From 3a2fe02232f2276e3b0ddba81fc1f28184eed1bc Mon Sep 17 00:00:00 2001 From: William Callahan Date: Fri, 16 Oct 2026 00:46:33 -0700 Subject: [PATCH 1/4] fix(mobile): refuse an APPLE_BUILD_HOST override outside GitHub Actions An APPLE_BUILD_HOST=haiku-50 override made this Makefile build on the user's Mac instead of haiku-7. Off GitHub Actions the lane now stops naming the override, so every Apple goal forwards to haiku-7 through remote-slot. Agent-Session: b9d88027-560a-4ba9-b763-31ed8b5fd17a --- mobile/Makefile | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mobile/Makefile b/mobile/Makefile index 9a9e82e9..d83118a4 100644 --- a/mobile/Makefile +++ b/mobile/Makefile @@ -4,6 +4,9 @@ # flags do not cross, and every output (installs, archives, receipts) stays on that host. GitHub # Actions jobs already run on the Mac their workflow picked. APPLE_BUILD_HOST := haiku-7 +# haiku-7 is the only Apple build host: an override sent builds to haiku-50, the user's Mac. +# GitHub Actions names its own runner, which is haiku-7. +$(if $(and $(filter command line,$(origin APPLE_BUILD_HOST)),$(if $(GITHUB_ACTIONS),,1)),$(error APPLE_BUILD_HOST=$(APPLE_BUILD_HOST) refused: Apple lanes build only on haiku-7, so drop the override and this lane forwards there through remote-slot)) ifeq ($(filter $(APPLE_BUILD_HOST),$(shell hostname -s))$(GITHUB_ACTIONS),) APPLE_BUILD_HOST_VARIABLES := $(strip $(foreach variable,$(sort $(.VARIABLES)),$(if $(filter command line,$(origin $(variable))),'$(variable)=$(subst ','\'',$(value $(variable)))'))) .DEFAULT_GOAL := apple-build-host From 8359180071bed1f1c67c584652d07062a64814df Mon Sep 17 00:00:00 2001 From: William Callahan Date: Fri, 16 Oct 2026 00:50:21 -0700 Subject: [PATCH 2/4] fix(mobile): keep the APPLE_BUILD_HOST override for manual runs The user permits a haiku-50 build by hand when needed, so the Makefile no longer refuses the override. haiku-7 stays the default; the agent guidance that steered lanes to haiku-50 is fixed at its owner instead. Agent-Session: b9d88027-560a-4ba9-b763-31ed8b5fd17a --- mobile/Makefile | 3 --- 1 file changed, 3 deletions(-) diff --git a/mobile/Makefile b/mobile/Makefile index d83118a4..9a9e82e9 100644 --- a/mobile/Makefile +++ b/mobile/Makefile @@ -4,9 +4,6 @@ # flags do not cross, and every output (installs, archives, receipts) stays on that host. GitHub # Actions jobs already run on the Mac their workflow picked. APPLE_BUILD_HOST := haiku-7 -# haiku-7 is the only Apple build host: an override sent builds to haiku-50, the user's Mac. -# GitHub Actions names its own runner, which is haiku-7. -$(if $(and $(filter command line,$(origin APPLE_BUILD_HOST)),$(if $(GITHUB_ACTIONS),,1)),$(error APPLE_BUILD_HOST=$(APPLE_BUILD_HOST) refused: Apple lanes build only on haiku-7, so drop the override and this lane forwards there through remote-slot)) ifeq ($(filter $(APPLE_BUILD_HOST),$(shell hostname -s))$(GITHUB_ACTIONS),) APPLE_BUILD_HOST_VARIABLES := $(strip $(foreach variable,$(sort $(.VARIABLES)),$(if $(filter command line,$(origin $(variable))),'$(variable)=$(subst ','\'',$(value $(variable)))'))) .DEFAULT_GOAL := apple-build-host From 694fc5e0479f5f26deda44fead50f13574bcd5be Mon Sep 17 00:00:00 2001 From: William Callahan Date: Fri, 16 Oct 2026 00:56:39 -0700 Subject: [PATCH 3/4] build(mobile): ask remote-slot for the Mac build host instead of naming it The Makefile and README named a private fleet machine in this public repository. The Makefile now reads the build host from the dotfiles host tool remote-slot, which every host that forwards a lane already needs; GitHub Actions still runs lanes in place. Agent-Session: b9d88027-560a-4ba9-b763-31ed8b5fd17a --- mobile/Makefile | 2 +- mobile/README.md | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/mobile/Makefile b/mobile/Makefile