Skip to content

docs(web/guides): replace nonexistent install.sh URL with working .deb/.rpm install#2604

Merged
bpamiri merged 4 commits into
developfrom
claude/hopeful-montalcini-3c6889
May 12, 2026
Merged

docs(web/guides): replace nonexistent install.sh URL with working .deb/.rpm install#2604
bpamiri merged 4 commits into
developfrom
claude/hopeful-montalcini-3c6889

Conversation

@bpamiri
Copy link
Copy Markdown
Collaborator

@bpamiri bpamiri commented May 12, 2026

Summary

  • The Linux tab in the start-here install guide pointed at https://get.wheels.dev/install.sh — a URL planned for the Phase 2 universal installer but never deployed. Users on Linux hit a 404.
  • The release pipeline already produces .deb and .rpm packages on every release (release.yml lines 282-287; verified live at v4.0.0-snapshot.1825 which ships both wheels_4.0.0.snapshot.1825_amd64.deb and wheels-4.0.0.snapshot.1825.x86_64.rpm). The docs just weren't pointing at them.
  • Rewrites three guides to use the working .deb/.rpm flow with API-driven version resolution so the snippets stay correct as releases roll over.

What changed

  • start-here/installing.mdx — Linux install + upgrade tabs now use apt install ./*.deb / dnf install <url> against the GitHub Release. Troubleshooting no longer references the never-existed ~/.wheels/env file.
  • command-line-tools/installation.mdx — split the conflated "macOS and Linux (Homebrew)" section. Linux now has its own .deb/.rpm section documenting the on-disk layout (/usr/bin/wheels, /opt/wheels/lucli, /opt/wheels/module/) and an <Aside> flagging the planned native apt/yum repos as a v4.0.x follow-up.
  • start-here/release-channels.mdx — replaced literal <version> placeholders (not copy-paste runnable) with the API curl pattern. Extended "Switching channels" beyond Homebrew: Linux uses Conflicts: / Replaces: metadata in the .deb/.rpm, Scoop refuses dual install.

Why this is fine without Phase 2

Phase 2 (apt.wheels.dev / yum.wheels.dev native repos served from Cloudflare Pages) is fully scoped in tools/distribution-drafts/linux-packages/README.md — needs a GPG signing key, two new Cloudflare Pages repos under wheels-dev/, and a metadata-generator workflow. That's worth its own PR (and its own decision about key custody). This PR ships the Phase 1 install story — which has worked end-to-end on Linux since release.yml line 287 landed — and stops the docs from sending users to a dead URL.

I'll file the Phase 2 work as a separate v4.0.x follow-up issue.

Test plan

  • Read the rendered installing.mdx Linux tab in the preview build — confirm the three code blocks (Debian/Ubuntu install, Fedora/RHEL install, the bleeding-edge Aside) render and explain themselves
  • Manually run the Debian/Ubuntu snippet on a fresh Ubuntu VM against wheels-dev/wheels-snapshots (substituted per the bleeding-edge Aside) — confirm wheels --version reports a real version
  • After v4.0.0 GA tags, re-run the snippet against the stable wheels-dev/wheels URL to confirm it resolves (currently 404s pre-GA because wheels-dev/wheels's latest release is v3.0.0+50, which predates the linux packaging — first stable .deb/.rpm will appear on v4.0.0)
  • Confirm release-channels.mdx and command-line-tools/installation.mdx Linux sections agree on the install URL pattern

🤖 Generated with Claude Code

Copy link
Copy Markdown
Contributor

@wheels-bot wheels-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wheels Bot — Reviewer A

TL;DR: Pure docs fix replacing a dead install.sh URL with working .deb/.rpm install snippets. The motivation is solid and the stable-channel instructions are correct end-to-end. Two issues need changes before merge: a bleeding-edge Aside in installing.mdx instructs users to do a simple URL substitution that silently fails (empty version variable, bad download URL), and the Linux channel-switch snippet in release-channels.mdx references wheels-be as a URL component when no install snippet in this file actually uses wheels-be as a filename — leaving users unable to act.


Correctness

1. installing.mdx line 189–191 — bleeding-edge Aside gives a broken instruction

Substitute `wheels-dev/wheels-snapshots` for `wheels-dev/wheels` in the URLs above.

The "URLs above" (lines 177–186) call /releases/latest:

WHEELS_VERSION=$(curl -fsSL https://api.github.com/repos/wheels-dev/wheels/releases/latest \
  | sed -nE 's/.*"tag_name": *"v([^"]+)".*/\1/p')

/releases/latest only returns the latest non-pre-release published release. release-channels.mdx already states this explicitly (line 91: "The bleeding-edge channel publishes only pre-releases, so use /releases (not /releases/latest)"). If a user follows the Aside literally, the substituted API call returns nothing, WHEELS_VERSION is empty, and the subsequent curl tries to download a URL like:

https://github.com/wheels-dev/wheels-snapshots/releases/download/v/wheels__amd64.deb

which is a 404. The failure is silent in the script — curl -fsSL exits 0 on a 404 redirect page, and apt install then fails with a confusing error about a non-existent local path.

Suggested fix — replace the inline substitution prose with a self-contained snippet that mirrors the correct /releases + head -1 pattern already used in release-channels.mdx lines 92–95:

SNAP_TAG=$(curl -fsSL https://api.github.com/repos/wheels-dev/wheels-snapshots/releases \
  | sed -nE 's/.*"tag_name": *"v([^"]+)".*/\1/p' | head -1)
SNAP_FILENAME_VER="${SNAP_TAG//-/.}"
curl -fsSLO "https://github.com/wheels-dev/wheels-snapshots/releases/download/v${SNAP_TAG}/wheels_${SNAP_FILENAME_VER}_amd64.deb"
sudo apt install "./wheels_${SNAP_FILENAME_VER}_amd64.deb"

2. release-channels.mdx lines 122–126 — Linux channel-switch snippet is comment-only and the wheels-be reference is unexplained

# apt/dnf sees the Conflicts: + Replaces: metadata and swaps the packages atomically.
# Use the install snippet from the appropriate channel above with wheels-be / wheels
# substituted in the URL — apt/dnf removes the old one as part of the transaction.

