

  • The high-effort /code-review of [#298] surfaced 4 correctness divergences from the original TS routes — all fixed (b54ec04): multibyte log-tail drop, leaked tasks-sync child, lenient quiet-hours parser, divergent DB-path resolver.
  • CI Rust job now authenticates the private screenpipe-fork git dep (#331).

Compatibility & breaking changes

Audited across four surfaces (DB schema, public interfaces, install/upgrade path, runtime behavior). No hard breaking changes for existing installs — the version-affecting changes are additive or documented v1 degradations.

✅ Safe / non-breaking

  • DB migrations are strictly append-only (046 capture_frames, 047 capture_ui_events, 048 ETL-cursor reset) — no modified/renamed/deleted migrations (CI "Migrations append-only" guard enforced), no DROP/ALTER/destructive changes. Existing meridian.db upgrades cleanly; app_sessions history preserved.
  • Public interfaces preserved — no CLI command, env var, settings.json key, or MCP tool removed or renamed (only additions). The deleted /api/* routes were internal-only (consumed solely by the bundled dashboard, which moved to Tauri invoke in lockstep).
  • Added busy_timeout(5s) on the meridian pool for the new tray↔daemon concurrent-write topology — backward compatible.

⚠️ Documented v1 degradations (intentional, not regressions)

  • Audio droppedget_audio_snippets stubbed empty (in-process capture is text/OCR/a11y only). Classifier runs on text, so accuracy is unaffected; audio_snippets is simply always empty.
  • Idle detection off — no in-process idle signal yet, so gaps all classify system_sleep (capture_trigger is NULL).
  • Both are accepted v1 trade-offs with audio + idle-detection as future slices.

Semantic note: the /api removal and capture cutover are large architectural changes but not user-contract breaks — nothing a user, script, or external integration depends on was removed. Hence the minor bump is honest (see below).


Build & artifacts

  • DMG: 19.6 MB (Meridian.dmg), updater bundle Meridian.app.tar.gz 19.3 MB + minisign .sig + latest.json.
  • Release build ~5 min on the macOS runner (release-staging.yml: build → sign → updater-sign → package → publish + mirror).
  • Self-contained: the .app carries the daemon, a11y helper, embedded dashboard, and in-process capture; the MLX runtime provisions on first run.
  • Ships ad-hoc-signed today; notarization / Gatekeeper-clean first launch lands with the Apple Developer ID (org enrollment for MERIDIONA LLP currently In Review).

Quality & test coverage

  • 516 Rust test functions across the workspace — daemon 362, meridian-core 63, tray 27, integration 64 (tests/etl_*.rs, task_linker_smoke, tray_assets, worklog_provider, + meridian-core/tests/readers.rs, today_smoke.rs).
  • 7 JS/TS suites (ui/__tests__/: intervals, format, category-colors, cursor-pointer, redesign, lib, meridian-bin).
  • Ported readers are test-covered — in-memory seeded DB tests assert byte-for-byte parity with the deleted /api routes.
  • CI green on [#330]: Rust (fmt + clippy -D warnings + test) 2m52s, UI build 41s, Migrations-append-only guard, screenpipe MIT-pin guard, CodeQL (rust/js/python/actions), CodeRabbit.
  • Every constituent PR passed the full pre-push suite (fmt + clippy + cargo test + UI build + UI tests + security audit).

Versioning

v1.63.0v1.64.0 (minor). semantic-release derives the bump from conventional commits: 72 feat: force at least a minor, and zero BREAKING CHANGE: footers / ! markers mean no major. Empirically confirmed — the staging channel already cut v1.64.0-staging.{1,2,3} from these exact commits.


Known follow-ups (deferred, non-blocking)

  • Next-fold deferred findingsweek.rs UTC bucketing, refresh.rs poll-loop efficiency, file-size splits (incl. mlx_server.rs 1183 lines), table_exists() DRY extraction.
  • Apple Developer ID (MERIDIONA LLP org enrollment, In Review) gates notarization / single-"Meridian" TCC / Gatekeeper-clean first launch — ships ad-hoc-signed until the cert lands.
  • Audio capture + in-process idle detection are future slices.
  • Tray redesign: timer drift + pending-drafts amber dot.

