[pithead-developer]

What's the problem

develop-v1.19.0 was created on 2026-11-07 to keep feature work off develop while 1.18.1 was overdue. 1.18.1 is now published, so that reason is gone. On 2026-11-08 the owner ruled that RigForge moves on to 1.19.0 with no 1.18.2, and that the integration branch folds back into develop.

The branch holds seven merged feature PRs that are not on develop:

• Expose appliance mode and baked ref in the sister feed #637 sister-feed appliance mode
• Automate docs replay, API allowlist, and uninstall checks #617 docs replay
• Add an opt-in shared-host resource profile #611 shared-host profile
• Qualify historical RigForge benchmark claims #639 benchmark claims
• Support solo daemon pools and report node health #645 solo daemon pools
• Warn when source configuration changes after generation #609 source-drift warning
• Add JSON doctor reports with stable check IDs #606 JSON doctor reports

It is also 9 commits behind develop, which carries the v1.18.1 release and #661.

How I fixed it

1. fold/develop-v1.19.0-into-develop starts at develop-v1.19.0 (eb50ae22) and merges develop (d41b6d3a).
2. Five files conflicted. Each had one hunk, resolved like this:
   • Makefile, tests/run.sh: kept both sides' new test entries.
   • tests/e2e-pithead.sh: kept both sides' new test sources.
   • rigforge.sh: the conflict is comments only. Both sides deleted overlapping comment lines, and both deletions are kept, with no code change.
   • tests/coverage.sh: kept Verify cached jq before use and preserve fresh coverage proofs #643's early rm -rf "$OUT". The branch still had the old wipe after the source proofs are written, which would delete source-files.sha256. The merged file equals develop's plus the branch's intended changes: util/config-apply-state.sh in the coverage include pattern and the header wording.
3. This PR squash-merges into develop as one commit.
4. After the merge:
   • The five open PRs based on develop-v1.19.0 (Add validated XMRig configuration overlays #604, Support configurable RandomX modes and initialization #605, Preserve optional XMRig pool fields #607, Keep RigForge in control of generated XMRig config #608, Verify XMRig benchmarks and add bounded stress checks #610) move to develop with a rebase --onto develop develop-v1.19.0.
   • Runner routing for the v1.19.0 and v2.x - post-GA milestones returns to develop.

Here is the proof

• Head 1539c4f5: the merge commit fdc11f22 (parents eb50ae22, d41b6d3a) plus five fix commits for merge interactions, all listed in the review record: Fold develop-v1.19.0 back into develop for 1.19.0 #664 (comment)
• CI: all 10 checks green at this head.
• Local:
  • test-doctor-json.sh: 51 passed, 0 failed;
  • test-worker-proof.py: 24 OK; test-worker-proof.sh: 21 passed;
  • test-config-apply-state.sh and test-coverage-cache.sh pass;
  • the file-budget gate passes against develop;
  • shellcheck passes on all shell files.
• Review: the adversarial review covered the render pipeline, lifecycle, feed and security, and tests, with a skeptic per serious finding.
  • The 1.19.0-side defects it found are filed as watchdog: the shared-host start guard runs before the thermal stop, so a failing guard leaves a hot miner running #665, A failed shared-host safeguard render leaves the secret-bearing temp config in the build directory #666 and e2e proof gaps after the 1.19.0 fold: the allowlist positive leg bypasses the saddr rule, and shared-host is not a proof group #667.
  • The adversarial-review status is posted at this head.

🤖 Generated with Claude Code

[pithead-reviewer]

Adversarial review of the fold at 1539c4f5 (2026-11-08)

Scope: the conflict resolutions, plus every place where a 1.19.0 feature (#637, #617, #611, #639, #645, #609, #606) meets code that v1.18.1 rewrote after that feature was reviewed. Four reviewers each took one lens: render pipeline, lifecycle, feed and security, tests and CI. Each serious finding was re-checked by an independent skeptic, and six further notes were verified separately.

Merge interactions found and fixed on this branch. Neither side was wrong on its own.

• Worker-proof pass totals. Bind ordered worker proofs to their execution context #641 hard-coded the per-group totals, and Add JSON doctor reports with stable check IDs #606 and Automate docs replay, API allowlist, and uninstall checks #617 add assertions to connect and network. The totals are now connect 8, network 10 and 9 for each replay group, in the verifier, its doc and the shell fixture.
• Settle-test stub. fix(tests): wait for the sister snapshot to recover before the network wire check (#563) #654's network settle test now stubs Automate docs replay, API allowlist, and uninstall checks #617's phase_api_allowlist. Before, it ran an undefined command and printed a FAIL row while still passing.
• Doctor IDs. Add JSON doctor reports with stable check IDs #606 requires a stable ID on every doctor row, but Warn when source configuration changes after generation #609's generated-configuration rows had none. The four daemon-pool doctor-JSON cases failed, and they fail on the 1.19.0 tip too, which never ran CI. Those rows now report config-apply.
• Coverage scope. Verify cached jq before use and preserve fresh coverage proofs #643's coverage-cache test pinned the two-file kcov scope. It now expects 1.19.0's third file, util/config-apply-state.sh.
• File budget. tests/e2e-pithead.sh was 569 lines against its 563 ceiling, which may not rise. It is back to 563, with identical behaviour.

Checked and clean:

• Render pipeline. Support solo daemon pools and report node health #645's daemon pools, Add an opt-in shared-host resource profile #611's shared-host profile and Warn when source configuration changes after generation #609's drift stamp all go through Preserve the last valid miner configuration when rendering fails #634's temp-render, validate and install path.
• Lifecycle ordering. Add an opt-in shared-host resource profile #611's reown runs after the staged swap. Propagate miner restart failures instead of reporting the payout applied #630's restart accounting is unchanged. Setup and upgrade skip the API firewall when the sister API fails to start #613 and Keep the writable receiver blocked when required firewall loading fails #628 keep the firewall order. Stop stale receiver access when token revocation cannot restart the receiver #626's receiver stop is untouched.
• Feed revision. The new feed fields sit inside Key the public configuration revision to prevent offline password guessing #629's keyed revision.

Real, but already on the 1.19.0 side, so filed rather than fixed here: #665 (watchdog guard ahead of the thermal stop), #666 (shared-host render temp file left on disk) and #667 (e2e proof gaps). Three notes were refuted: the daemon feed connection shape is deliberate and pinned by a test, the daemon wallet in the feed is a public address already served, and the shared-host rebuild downtime is documented.

Local proof at this head:

• test-doctor-json.sh: 51 passed, 0 failed.
• test-worker-proof.py: 24 OK; test-worker-proof.sh: 21 passed.
• test-config-apply-state.sh, test-coverage-cache.sh, and every test-suite command after the doctor test, which CI never reached on the earlier head.
• The file-budget gate against develop.
• shellcheck on all shell files. Local shfmt 3.13.1 differs from CI's 3.14.1 only on lines this PR does not touch; pure develop shows the same differences.

CI at this head: all 10 checks green (test suite, shellcheck + shfmt, coverage, both stock-home setups, Docker end-to-end, markdownlint, yamllint, zizmor, gitleaks).

🤖 Generated with Claude Code