The macOS and Windows snippets have concrete, copy-pasteable commands. This one has none. More importantly, none of the install snippets above (lines 83–96) contain wheels-be as a filename component. The stable snippet downloads wheels_${WHEELS_VERSION}_amd64.deb; the bleeding-edge snippet downloads wheels-${WHEELS_FILENAME_VER}.x86_64.rpm. A user who reads "substitute wheels-be in the URL" cannot figure out what to substitute where.

If the snapshots packages are actually named wheels-be_*_amd64.deb / wheels-be-*.x86_64.rpm, those names need to appear explicitly so users know what to look for. If they are still named wheels (and the channel distinction is only the source repo), the comment is misleading — the right instruction is to install from the other channel's repo URL, not to substitute a filename component.

Suggested minimum fix: Add at least one concrete example command (mirroring macOS/Windows), and clarify whether a wheels-be-named package file exists in the snapshots repo.


Docs

3. release-channels.mdx line 94 — comment misdescribes the shell substitution

WHEELS_FILENAME_VER="${WHEELS_TAG//-/.}"  # GitHub Releases rewrites ~ to . in filenames

The code replaces - with . in the variable (tag 4.0.0-snapshot.1825 → fragment 4.0.0.snapshot.1825). The comment correctly explains why the dot form exists (GitHub Releases rewrites ~ to . in asset filenames; the internal package version is 4.0.0~snapshot.1825), but a reader will wonder why the substitution is //-/. when the comment says the rewrite is ~.. Suggested replacement:

WHEELS_FILENAME_VER="${WHEELS_TAG//-/.}"  # tag uses hyphen (4.0.0-snapshot.N); filename uses dot because GitHub Releases rewrites the internal ~snapshot.N form

4. installing.mdx lines 164–172 vs. line 160 — explicit JDK step contradicts the stated package dependency

Line 160 says "The package… depends on OpenJDK 21" and installation.mdx says "apt/dnf pulls it in alongside wheels". Step 1 then asks users to install OpenJDK 21 manually before installing the package. This creates two conflicting mental models for the same operation. Either drop step 1 and let the package manager pull in the declared dependency automatically (the simpler story, consistent with installation.mdx), or add a note explaining when a manual pre-install is genuinely needed (e.g., air-gapped environments where apt cannot resolve the transitive dependency).


Commits

Single commit docs(web/guides): replace nonexistent install.sh URL with working .deb/.rpm install — valid docs type, web/guides scope, subject under 100 chars. No issues.


@wheels-bot
Copy link
Copy Markdown
Contributor

wheels-bot Bot commented May 12, 2026

Wheels Bot — Reviewer B (round 1)

A's review is substantively correct: all four findings are valid, the CHANGES_REQUESTED verdict is appropriate, and there's no sycophancy. One missed issue: the identical broken bleeding-edge instruction appears in a second file A didn't flag. Not aligned until that's added.

Sycophancy

None detected. A gave CHANGES_REQUESTED and cited specific lines before drawing any conclusion.

False positives

None detected. I re-read the cited lines for each finding:

  • Finding 1: Confirmed. installing.mdx step 2 calls /releases/latest; release-channels.mdx itself (line 91, not touched by this PR) already documents that wheels-snapshots publishes only pre-releases and that /releases/latest won't return them. The Aside's "substitute ... in the URLs above" instruction silently sets WHEELS_VERSION to empty.
  • Finding 2: Confirmed. The release-channels.mdx Linux channel-switch block is entirely comments; no executable command exists. The wheels-be token appears in the comment prose but in none of the surrounding install snippets (which name assets wheels_${...}_amd64.deb and wheels-${...}.x86_64.rpm).
  • Finding 3: The comment isn't strictly wrong — GitHub Releases does rewrite ~ to . in asset filenames — but A is right that the code substitutes -. while the comment says the rewrite is ~.. A reader has to work out the chain themselves. A's suggested rephrasing resolves the gap.
  • Finding 4: Confirmed. installation.mdx says apt/dnf pulls in OpenJDK 21 automatically as a declared dependency; installing.mdx step 1 asks the user to install it manually first. The contradiction is real, even if the manual step is technically harmless.

Missed issues

installation.mdx — identical broken bleeding-edge substitution (same root cause as finding 1)

The new Linux section in installation.mdx ends with:

For the bleeding-edge channel (every merge to develop), substitute wheels-dev/wheels-snapshots for wheels-dev/wheels in the URLs above.

The "URLs above" in installation.mdx also call /releases/latest:

WHEELS_VERSION=$(curl -fsSL https://api.github.com/repos/wheels-dev/wheels/releases/latest \
  | sed -nE 's/.*"tag_name": *"v([^"]+)".*/\1/p')

Substituting wheels-snapshots for wheels in that URL produces /repos/wheels-dev/wheels-snapshots/releases/latest, which returns nothing for a pre-release-only repo. WHEELS_VERSION is set to empty and the download URL becomes malformed — the same failure A described for installing.mdx. A flagged the installing.mdx Aside but didn't flag the corresponding prose in installation.mdx. Both need a self-contained snippet that uses /releases + head -1 instead of the substitution shortcut.

Verdict alignment

A's CHANGES_REQUESTED verdict is consistent with findings 1 and 2 alone (broken user-facing install command and a non-executable code block). Correct.

Convergence

Not aligned yet. A needs to add the installation.mdx bleeding-edge prose to finding 1 — it's the same bug, same fix (self-contained snippet using /releases + head -1), just in the reference guide rather than the tutorial. Once A acknowledges that finding, all issues will be covered and the consensus will be CHANGES_REQUESTED on the same grounds A already stated.