Risk

Every constituent change already merged via its own reviewed PR into pre-main; this PR is the promotion gate to main, not new unreviewed work. Each feature is independently revertable at its merge commit. CI is fully green.

🤖 Generated with Claude Code

Related

Tickets: #298
Tickets: #314
Tickets: #318
Tickets: #319
Tickets: #320
Tickets: #321
Tickets: #324
Tickets: #326
Tickets: #329
Tickets: #330
Tickets: #331
Tickets: #332
Tickets: #333

Discussion

  • Anonymous

    Anonymous - 2026-06-24

    Originally posted by: coderabbitai[bot]

    [!IMPORTANT]

    Review skipped

    Too many files!

    This PR contains 219 files, which is 69 over the limit of 150.

    To get a review, narrow the scope:
    • coderabbit review --type committed # exclude uncommitted changes
    • coderabbit review --dir <path> # limit to a subdirectory
    • coderabbit review --base <branch> # compare against a closer base</branch></path>

    Upgrade to a paid plan to raise the limit.


    ⚙️ Run configuration

    Configuration used: Organization UI

    Review profile: ASSERTIVE

    Plan: Pro Plus

    Run ID: 68a07fa9-0943-4312-aee9-56ed5340f20e


    📥 Commits

    Reviewing files that changed from the base of the PR and between [72a2a6] and 768f47b4ba139968ef2c199d15123bf75f764963.


    ⛔ Files ignored due to path filters (5)

    • Cargo.lock is excluded by !**/*.lock
    • package-lock.json is excluded by !**/package-lock.json
    • services/uv.lock is excluded by !**/*.lock
    • tray/src-tauri/icons/meridiona-mark.png is excluded by !**/*.png
    • ui/package-lock.json is excluded by !**/package-lock.json


    📒 Files selected for processing (219)