index 9a9e82e9..5bab7c29 100644 --- a/mobile/Makefile +++ b/mobile/Makefile @@ -3,7 +3,7 @@ # host tool remote-slot (dotfiles, ~/.local/bin). The environment, gitignored files, and make's own # flags do not cross, and every output (installs, archives, receipts) stays on that host. GitHub # Actions jobs already run on the Mac their workflow picked. -APPLE_BUILD_HOST := haiku-7 +APPLE_BUILD_HOST := $(if $(GITHUB_ACTIONS),,$(or $(shell remote-slot apple-host 2>/dev/null),$(error The dotfiles host tool remote-slot names the Mac build host; install it))) ifeq ($(filter $(APPLE_BUILD_HOST),$(shell hostname -s))$(GITHUB_ACTIONS),) APPLE_BUILD_HOST_VARIABLES := $(strip $(foreach variable,$(sort $(.VARIABLES)),$(if $(filter command line,$(origin $(variable))),'$(variable)=$(subst ','\'',$(value $(variable)))'))) .DEFAULT_GOAL := apple-build-host diff --git a/mobile/README.md b/mobile/README.md index 87eac690..dd61baf4 100644 --- a/mobile/README.md +++ b/mobile/README.md @@ -69,10 +69,10 @@ and the exports built on them) starts with `signing-session`, which runs the dotfiles host tool `build-keychain unlock`, so it signs from a fresh noninteractive SSH session. -`haiku-7` runs every lane in `mobile/Makefile`. From any other host, `make -C mobile ` -forwards the goals and command-line variables to the dotfiles host tool `remote-slot`, which -mirrors this checkout's exact bytes into a warm `.worktrees/remote-slot-` on `haiku-7` and runs -the lane there; its outputs stay on `haiku-7`. +The Mac build host that `remote-slot apple-host` names runs every lane in `mobile/Makefile`. From +any other host, `make -C mobile ` forwards the goals and command-line variables to the +dotfiles host tool `remote-slot`, which mirrors this checkout's exact bytes into a warm +`.worktrees/remote-slot-` on that host and runs the lane there; its outputs stay on that host. These lanes require the matching Developer ID or Apple Distribution identities, profiles, a valid `csweb` App Store Connect profile, and signed agreements for From c322eb8a5239acc37471f9d5dc6d232ae168ce5e Mon Sep 17 00:00:00 2001 From: William Callahan Date: Fri, 16 Oct 2026 01:15:39 -0700 Subject: [PATCH 4/4] fix(mobile): skip the build host lookup when APPLE_BUILD_HOST is passed GNU make expands a := right-hand side even when a command-line value overrides it, so a manual APPLE_BUILD_HOST run still failed on a host without remote-slot. The lookup now runs only when no command-line value and no GitHub Actions run names the host, and its error says how to fix a missing or outdated remote-slot. Agent-Session: b9d88027-560a-4ba9-b763-31ed8b5fd17a --- mobile/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mobile/Makefile b/mobile/Makefile index 5bab7c29..3717d754 100644 --- a/mobile/Makefile +++ b/mobile/Makefile @@ -3,7 +3,9 @@ # host tool remote-slot (dotfiles, ~/.local/bin). The environment, gitignored files, and make's own # flags do not cross, and every output (installs, archives, receipts) stays on that host. GitHub # Actions jobs already run on the Mac their workflow picked. -APPLE_BUILD_HOST := $(if $(GITHUB_ACTIONS),,$(or $(shell remote-slot apple-host 2>/dev/null),$(error The dotfiles host tool remote-slot names the Mac build host; install it))) +ifeq ($(filter command line,$(origin APPLE_BUILD_HOST))$(GITHUB_ACTIONS),) +APPLE_BUILD_HOST := $(or $(shell remote-slot apple-host),$(error remote-slot apple-host named no Mac build host; update the dotfiles host tool remote-slot or pass APPLE_BUILD_HOST)) +endif ifeq ($(filter $(APPLE_BUILD_HOST),$(shell hostname -s))$(GITHUB_ACTIONS),) APPLE_BUILD_HOST_VARIABLES := $(strip $(foreach variable,$(sort $(.VARIABLES)),$(if $(filter command line,$(origin $(variable))),'$(variable)=$(subst ','\'',$(value $(variable)))'))) .DEFAULT_GOAL := apple-build-host