@bpamiri bpamiri mentioned this pull request May 12, 2026
5 tasks
Copy link
Copy Markdown
Contributor

@wheels-bot wheels-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wheels Bot — Reviewer A response (round 1)

B's critique is well-founded. All four original findings stand, and B correctly identified a fifth bug I missed: the installation.mdx reference guide contains the same broken bleeding-edge substitution as installing.mdx. The "substitute ... in the URLs above" prose in installation.mdx points at a /releases/latest call, which silently fails against a pre-release-only repo. Conceding that finding. Verdict stays CHANGES_REQUESTED on the same grounds, now covering both files.

Conceded points

  • installation.mdx bleeding-edge prose (B's missed-issue finding): The new Linux section in installation.mdx (added in this PR) ends with: "For the bleeding-edge channel … substitute wheels-dev/wheels-snapshots for wheels-dev/wheels in the URLs above." The URLs above use /releases/latest (diff lines +56–58 and +62–64), which returns nothing for a pre-release-only repo. Substituting the repo name produces an empty WHEELS_VERSION and a malformed download URL — the same failure mode I described for installing.mdx finding 1. I did not flag this in my initial review. B was correct to surface it.

Defended points

  • Finding 1 (installing.mdx Aside): Confirmed. The Aside instructs URL substitution against /releases/latest; same root cause as the conceded installation.mdx issue.
  • Finding 2 (release-channels.mdx Linux switch snippet): Confirmed. The snippet is entirely comments with no executable command and references wheels-be as a URL component that does not appear in any surrounding install snippet.
  • Finding 3 (release-channels.mdx line 94 comment): Confirmed. The substitution is /-/. but the comment describes the rewrite as ~.. The comment needs one more clause to bridge the gap.
  • Finding 4 (installing.mdx step 1 vs. stated package dependency): Confirmed. Asking users to manually install OpenJDK 21 contradicts both the introductory prose and installation.mdx's claim that apt/dnf pulls it in automatically as a declared dependency.

Updated verdict

Still CHANGES_REQUESTED: findings 1 and 2 (now covering both installing.mdx and installation.mdx) leave users with either a silently broken install command or no command at all; those must be fixed before the docs are usable for the Linux path this PR is introducing.

bpamiri added a commit that referenced this pull request May 12, 2026
…tch docs

Wheels-bot's Reviewer A + Reviewer B caught five issues with the previous
revision of #2604. All five address the same root tension: the docs read
as if the BE channel mirrors the stable channel filename-for-filename and
API-call-for-API-call, but the underlying release pipeline (release.yml
hardcoding CHANNEL=stable, GitHub /releases/latest excluding pre-releases)
makes the asymmetry user-visible.

1. installing.mdx Aside (bot finding 1) — the "substitute repo name in the
   URLs above" prose pointed at /releases/latest, which returns nothing
   against the pre-release-only snapshots repo. WHEELS_VERSION would be
   empty and the download URL would 404 silently. Replaced with two
   self-contained snippets (Debian/Ubuntu + Fedora/RHEL) using /releases
   + head -1, matching the pattern already used in release-channels.mdx.

2. release-channels.mdx Linux switch block (bot finding 2) — the previous
   block was comments-only with no executable command, and referenced
   "wheels-be" as a filename component that doesn't exist (release.yml
   hardcodes CHANNEL=stable, so both stable and snapshot publish a single
   package literally named `wheels`). Replaced with concrete stable →
   bleeding-edge and bleeding-edge → stable command blocks. Noted the
   --allow-downgrades requirement for BE → stable on apt (4.0.0 sorts
   below 4.0.1~snapshot.500 per dpkg).

3. release-channels.mdx comment on the version substitution (bot finding
   3) — the inline comment said "GitHub Releases rewrites ~ to ." but the
   shell substitution is /-/. The reader had to chain three concepts
   themselves (tag uses hyphen → internal package version uses tilde →
   GitHub mangles tilde to dot at upload). Expanded the comment to spell
   the chain out explicitly.

4. installing.mdx step 1 (bot finding 4) — the manual `sudo apt install
   openjdk-21-jre-headless` step contradicted both the intro paragraph
   ("depends on OpenJDK 21") and installation.mdx ("apt/dnf pulls it in
   alongside wheels"). Dropped step 1 entirely; reworded the intro to
   spell out the auto-pull behavior explicitly. Step 2 (install) and
   step 3 (verify) renumber to 1 and 2.

5. installation.mdx BE prose (Reviewer B's missed-issue finding) — same
   root cause as #1, in the deeper reference doc. Same fix: replace the
   "substitute the repo name" prose with two self-contained BE snippets
   using /releases + head -1.

Also added a brief BE pointer to the Linux upgrade tab, mirroring the
"# or, for the bleeding-edge channel:" line in the Windows upgrade tab.

Verified the BE snippet end-to-end:
  SNAP_TAG=$(curl ... /repos/wheels-dev/wheels-snapshots/releases | ... | head -1)
  → 4.0.0-snapshot.1826
  → URL: .../v4.0.0-snapshot.1826/wheels_4.0.0.snapshot.1826_amd64.deb
  → HTTP 302 (redirect to release-assets.githubusercontent.com)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@bpamiri
Copy link
Copy Markdown
Collaborator Author

bpamiri commented May 12, 2026

Addressed all five findings from Reviewer A + Reviewer B's missed-issue catch (commit ea694d962). Mapping for the next review pass:

Finding File Fix
1. broken BE Aside installing.mdx Replaced "substitute the repo name" prose with two self-contained snippets (Debian + RHEL) using /releases + head -1
2. comment-only Linux switch block release-channels.mdx Replaced with concrete stable→BE and BE→stable command blocks. Noted the --allow-downgrades requirement for the BE→stable direction on apt. Also clarified the macOS/Windows vs Linux split in the section intro paragraph (Linux only publishes one package name today — the channel distinction lives in the source repo)
3. confusing -. comment release-channels.mdx Expanded the comment to chain all three concepts (tag uses hyphen → internal package version uses tilde → GitHub Releases rewrites tilde to dot at upload time → substitution converts tag's hyphen to URL's dot)
4. JDK step contradicts dep installing.mdx Dropped step 1 (the manual apt install openjdk-21-jre-headless). Intro paragraph now reads "declares OpenJDK 21 as a runtime dependency (so apt/dnf pulls a JDK in automatically)" — consistent with installation.mdx. Steps renumber 2→1, 3→2
5 (B's missed). installation.mdx BE prose installation.mdx Same root cause as #1, same fix: two self-contained BE snippets

Verified the BE snippet end-to-end against wheels-dev/wheels-snapshots v4.0.0-snapshot.1826 — the generated URL wheels_4.0.0.snapshot.1826_amd64.deb returns HTTP 302 (redirect to the release-assets host).

Also added a one-line BE pointer to the Linux upgrade tab so it mirrors the Windows tab's scoop update wheels-be callout.

Copy link
Copy Markdown
Contributor

@wheels-bot wheels-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wheels Bot — Reviewer A

TL;DR: All five issues from the previous review cycle are resolved — the installing.mdx Aside and installation.mdx bleeding-edge prose both use self-contained /releases + head -1 snippets; the release-channels.mdx Linux switch section has concrete executable commands; the version-substitution comment is expanded to walk through the full three-step chain; the contradictory manual JDK step is gone. Two gaps remain that a RHEL/Fedora user or a Windows Scoop user would hit: the Linux channel-switch section only shows apt/.deb commands (the .rpm/dnf counterparts are missing), and there is no "Windows (Scoop) — bleeding-edge → stable" snippet. Neither rises to a blocking correctness failure — the shown commands are correct and the existing snippets elsewhere in the file are close enough to adapt — so the verdict is comment.


Correctness

1. release-channels.mdx lines 127–146 — Linux switching section covers apt/deb only; no dnf/rpm commands for either direction

# Use the bleeding-edge install snippet from "Installing each channel" above
# (the wheels-dev/wheels-snapshots URLs). apt/dnf sees a newer version
# (e.g. 4.0.1~snapshot.500 sorts above the most recent stable 4.0.0) and
# upgrades in place — no uninstall step needed.
SNAP_TAG=$(...)
SNAP_FILENAME_VER="${SNAP_TAG//-/.}"
curl -fsSLO "...wheels_${SNAP_FILENAME_VER}_amd64.deb"
sudo apt install "./wheels_${SNAP_FILENAME_VER}_amd64.deb"
# apt treats this as a downgrade ... so add --allow-downgrades.
# dnf handles downgrades transparently with `dnf downgrade`.
...
sudo apt install --allow-downgrades "./wheels_${WHEELS_VERSION}_amd64.deb"

Both blocks name dnf in their comments but show only apt commands. The "bleeding-edge → stable" case is the harder gap: the comment tells a Fedora/RHEL user to use dnf downgrade but gives no URL to pass to it. Constructing the correct URL requires synthesising the version-resolution pattern from the "Installing each channel" section (which uses dnf install <url>, not dnf downgrade <url>) and knowing that the stable filename drops the snapshot suffix. A user following this page literally is stuck.

Suggested additions alongside each existing block:

SNAP_TAG=$(curl -fsSL https://api.github.com/repos/wheels-dev/wheels-snapshots/releases \
  | sed -nE 's/.*"tag_name": *"v([^"]+)".*/\1/p' | head -1)
SNAP_FILENAME_VER="${SNAP_TAG//-/.}"
sudo dnf install "https://github.com/wheels-dev/wheels-snapshots/releases/download/v${SNAP_TAG}/wheels-${SNAP_FILENAME_VER}.x86_64.rpm"
WHEELS_VERSION=$(curl -fsSL https://api.github.com/repos/wheels-dev/wheels/releases/latest \
  | sed -nE 's/.*"tag_name": *"v([^"]+)".*/\1/p')
sudo dnf downgrade "https://github.com/wheels-dev/wheels/releases/download/v${WHEELS_VERSION}/wheels-${WHEELS_VERSION}.x86_64.rpm"

2. release-channels.mdx lines 148–151 — Missing Windows (Scoop) bleeding-edge → stable snippet

scoop uninstall wheels
scoop install wheels-be

This direction exists; the reverse does not. macOS now shows both directions, Linux shows both, Scoop shows only one. The fix is symmetric to the macOS pair and trivial:

scoop uninstall wheels-be
scoop install wheels

Security

3. installation.mdx / installing.mdx — no integrity check on downloaded packages

The install snippets download packages over HTTPS but do not verify a detached checksum or signature before calling apt install ./…:

curl -fsSLO "https://github.com/wheels-dev/wheels/releases/download/v${WHEELS_VERSION}/wheels_${WHEELS_VERSION}_amd64.deb"
sudo apt install "./wheels_${WHEELS_VERSION}_amd64.deb"

The PR description explicitly positions this as Phase 1 behavior and notes that Phase 2 adds proper GPG-signed apt/yum repos. That context is clear to someone who reads the PR, but a user hitting just the docs page sees no caveats on the trust model. A one-line note alongside the Phase 1 <Aside> — e.g. "Until the native repos are live, download integrity relies on GitHub's HTTPS transport; there is no detached signature to verify" — would set expectations correctly.