    • .cargo/config.toml
    • .claude/skills/meridian-ui/SKILL.md
    • .github/workflows/build-mlx-runtime.yml
    • .github/workflows/ci.yml
    • .github/workflows/release-staging.yml
    • .github/workflows/release.yml
    • .gitignore
    • .releaserc.json
    • .releaserc.staging.json
    • .taurignore
    • CLAUDE.md
    • Cargo.toml
    • README.md
    • SETUP.md
    • install.sh
    • meridian-core/Cargo.toml
    • meridian-core/src/capture.rs
    • meridian-core/src/db.rs
    • meridian-core/src/lib.rs
    • meridian-core/src/notifications.rs
    • meridian-core/src/readers/active.rs
    • meridian-core/src/readers/coding_agents.rs
    • meridian-core/src/readers/current_task.rs
    • meridian-core/src/readers/integrations.rs
    • meridian-core/src/readers/mod.rs
    • meridian-core/src/readers/notices.rs
    • meridian-core/src/readers/plan.rs
    • meridian-core/src/readers/task_detail.rs
    • meridian-core/src/readers/tasks.rs
    • meridian-core/src/readers/today/mod.rs
    • meridian-core/src/readers/today/types.rs
    • meridian-core/src/readers/triage.rs
    • meridian-core/src/readers/week.rs
    • meridian-core/src/readers/worklogs.rs
    • meridian-core/src/settings.rs
    • meridian-core/src/util/date.rs
    • meridian-core/src/util/hygiene.rs
    • meridian-core/src/util/intervals.rs
    • meridian-core/src/util/mod.rs
    • meridian-core/tests/readers.rs
    • meridian-core/tests/today_smoke.rs
    • package.json
    • scripts/build-mlx-runtime.sh
    • scripts/com.meridiona.ui.plist
    • scripts/dev-signing.sh
    • scripts/install-from-bundle.sh
    • scripts/install-ui-daemon.sh
    • scripts/meridian-cli.sh
    • scripts/meridian-npm-setup.sh
    • scripts/mirror-staging-release.sh
    • scripts/package-release.sh
    • scripts/package-updater.sh
    • scripts/set-version.sh
    • scripts/smoke-test-mlx-runtime.sh
    • scripts/test-updater-github.sh
    • scripts/test-updater-local.sh
    • scripts/ui-start.sh
    • scripts/uninstall-ui-daemon.sh
    • scripts/verify-release-bundle.sh
    • services/agents/run_task_linker_mlx.py
    • services/agents/server.py
    • src/config.rs
    • src/db/meridian.rs
    • src/db/mod.rs
    • src/db/screenpipe.rs
    • src/etl/block_ops.rs
    • src/etl/extractor.rs
    • src/etl/runner.rs
    • src/health/capture.rs
    • src/health/fix.rs
    • src/health/mlx.rs
    • src/health/mod.rs
    • src/health/platform.rs
    • src/health/ui.rs
    • src/intelligence/oauth/github.rs
    • src/intelligence/oauth/jira.rs
    • src/intelligence/oauth/mod.rs
    • src/intelligence/task_linker/mod.rs
    • src/intelligence/task_triage/store.rs
    • src/lib.rs
    • src/main.rs
    • src/migrations/046_capture_frames.sql
    • src/migrations/047_capture_ui_events.sql
    • src/migrations/048_reset_cursor_for_capture_cutover.sql
    • src/pm_worklog/synth.rs
    • src/telemetry_spool/shipper.rs
    • src/telemetry_spool/writer.rs
    • src/uninstall.rs
    • tests/common/mod.rs
    • tests/etl_basic.rs
    • tests/etl_gaps.rs
    • tests/etl_session_close.rs
    • tests/etl_session_text.rs
    • tests/etl_ui_events.rs
    • tests/task_linker_smoke.rs
    • tests/tray_assets.rs
    • tray/create-icons.sh
    • tray/package.json
    • tray/src-tauri/Cargo.toml
    • tray/src-tauri/build.rs
    • tray/src-tauri/capabilities/default.json
    • tray/src-tauri/src/backend_install.rs
    • tray/src-tauri/src/capture/mod.rs
    • tray/src-tauri/src/capture/screenpipe.rs
    • tray/src-tauri/src/capture/ui_events.rs
    • tray/src-tauri/src/commands.rs
    • tray/src-tauri/src/commands/daemon.rs
    • tray/src-tauri/src/commands/dashboard.rs
    • tray/src-tauri/src/commands/health.rs
    • tray/src-tauri/src/commands/integrations.rs
    • tray/src-tauri/src/commands/logs.rs
    • tray/src-tauri/src/commands/notices.rs
    • tray/src-tauri/src/commands/notifications.rs