Commits

4. Both commits lack DCO Signed-off-by: trailers

CONTRIBUTING.md § DCO (merged in #2575, which appears in the ancestry of this branch) requires every commit to carry:

Signed-off-by: Peter Amiri <peter@alurium.com>

Neither 39e6689e1 nor ea694d962 has this trailer. The DCO GitHub App (https://github.com/apps/dco) is listed as a required status check in CONTRIBUTING.md; it does not appear in the current check list, which suggests the App may not be installed yet on this repo. Flagging preemptively — once the App is wired up, this will block merge. The fix (from CONTRIBUTING.md lines 65–72):

git rebase --signoff HEAD~2
git push --force-with-lease

bpamiri and others added 3 commits May 11, 2026 22:20
…b/.rpm install

The Linux tabs on the start-here installing guide and the upgrade flow pointed
at `https://get.wheels.dev/install.sh` — a URL that was planned for the Phase 2
universal installer but doesn't exist yet. Users on Linux hit a 404 and a
confusing `bash: command not found` chain.

Rewrite all three install-related guides to use the .deb/.rpm packages that
release.yml already produces (verified on snapshot v4.0.0-snapshot.1825). The
new snippets resolve the latest version dynamically via the GitHub API, so
they keep working as releases roll over.

- start-here/installing.mdx: Linux install + upgrade tabs; troubleshooting
  no longer references the never-existed `~/.wheels/env` file.
- command-line-tools/installation.mdx: split the "macOS and Linux (Homebrew)"
  section — Linux now has its own `.deb`/`.rpm` section with the package layout
  and an Aside flagging native apt/yum repos as a v4.0.x follow-up.
- start-here/release-channels.mdx: replace literal `<version>` placeholders
  with the API-driven version resolution; extend the "Switching channels"
  section beyond Homebrew (Linux uses Conflicts:/Replaces: metadata, Scoop
  refuses dual install).

Phase 2 (native apt.wheels.dev / yum.wheels.dev repositories) is planned as a
follow-up — see tools/distribution-drafts/linux-packages/README.md for the
full plan.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>
…tch docs

Wheels-bot's Reviewer A + Reviewer B caught five issues with the previous
revision of #2604. All five address the same root tension: the docs read
as if the BE channel mirrors the stable channel filename-for-filename and
API-call-for-API-call, but the underlying release pipeline (release.yml
hardcoding CHANNEL=stable, GitHub /releases/latest excluding pre-releases)
makes the asymmetry user-visible.

1. installing.mdx Aside (bot finding 1) — the "substitute repo name in the
   URLs above" prose pointed at /releases/latest, which returns nothing
   against the pre-release-only snapshots repo. WHEELS_VERSION would be
   empty and the download URL would 404 silently. Replaced with two
   self-contained snippets (Debian/Ubuntu + Fedora/RHEL) using /releases
   + head -1, matching the pattern already used in release-channels.mdx.

2. release-channels.mdx Linux switch block (bot finding 2) — the previous
   block was comments-only with no executable command, and referenced
   "wheels-be" as a filename component that doesn't exist (release.yml
   hardcodes CHANNEL=stable, so both stable and snapshot publish a single
   package literally named `wheels`). Replaced with concrete stable →
   bleeding-edge and bleeding-edge → stable command blocks. Noted the
   --allow-downgrades requirement for BE → stable on apt (4.0.0 sorts
   below 4.0.1~snapshot.500 per dpkg).

3. release-channels.mdx comment on the version substitution (bot finding
   3) — the inline comment said "GitHub Releases rewrites ~ to ." but the
   shell substitution is /-/. The reader had to chain three concepts
   themselves (tag uses hyphen → internal package version uses tilde →
   GitHub mangles tilde to dot at upload). Expanded the comment to spell
   the chain out explicitly.

4. installing.mdx step 1 (bot finding 4) — the manual `sudo apt install
   openjdk-21-jre-headless` step contradicted both the intro paragraph
   ("depends on OpenJDK 21") and installation.mdx ("apt/dnf pulls it in
   alongside wheels"). Dropped step 1 entirely; reworded the intro to
   spell out the auto-pull behavior explicitly. Step 2 (install) and
   step 3 (verify) renumber to 1 and 2.

5. installation.mdx BE prose (Reviewer B's missed-issue finding) — same
   root cause as #1, in the deeper reference doc. Same fix: replace the
   "substitute the repo name" prose with two self-contained BE snippets
   using /releases + head -1.

Also added a brief BE pointer to the Linux upgrade tab, mirroring the
"# or, for the bleeding-edge channel:" line in the Windows upgrade tab.

Verified the BE snippet end-to-end:
  SNAP_TAG=$(curl ... /repos/wheels-dev/wheels-snapshots/releases | ... | head -1)
  → 4.0.0-snapshot.1826
  → URL: .../v4.0.0-snapshot.1826/wheels_4.0.0.snapshot.1826_amd64.deb
  → HTTP 302 (redirect to release-assets.githubusercontent.com)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>
…se paths

Round-2 bot findings:

1. release-channels.mdx Switching channels — the Linux blocks named dnf in
   their comments but only showed apt commands, leaving Fedora/RHEL users
   without a usable command. Split each direction into a Debian/Ubuntu
   block and a Fedora/RHEL block. For the BE → stable direction, dnf gets
   `dnf downgrade <url>` (the rpm-native way to handle an older-version
   transition); apt keeps its --allow-downgrades trick.

2. release-channels.mdx Switching channels — Scoop only had stable → BE;
   added the symmetric bleeding-edge → stable block to match the macOS
   pair.

3. Trust-model documentation — Phase 1 ships .deb/.rpm without detached
   GPG signatures, so download integrity depends solely on GitHub's HTTPS
   transport. Added a `<Aside type="caution">` on both installing.mdx (the
   onboarding guide) and installation.mdx (the deeper reference) noting
   this explicitly and pointing forward to the Phase 2 signed repos at
   apt.wheels.dev / yum.wheels.dev.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>
@bpamiri bpamiri force-pushed the claude/hopeful-montalcini-3c6889 branch from ea694d9 to 525b37e Compare May 12, 2026 05:20
@bpamiri
Copy link
Copy Markdown
Collaborator Author

bpamiri commented May 12, 2026

Round 2 addressed (commits 9bdf4c915 / 57f618d73 / 525b37ed4 after rebase). Mapping to A's round-2 findings:

Finding Fix
1. Linux switch shows apt only Split each switch direction into a Debian/Ubuntu block and a Fedora/RHEL block. The BE → stable Fedora block uses dnf downgrade <url>, which is the rpm-native way to handle the older-version transition (matches the bot's suggestion verbatim)
2. Missing Scoop bleeding-edge → stable Added the symmetric block matching the macOS pair
3. No trust-model note Added <Aside type="caution" title="Trust model during Phase 1"> to both installing.mdx (the onboarding guide) and installation.mdx (the reference doc) explicitly calling out that Phase 1 ships unsigned .deb/.rpm artifacts and integrity rests on HTTPS transport. Points forward to the Phase 2 signed apt/yum repos
4. Missing DCO Signed-off-by: trailers Rebased with --signoff — all three commits now carry Signed-off-by: Peter Amiri <peter@alurium.com>. Verified per-commit

Force-pushed with --force-with-lease as the CONTRIBUTING.md DCO section prescribes.

@wheels-bot
Copy link
Copy Markdown
Contributor

wheels-bot Bot commented May 12, 2026

Wheels Bot — Reviewer B (round 1)

A's review is accurate and evidence-backed. All four findings are confirmed against the diff. The verdict of comment slightly undershoots: findings 1 and 2 are real documentation gaps a user would hit, not just advisory suggestions — but the reasoning is coherent and the suggested snippets are ready to apply. Aligning on changes needed.

Sycophancy

None detected. A gave COMMENTED with specific line citations before drawing any conclusion.

False positives

None detected. I re-read the cited diff lines for each finding:

  • Finding 1: Confirmed. Both Linux channel-switch blocks (release-channels.mdx lines 127-146) contain only apt/.deb commands. The comments mention dnf but supply no executable dnf command. A Fedora/RHEL user following the "Switching channels" section literally cannot complete the task from those docs alone -- especially the bleeding-edge to stable direction, where the comment says "dnf handles downgrades transparently with dnf downgrade" but gives no URL or command.
  • Finding 2: Confirmed. The diff adds only the Scoop stable-to-bleeding-edge block; the reverse direction is absent. macOS shows both directions; Scoop shows one.
  • Finding 3: Confirmed. The install snippets download .deb/.rpm over HTTPS from GitHub with no checksum step. A's suggested one-liner note is accurate, though the PR body already documents the Phase 1/Phase 2 split.
  • Finding 4: Confirmed. Both commits (39e6689e1 and ea694d962) have Co-Authored-By: trailers but no Signed-off-by: trailers. A's hedging about the DCO app installation status is appropriate.

Missed issues

None worth escalating. A caught the four substantive gaps. The version-semantics comment ("e.g. 4.0.1~snapshot.500 sorts above the most recent stable 4.0.0") is correct for the intended post-GA scenario where bleeding-edge builds toward the next minor.

Verdict alignment

A's COMMENTED verdict is consistent with the stated reasoning -- A explicitly called both gaps non-blocking correctness failures. I'd call findings 1 and 2 request-changes territory (a RHEL/Fedora user and a Windows Scoop user are each left with an incomplete "Switching channels" story), but A provided exact actionable snippets for both, which makes the substance right even if the verdict label is conservative.

Finding 4 (DCO) cannot be addressed by the bot -- it requires the PR author to git rebase --signoff HEAD~2 and push. This should be handled by the human author, not by the address-review bot.

Convergence

Aligned. Joint recommendation: apply findings 1 and 2 (add the missing dnf/.rpm channel-switch commands and the Scoop wheels-be to wheels snippet). Finding 3 (integrity note) is optional. Finding 4 (DCO) requires human action outside the bot's scope -- flagging to the PR author separately.

Copy link
Copy Markdown
Contributor

@wheels-bot wheels-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wheels Bot — Reviewer A

TL;DR: All five issues raised across the two previous review cycles are addressed in this revision: the broken bleeding-edge snippet in installing.mdx is replaced with self-contained snippets; installation.mdx gets the same treatment; the Linux switch section in release-channels.mdx has concrete executable commands for all four distro × direction combinations; the Scoop reverse path is added; and the trust-model <Aside type="caution"> documenting Phase 1 GPG limitations is present in both install guides. All three commits carry valid docs(web/guides): ... subjects and DCO Signed-off-by trailers. One nit remains.


Docs

1. release-channels.mdx lines 83–99 — "Installing each channel" Linux tab covers only two of four combinations

The Linux tab in the "Installing each channel" section shows two snippets:

WHEELS_VERSION=$(curl …/wheels/releases/latest …)
…
sudo apt install "./wheels_${WHEELS_VERSION}_amd64.deb"
WHEELS_TAG=$(curl …/wheels-snapshots/releases …)
…
sudo dnf install "https://…/wheels-${WHEELS_FILENAME_VER}.x86_64.rpm"

The pairing is diagonal: apt stable and dnf bleeding-edge. A Fedora/RHEL user looking for the stable install command, or a Debian/Ubuntu user looking for the bleeding-edge command in this section, finds neither. Both full sets of snippets exist in installing.mdx and installation.mdx, so the information is not lost — but release-channels.mdx is where a user lands when they want to compare or install a specific channel, so the gap is noticeable.

Suggested minimum fix: add the two missing snippet titles (either inline or as a labelled group), or add a note pointing to the corresponding section in installing.mdx for the missing combinations. The Switching channels section (added in round 2) already has all four distro × direction blocks, so the pattern is established — it just wasn't carried back to the Installing section.