    • tray/src-tauri/src/commands/openobserve.rs
    • tray/src-tauri/src/commands/parents.rs
    • tray/src-tauri/src/commands/settings.rs
    • tray/src-tauri/src/commands/setup.rs
    • tray/src-tauri/src/commands/system.rs
    • tray/src-tauri/src/commands/tasks.rs
    • tray/src-tauri/src/commands/triage.rs
    • tray/src-tauri/src/commands/version.rs
    • tray/src-tauri/src/commands/worklogs.rs
    • tray/src-tauri/src/format.rs
    • tray/src-tauri/src/install.rs
    • tray/src-tauri/src/lib.rs
    • tray/src-tauri/src/mlx_server.rs
    • tray/src-tauri/src/poll.rs
    • tray/src-tauri/src/poll/live.rs
    • tray/src-tauri/src/poll/mod.rs
    • tray/src-tauri/src/poll/notifications.rs
    • tray/src-tauri/src/poll/refresh.rs
    • tray/src-tauri/src/state.rs
    • tray/src-tauri/src/sys.rs
    • tray/src-tauri/src/tray.rs
    • tray/src-tauri/src/tray_icon.rs
    • tray/src-tauri/src/update.rs
    • tray/src-tauri/tauri.conf.json
    • tray/src-tauri/tauri.staging.conf.json
    • tray/src/app.js
    • tray/src/index.html
    • tray/src/style.css
    • tray/src/tooltip.css
    • tray/src/tooltip.html
    • tray/src/tooltip.js
    • ui/.gitignore
    • ui/__tests__/intervals.test.ts
    • ui/app/api/active/route.ts
    • ui/app/api/auth/oauth/start/route.ts
    • ui/app/api/auth/token/route.ts
    • ui/app/api/coding-agents/route.ts
    • ui/app/api/daemon/reload/route.ts
    • ui/app/api/daemon/status/route.ts
    • ui/app/api/health/route.ts
    • ui/app/api/health/stream/route.ts
    • ui/app/api/integrations/azure-devops/discover/route.ts
    • ui/app/api/integrations/route.ts
    • ui/app/api/logs/route.ts
    • ui/app/api/logs/stream/route.ts
    • ui/app/api/notices/[id]/route.ts
    • ui/app/api/notices/stream/route.ts
    • ui/app/api/notifications/[id]/delivered/route.ts
    • ui/app/api/notifications/[id]/dismiss/route.ts
    • ui/app/api/notifications/allowed/route.ts
    • ui/app/api/notifications/pending/route.ts
    • ui/app/api/notifications/stream/route.ts
    • ui/app/api/openobserve/route.ts
    • ui/app/api/plan/route.ts
    • ui/app/api/plan/task/route.ts
    • ui/app/api/settings/route.ts
    • ui/app/api/tasks/route.ts
    • ui/app/api/tasks/sync/route.ts
    • ui/app/api/today/route.ts
    • ui/app/api/triage/apply/route.ts
    • ui/app/api/triage/decision/route.ts
    • ui/app/api/triage/ignore/route.ts
    • ui/app/api/triage/parents/route.ts
    • ui/app/api/triage/route.ts
    • ui/app/api/update/route.ts
    • ui/app/api/version/route.ts
    • ui/app/api/week/route.ts
    • ui/app/api/worklogs/[id]/route.ts
    • ui/app/api/worklogs/route.ts
    • ui/app/globals.css
    • ui/app/setup/atoms.tsx
    • ui/app/setup/data.ts
    • ui/app/setup/page.tsx
    • ui/app/setup/steps.tsx
    • ui/components/DayTimeline.tsx
    • ui/components/HealthBanner.tsx
    • ui/components/HygieneDialog.tsx
    • ui/components/MustFixBanner.tsx
    • ui/components/NoticeBar.tsx
    • ui/components/NotificationBanner.tsx
    • ui/components/ShapeOfDay.tsx
    • ui/components/Sidebar.tsx
    • ui/components/plan/TaskDialog.tsx
    • ui/components/views/CleanupView.tsx
    • ui/components/views/LogsView.tsx
    • ui/components/views/PlanView.tsx
    • ui/components/views/SessionsView.tsx
    • ui/components/views/SettingsView.tsx
    • ui/components/views/TasksView.tsx
    • ui/components/views/TodayView.tsx
    • ui/components/views/WeekView.tsx
    • ui/components/views/WorklogsView.tsx
    • ui/instrumentation.ts
    • ui/lib/api-types.ts
    • ui/lib/bridge.ts
    • ui/lib/daily-plan.ts
    • ui/lib/db-write.ts
    • ui/lib/db.ts
    • ui/lib/intervals.ts
    • ui/lib/notices-store.ts
    • ui/lib/notifications-banner-store.ts
    • ui/lib/notifications.ts
    • ui/lib/observability.ts
    • ui/lib/settings.ts
    • ui/next.config.ts
    • ui/package.json

    You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

    Use the checkbox below for a quick retry:
    - [ ] 🔍 Trigger review

    ✨ Finishing Touches
    🧪 Generate unit tests (beta) - [ ] Create PR with unit tests - [ ] Commit unit tests in branch `pre-main`

    Comment @coderabbitai help to get the list of available commands.

     

    Related

    Commit: [72a2a6]

  • Anonymous

    Anonymous - 2026-06-24

    Originally posted by: Akarsh-Hegde

    Review findings resolved → PR [#333]

    All findings from @adityaharishch's review have been addressed in PR [#333] (fix/pr-330-review → pre-main). Summary:

    Fixed

    Severity Finding Fix
    HIGH CORRECTNESS meridian doctor exits non-zero on every healthy post-fold install — ui_service() + ui::checks() probe the retired com.meridiona.ui Node server Replaced both with Info checks: "dashboard embedded in the Tauri binary (no separate service)". Removed the HTTP probe, plist check, .next check, serve_mode_check, and their unit tests.
    HIGH CORRECTNESS MLX restart-budget exhaustion permanently wedges — supervise_mlx never resets attempts when /health keeps failing, so the zombie holding port 7823 is never cleared Added MLX_COOLING_TICKS = 10 (~10 min). attempts now increments through the cooling window past MLX_MAX_RESTARTS; at MAX + COOLING ticks it resets to 0 so supervise() runs again (with its existing KilledWedged path) and a fresh restart cycle begins.
    HIGH SECURITY (partial) MERIDIAN_RUNTIME_MANIFEST_URL env-var redirectable in production Gated behind #[cfg(debug_assertions)] — release binary cannot be redirected via a compromised env var. The self-referential SHA-256 issue (manifest + tarball on the same origin) requires an out-of-band trust root (minisign, like the updater); design tracked as a follow-up.
    MEDIUM CORRECTNESS capture_coverage datetime format mismatch — datetime('now', ?1) produces '…T…Z' vs ' '-separated stored timestamps; 'T' > ' ' so every row passes the filter Fixed to julianday(timestamp) > julianday('now', ?1) following the frame_freshness pattern in the same file.
    MEDIUM CORRECTNESS subscribe() snapshot prime silently swallows errors on cold-DB startup Retry-once-after-2s on first failure; console.warn(...) on second failure — visible in DevTools.
    MEDIUM SECURITY sudo npm install runs lifecycle scripts as root Added --ignore-scripts to both npm install lines in install-from-bundle.sh.

    Deferred (acknowledged, not blocking)

    • install.sh OO sha256 and build-mlx-runtime.sh PBS pin: both need real hash values from the upstream release pages — straightforward follow-ups.
    • MLX manifest self-referential SHA-256: requires a minisign/ed25519 embedded public key (same mechanism as the updater's pub_key). Tracked separately.
     

    Related

    Tickets: #333

  • Anonymous

    Anonymous - 2026-06-24

    Originally posted by: Akarsh-Hegde

    Review findings — status update (PR [#333] merged to pre-main)

    All inline threads updated. Summary of what's resolved vs. still open:

    Thread Status
    poll/mod.rs — MLX restart-budget exhaustion permanently wedges Resolved (PR [#333]) — MLX_COOLING_TICKS = 10 added; attempts counts through a ~10-min cooling window then resets, letting supervise() kill any zombie and start a fresh restart cycle
    ui/lib/bridge.tssubscribe() snapshot prime silently swallows errors Resolved (PR [#333]) — retry-once-after-2s for the cold-DB startup race; console.warn on second failure
    src/health/ui.rs + platform::ui_service()doctor CRITICAL on healthy installs Resolved (PR [#333]) — removed all Node-era HTTP probes and plist checks; both now return Info: dashboard embedded in the Tauri binary
    src/health/capture.rscapture_coverage datetime format mismatch Resolved (PR [#333]) — julianday(timestamp) > julianday('now', ?1) in both subqueries
    install-from-bundle.shsudo npm install runs lifecycle scripts as root Resolved (PR [#333]) — --ignore-scripts added to both npm install lines
    mlx_server.rsMERIDIAN_RUNTIME_MANIFEST_URL redirectable in production ⚠️ Partially resolved (PR [#333]) — env-var path gated behind #[cfg(debug_assertions)]; self-referential SHA-256 (manifest + tarball from same origin) requires an out-of-band trust root (minisign embedded key), tracked as a follow-up
    build-mlx-runtime.sh — PBS releases/latest + no checksum 🔲 Deferred — needs real sha256 of the pinned PBS release; adding a fabricated hash would be worse than leaving it unpinned
    services/agents/server.py — empty except clause 🔲 Not addressed — out of scope for the fold; tracked separately

    PR [#333] is merged into pre-main. The remaining two open items are tracked as follow-ups and are not blocking the pre-main → main promotion.

     

    Related

    Tickets: #333

  • Anonymous

    Anonymous - 2026-06-24

    Originally posted by: Akarsh-Hegde

    The three deferred items are now tracked in the Obsidian tech backlog (Architecture/Tech Backlog.md):

    • MLX runtime manifest out-of-band signature (minisign pub key embedded in binary)
    • build-mlx-runtime.sh PBS release pin + sha256 verification
    • services/agents/server.py empty except clause
     
  • Anonymous

    Anonymous - 2026-06-24

    Ticket changed by: Akarsh-Hegde

    • status: open --> closed
     

Log in to post a comment.