Commits

Three commits, all conforming to commitlint:

  • docs(web/guides): replace nonexistent install.sh URL with working .deb/.rpm install — valid
  • docs(web/guides): fix bot-flagged issues on Linux install/upgrade/switch docs — valid
  • docs(web/guides): fill remaining gaps on Linux switch and Scoop reverse paths — valid

All three carry Signed-off-by: Peter Amiri <peter@alurium.com>. DCO gate is clear.


Round-3 bot finding: the "Installing each channel" Linux tab in
release-channels.mdx showed only two of four distro × channel combinations
— Debian/Ubuntu (stable) with apt, and Fedora/RHEL (bleeding-edge) with
dnf. The diagonal pairing left a Fedora user looking for the stable rpm
install or a Debian user looking for the bleeding-edge .deb install with
no command they could copy out of this section.

Added the two missing snippets to make the full 2×2 (apt/dnf ×
stable/bleeding-edge) explicit, mirroring the structure already
established in the round-2 "Switching channels" section.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>
@bpamiri
Copy link
Copy Markdown
Collaborator Author

bpamiri commented May 12, 2026

Round 3 addressed (commit `bf92eff7c`). Fixed A's nit on `release-channels.mdx` "Installing each channel" Linux tab: the previous revision showed a diagonal pairing (Debian/stable + Fedora/BE), leaving two combinations unaddressed. Added the two missing snippets so the section now mirrors the 2×2 structure already established in "Switching channels":

  • Debian / Ubuntu (stable) ✓ existed
  • Fedora / RHEL (stable) ✓ new
  • Debian / Ubuntu (bleeding-edge) ✓ new
  • Fedora / RHEL (bleeding-edge) ✓ existed

All four use the same version-resolution patterns and tag→filename translation already documented inline. Trailer on `bf92eff7c` carries `Signed-off-by: Peter Amiri peter@alurium.com`.

B's round-1 comment shown alongside is the historical convergence record against the round-1 SHA (`ea694d962`) — those findings (1–4) were fully addressed in round 2; the round-3 nit is the only outstanding item, now closed.

@wheels-bot
Copy link
Copy Markdown
Contributor

wheels-bot Bot commented May 12, 2026

Wheels Bot — Reviewer B (round 1)

A's review is accurate and concise. The single finding is confirmed against the diff, there is no sycophancy, and no false positives. The COMMENTED verdict is defensible given the information exists in other guides, though the gap is real enough to warrant a fix. Converging on changes needed.

Sycophancy

None detected. A cited specific line context before drawing any conclusion.

False positives

None detected. I re-read the relevant diff section:

  • Finding 1 (diagonal snippet pairing): Confirmed. release-channels.mdx lines 83-99 have exactly two blocks: "Debian / Ubuntu (stable)" (apt, stable channel) and "Fedora / RHEL (bleeding-edge)" (dnf, snapshots channel). Both full sets are present in installing.mdx and installation.mdx, but this section is the natural landing page for a user deciding between channels, so the missing "Fedora / RHEL (stable)" and "Debian / Ubuntu (bleeding-edge)" blocks are a real gap. A's description is accurate.

Missed issues

None detected. The Switching channels section has all four distro x direction combinations for Linux plus both directions for macOS and Scoop. Commits are valid (docs(web/guides): type, subjects within 100 chars, not ALL-CAPS). All three commits carry Signed-off-by trailers; the DCO gate is clear.

Verdict alignment

A's COMMENTED verdict is consistent with the reasoning -- A explicitly noted the information is available elsewhere, framing the gap as a quality issue rather than a functional blocker. I'd lean CHANGES_REQUESTED given that a user reading this section to pick a channel+distro combination will find the section incomplete on its face, but COMMENTED with a concrete, actionable suggestion (add the two missing snippet titles or add a pointer to installing.mdx) is coherent.

Convergence

Aligned. A has one concrete finding and a clear suggested fix. Both A and B agree the diagonal pairing should be completed. Emitting converged-changes so the address-review bot can apply the fix.

@bpamiri
Copy link
Copy Markdown
Collaborator Author

bpamiri commented May 12, 2026

B's review is converging against SHA `525b37ed4` (round-2 HEAD); the finding it confirms (the diagonal pairing in "Installing each channel") was already fixed in `bf92eff7c` (round 3). Verified the two missing snippet titles are present on the current HEAD:

```
$ grep -c 'title="Fedora / RHEL (stable)"\|title="Debian / Ubuntu (bleeding-edge)"' \
web/sites/guides/src/content/docs/v4-0-0-snapshot/start-here/release-channels.mdx
2
```

Section now has all four distro × channel combinations. No additional code change needed; the next Reviewer A pass against `bf92eff7c` should confirm clean.

Copy link
Copy Markdown
Contributor

@wheels-bot wheels-bot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wheels Bot — Reviewer A

TL;DR: All findings from the previous three review cycles are now resolved. This final commit fills the diagonal gap in release-channels.mdx's "Installing each channel" Linux tab that was flagged in round 3 — the full 2×2 (apt/dnf × stable/bleeding-edge) is now explicit and every snippet is functionally correct. One very minor docs asymmetry remains, but it is cosmetic only. This PR is ready to merge.


Docs

1. release-channels.mdx lines 108–113 — "Fedora / RHEL (bleeding-edge)" snippet omits the explanatory comments present in the sibling block above it

The new "Debian / Ubuntu (bleeding-edge)" block (lines 96–106) carries two helpful comments:

# The bleeding-edge channel publishes only pre-releases, so use /releases (not /releases/latest).
...
# Tag uses a SemVer hyphen (4.0.0-snapshot.N). The on-disk asset name uses a dot
# in the same slot because GitHub Releases rewrites the package's internal
# ~snapshot.N form to . at upload time. So translate hyphen → dot for the URL.

The immediately following "Fedora / RHEL (bleeding-edge)" block (lines 108–113) has neither comment. A user reading the .rpm block in isolation (e.g. via a search-engine hit on the anchor) has no inline explanation for why /releases is used instead of /releases/latest, or why ${WHEELS_TAG//-/.} is needed. The two blocks are adjacent, so a sequential reader gets the context, but a tiny note like # See Debian/Ubuntu block above for an explanation of /releases and the hyphen→dot substitution would close the gap.

This is cosmetic — the snippet is functionally correct — so it does not block merge.


Prior findings — disposition

All issues raised over rounds 1–3 are resolved:

Round Finding Status
1 installing.mdx bleeding-edge Aside used /releases/latest (silent fail) Fixed
1 release-channels.mdx Linux switch section was comment-only, no executable commands Fixed
1 Version-substitution comment misattributed the ~. rewrite Fixed
1 Contradictory manual JDK install step Fixed
2 Missing DCO Signed-off-by trailers Fixed
2 Linux dnf channel-switch snippets absent Fixed
2 Windows (Scoop) reverse-path snippet absent Fixed
2 Trust-model caveat (Phase 1 GPG limitation) undocumented Fixed
3 Diagonal gap in "Installing each channel" Linux tab (only 2 of 4 combinations shown) Fixed in this commit

Commits

Four commits, all conforming to commitlint:

  • docs(web/guides): replace nonexistent install.sh URL with working .deb/.rpm install — valid
  • docs(web/guides): fix bot-flagged issues on Linux install/upgrade/switch docs — valid
  • docs(web/guides): fill remaining gaps on Linux switch and Scoop reverse paths — valid
  • docs(web/guides): fill diagonal gap in Installing each channel Linux tab — valid

All four carry Signed-off-by: Peter Amiri <peter@alurium.com>. DCO gate is clear.

@wheels-bot
Copy link
Copy Markdown
Contributor

wheels-bot Bot commented May 12, 2026

Wheels Bot — Address Review (round 1)

Convergence at 525b37ed4 reached on a single finding from Reviewer A and Reviewer B:

  • release-channels.mdx lines 83–99 — diagonal snippet pairing. The "Installing each channel" Linux tab showed only Debian / Ubuntu (stable) (apt) and Fedora / RHEL (bleeding-edge) (dnf), leaving a Fedora user looking for the stable .rpm or a Debian user looking for the bleeding-edge .deb without a command in this section.

This finding is already addressed in commit bf92eff7c by the PR author, which adds the two missing snippets (Fedora / RHEL (stable) and Debian / Ubuntu (bleeding-edge)) so the section now presents the full 2×2 of apt/dnf × stable/bleeding-edge. No additional bot changes needed.

A fresh Reviewer A run will fire on the updated head (bf92eff7c); the convergence loop continues until reviewers align on approve or the outer-loop cap (5 rounds) is reached.

@wheels-bot
Copy link
Copy Markdown
Contributor

wheels-bot Bot commented May 12, 2026

Wheels Bot — Reviewer B (round 1)

A's review is accurate and well-supported. The single cosmetic finding is confirmed by the diff. One additional cosmetic gap: a broken internal anchor in the upgrade section that A didn't flag. Both items are non-blocking. Aligning on approve.

Sycophancy

None detected. A gave APPROVED only after accounting for every prior finding in a disposition table and citing specific line context for the one remaining nit. The approval is evidence-backed.

False positives

None detected. I re-read the relevant diff lines:

  • Finding 1 (missing comments in Fedora/RHEL bleeding-edge block): Confirmed. The release-channels.mdx "Debian / Ubuntu (bleeding-edge)" block (lines ~96–106 in the diff) carries two inline comment blocks explaining (a) why /releases is used instead of /releases/latest and (b) why ${WHEELS_TAG//-/.} is needed. The immediately adjacent "Fedora / RHEL (bleeding-edge)" block has neither comment. A's description is accurate.

Missed issues

installing.mdx — upgrade section references a non-existent anchor #install-the-cli

The new upgrade prose for Linux reads:

For the bleeding-edge channel, run the install snippet from the bleeding-edge Aside — it points at wheels-dev/wheels-snapshots...

The target Aside has title="Want bleeding-edge?" — not "Install the CLI" — and it's an <Aside> component, not a heading. Astro Starlight generates navigable anchors from headings, not from Aside titles. #install-the-cli won't resolve; the link silently goes nowhere.

The surrounding text is clear enough that a reader will still find the Aside above, so this is cosmetic and non-blocking — but it should be fixed (either correct the anchor to match the section heading it appears under, or rewrite the sentence as prose without a fragment link).

Verdict alignment

A's APPROVED verdict is consistent with the findings: all previously raised issues are resolved, the one remaining nit is explicitly labeled cosmetic and non-blocking. Correct.

Convergence

Aligned. The missed anchor issue is cosmetic, the same severity as A's own finding. Neither item justifies another change cycle. Joint recommendation: approve and merge.

@bpamiri bpamiri merged commit c6f6cc6 into develop May 12, 2026
14 checks passed
@bpamiri bpamiri deleted the claude/hopeful-montalcini-3c6889 branch May 12, 2026 05:31
@bpamiri
Copy link
Copy Markdown
Collaborator Author

bpamiri commented May 12, 2026

Round 4: applied the two cosmetic nits from the converged-approve review (commit `9fca5d546`):

  • A's finding — Fedora/RHEL (bleeding-edge) block now carries the same two inline comments as the Debian/Ubuntu (bleeding-edge) block (the /releases vs /releases/latest rationale + the hyphen → dot translation explanation). Now symmetric.
  • B's missed-catch — `installing.mdx` upgrade prose linked to `#install-the-cli` which isn't a real anchor (Starlight only generates fragment anchors from headings, not from `` titles). Rewrote the sentence as plain prose pointing to the install snippet on the Linux tab above. No broken link.

Both reviewers had already converged on approve before this commit, so this is polish-only — no functional change. Trailer carries `Signed-off-by: Peter Amiri peter@alurium.com`.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant