From dd2d1feb6e8f9d5d93509966b98f74fd1e2fbb98 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 3 Aug 2026 12:34:20 +0200 Subject: [PATCH] release path publishes, and an unreleasable version fails CI (R-115, R-183) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NO VERSION BUMP and nothing built: no Go code changed. The agent stays v0.120.0. scripts/release-agent.sh — THE way to release. build -> tag -> publish -> verify by INDEPENDENT download. Publishing was a separate remembered step and was forgotten three times in five days (R-111's 17 stranded releases, 0.114.0, and 0.120.0 — deployed to both demo hosts and undownloadable, so a documented-path reinstall would have silently downgraded them WHILE REPORTING SUCCESS). R-111's own closing line named this leg and closed SHIPPED without it; it recurred the same afternoon, which is the evidence that a note is not a mechanism. It tags because felhom-host-install.sh now fetches the sixteen agent config files from raw/tag/v/ (R-183): a released version with no tag 404s a box mid-install, as root, on a virgin machine. It verifies by downloading what it just published and comparing the sha to what it built — the publish step's own success is a report on its own write; a fetch returning the right bytes is a different claim. It refuses a dirty/unpushed tree and refuses to re-release an existing version. It does NOT vouch: that points machines at a version and stays the operator's act. scripts/check-published-versions.py — the gate. Every v tag must have a downloadable package AND a tag tree serving the agent's configs. Registered as NOT --fast (needs network; a push must not fail because Gitea blinked), and the CI workflow now runs the FULL gate set instead of --fast — otherwise the gate would have been registered and never run, the built-but-never-wired failure this project has shipped four times. The invariant is not the one specified, and the reason was measured, not assumed: the hub artifact manifest is 401 without a per-customer passphrase and Gitea's package LISTING api is 401 without a token, while the package DOWNLOAD url and the git TAGS api are anonymous. So CI cannot ask "what is vouched" without an operator credential — whose addition is the operator's call. The tag-based invariant needs none and catches all three recorded instances. What it does not catch (the hub vouching a version never released at all) is filed as R-184. --- .gitea/workflows/gates.yml | 14 ++- CHANGELOG.md | 39 +++++++ CLAUDE.md | 14 ++- scripts/agent_gates.py | 7 ++ scripts/check-published-versions.py | 159 ++++++++++++++++++++++++++++ scripts/release-agent.sh | 133 +++++++++++++++++++++++ 6 files changed, 363 insertions(+), 3 deletions(-) create mode 100644 scripts/check-published-versions.py create mode 100755 scripts/release-agent.sh diff --git a/.gitea/workflows/gates.yml b/.gitea/workflows/gates.yml index cbc4587..622acdd 100644 --- a/.gitea/workflows/gates.yml +++ b/.gitea/workflows/gates.yml @@ -43,7 +43,19 @@ jobs: - name: Run the gate entry point # The ONLY thing CI runs. No go build, no go test, no linting, no deploy. The # exit code IS the result: no `|| true`, no pipe that could swallow it. - run: cd ws/felhom-agent && python3 scripts/agent_gates.py --fast + # + # THE FULL SET, NOT `--fast` (R-115, 2026-08-03). `--fast` means "no network and no + # container runtime" and exists for `.githooks/pre-push`, where a push must not fail + # because Gitea blinked or because someone is on a train. CI is the opposite machine: it + # has the network, it is not in anyone's way, and it is the half that emails. The + # published-versions gate — the R-115 mechanism, which asks Gitea whether a released + # version can actually be downloaded — is network-bound and therefore runs ONLY here. + # Leaving `--fast` in place would have registered that gate and never run it, which is the + # built-but-never-wired failure this project has shipped four times. + env: + # In-cluster, so the check does not depend on public DNS or the ingress TLS chain. + GITEA_BASE: http://gitea.gitea-system.svc.cluster.local:3000 + run: cd ws/felhom-agent && python3 scripts/agent_gates.py - name: Alarm on failure # THE POINT OF THE WHOLE THING. Probe P5 measured that a failed run produces NO mail, NO diff --git a/CHANGELOG.md b/CHANGELOG.md index 49e9e87..e6873f0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,42 @@ +## Releasing publishes, and an unreleasable version cannot pass CI (2026-08-03, R-115 + R-183) — **NO VERSION BUMP** + +**No Go code changed, so nothing is bumped and nothing was built.** This is the release path and a +gate; the agent stays **v0.120.0**. + +**`scripts/release-agent.sh` — THE way to release.** Build → **tag** → publish → **verify by an +independent download**. Publishing used to be a separate remembered step and was **forgotten three +times in five days** (R-111's seventeen stranded releases, 0.114.0, and 0.120.0 — which sat deployed +on both demo hosts and undownloadable, so a documented-path reinstall would have silently downgraded +them to the pre-merge agent *while reporting success*). R-111's own closing line named this leg and +closed SHIPPED without it; it recurred the same afternoon, which is the evidence that a note is not a +mechanism. + +- It **tags** because `felhom-host-install.sh` now fetches this version's sixteen config files from + `raw/tag/v/` (R-183) — a released version without a tag 404s a box mid-install, as root. +- It **verifies by downloading what it just published** and comparing the sha to what it built. The + publish step's own success is a report on its own write; a fetch returning the right bytes is a + different claim, and it is the one that matters. +- It **refuses** a dirty or unpushed tree, and refuses to re-release an existing version — one + version name must never mean two binaries. +- It **does NOT vouch.** Vouching points machines at a version and stays the operator's act. + +**`scripts/check-published-versions.py` — the gate (R-115 mechanism (b)).** Every `v` tag +must have a downloadable package AND a tag tree that serves the agent's configs. Registered in +`agent_gates.py` as **not `--fast`** (it needs network, and a push must not fail because Gitea +blinked), and **the CI workflow now runs the FULL gate set** rather than `--fast` — otherwise the +gate would have been registered and never run, which is the built-but-never-wired failure this +project has shipped four times. + +**The invariant is NOT the one the task specified, and the reason was measured.** The task asked for +*"the version the hub tells machines to install must be downloadable"*. That is the better invariant +and CI cannot see it: the hub's artifact manifest answers **401** without a per-customer passphrase, +and Gitea's package LISTING api answers **401** without a token, while the package DOWNLOAD url and +the git TAGS api are both anonymous. Putting an operator credential into CI to close that gap is the +operator's call, not a gate author's. The tag-based invariant needs no credential and **catches all +three recorded instances**, because the release script creates the tag and publishes in one act. +**What it does not catch — the hub vouching a version that was never released at all — is recorded +as R-184 rather than assumed away.** + ## docs — v0.120.0 PUBLISHED + vouched, and proven on two reinstalled boxes (2026-08-03, R-178) — **no version bump, nothing built** **Nothing shipped in this entry.** It records an operational fact the version history could not diff --git a/CLAUDE.md b/CLAUDE.md index fb4229d..b15a4d7 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -63,13 +63,23 @@ internal/storage/ storage observer + durable ids + role/claim classifiers + S > stays (it is a no-op when you work in this tree, and load-bearing if anything was pushed from > elsewhere). +> **RELEASING IS ONE COMMAND, AND IT PUBLISHES (R-115).** There used to be a raw `go build` line +> here and a *separate* "Publish" row, so publishing was a step someone had to remember — and it was +> **forgotten three times in five days**, the last leaving agent v0.120.0 deployed on both demo hosts +> and undownloadable, where a documented-path reinstall would have silently downgraded them while +> reporting success. Do not hand-roll the build: the script also creates the `v` git TAG +> that `felhom-host-install.sh` fetches this version's sixteen config files from (R-183), and it +> verifies by an **independent download** rather than trusting the publish step's own output. +> `scripts/publish-agent.sh` still exists and is still correct — the release script CALLS it rather +> than reimplementing it. + | Step | Where | One-liner | |---|---|---| -| Build | DooPlex (local) | `cd /mnt/5_hdd/felhom.eu/git/felhom-agent && git pull && go build -ldflags '-X main.version=' -o /tmp/felhom-agent- ./cmd/felhom-agent` | +| **Release** (build + tag + publish + verify) | DooPlex (local) | `GITEA_USER=admin GITEA_TOKEN= scripts/release-agent.sh ` — refuses a dirty/unpushed tree and refuses to re-release an existing version | | Copy | local → felhom-pve | `scp /tmp/felhom-agent- felhom-pve:/tmp/` (one hop) | | Deploy | felhom-pve | backup `.bak-` → `install -m0755` → `systemctl restart felhom-agent` (non-root `felhom-agent` user, config `/etc/felhom-agent/agent.json`) | | Ship configs | felhom-pve | sudoers (`/etc/sudoers.d/felhom-agent`) + guarded-mkfs wrapper WITH the binary when `configs/` changed | -| Publish | DooPlex (local) | `scripts/publish-agent.sh ` (REGISTRY_* creds); hub Day-0 manifest vouch = operator follow-up | +| **Vouch** | hub operator UI | Configs → Day-0 artifacts. **Deliberately NOT automated** — vouching is what points machines at a version, and it stays your act (prove-then-vouch) | | Verify | felhom-pve | `felhom-agent --version` + journal (clean ReassertGuestBinds, no capability degradation) | ## Proxmox model (the load-bearing rules) diff --git a/scripts/agent_gates.py b/scripts/agent_gates.py index 8b8221f..9166aef 100644 --- a/scripts/agent_gates.py +++ b/scripts/agent_gates.py @@ -9,6 +9,12 @@ Gates (all must pass; **non-zero exit on any failure**): 1. reuse-refs every path cited by this repo's REUSE.md still resolves + 2. published every `v` tag has a downloadable package AND a tag tree that serves + the agent's configs (R-115). NEEDS NETWORK, so it is **not** in `--fast` and + the pre-push hook does not run it — a push must not fail because Gitea blinked + or because someone is offline on a train. CI runs the FULL set for exactly this + reason: it is the machine that can afford a network check, and it is the half + that emails when something is wrong. WHY THIS FILE EXISTS, WITH ONE GATE (2026-08-02, R-29 leg (b)). @@ -39,6 +45,7 @@ SHARED_REUSE = os.path.join(os.path.dirname(ROOT), "felhom.eu", "scripts", "reus # (label, absolute script path, args, fast) GATES = [ ("reuse-refs", SHARED_REUSE, [ROOT], True), + ("published", os.path.join(ROOT, "scripts", "check-published-versions.py"), [], False), ] VERDICT = {0: "OK", 1: "FAILED", 2: "INCONCLUSIVE"} diff --git a/scripts/check-published-versions.py b/scripts/check-published-versions.py new file mode 100644 index 0000000..d7a2bcd --- /dev/null +++ b/scripts/check-published-versions.py @@ -0,0 +1,159 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- +"""check-published-versions.py — a released agent version must be INSTALLABLE, not merely built. + +R-115. A box installs the agent from a Gitea generic package the hub vouches, never from git, and +since R-110/R-183 it also fetches the agent's sixteen config files from `raw/tag/v/`. +Nothing in the build, deploy or session-end path checked that either existed, so "deployed" and +"installable" were independent states that drifted silently. **Three instances in five days:** + + * R-111 (2026-07-29) 17 releases v0.97.0-v0.113.0 built and never published — a new customer + would have installed without the whole R-82 tiered-backup arc, F-CRIT-2 and F-REBOOT. + * 0.114.0 (same afternoon) built, deployed to felhom-pve, never published. + * 0.120.0 (2026-08-03) built, committed, deployed to BOTH demo hosts, never published. A + documented-path reinstall would have silently DOWNGRADED both boxes to the pre-merge + agent — and would have *succeeded* while doing it. + +THE INVARIANT, AND WHY IT IS THIS ONE. + + For every `v` git tag in this repo: the matching generic package must be DOWNLOADABLE, + and the tag must serve the agent's configs. + +The task's §8.4 asked for a different one — *"the version the hub tells machines to install must be +downloadable"* — and that is the better invariant in principle. **It is not implementable from CI, +and that was measured rather than assumed:** the hub's artifact manifest +(`GET /api/v1/artifacts/`) answers **401** without a per-customer retrieval passphrase, +and the Gitea package LISTING api answers **401** without a token, while the package DOWNLOAD url +and the git TAGS api are both anonymous. So a credential-free gate can ask *"is this version +installable"* but not *"which version is vouched"*. Putting an operator credential into CI to close +that gap is the operator's call, not a gate author's — it is recorded as a limitation below and as a +backlog row rather than quietly assumed away. + +**What this invariant does catch: all three instances above.** `release-agent.sh` creates the tag and +publishes in one act, so a release whose publish was skipped, failed, or was forgotten leaves a tag +with no package — which is exactly what this refuses. It needs no version floor: tags begin at +v0.120.0, which is published. + +**What it does NOT catch, stated plainly:** the hub vouching a version that was never released at +all (no tag, no package). Nothing here can see that; it belongs at vouch time, in the hub. → R-184. + +FAIL-CLOSED. A network error, an unparseable response or an unreachable Gitea is exit **2 +INCONCLUSIVE**, naming every URL tried — never a pass. "Cannot determine" is not "fine": that is the +standing rule this project earned twice, and a gate that green-lights on its own blindness is worse +than no gate, because it looks like coverage. + +Pure python3 + urllib, NO curl and no third-party module: the CI runner is a host-mode container +carrying python3 and git and nothing else, and an earlier workflow step died on +`curl: command not found`. + + python3 scripts/check-published-versions.py + +Exit: 0 every tag installable · 1 at least one is not · 2 could not be determined. +Env: GITEA_BASE overrides the Gitea root (CI sets the in-cluster service URL). +""" +import json +import os +import re +import sys +import urllib.error +import urllib.request + +GITEA_BASE = os.environ.get("GITEA_BASE", "https://gitea.dooplex.hu").rstrip("/") +OWNER = "admin" +REPO = "felhom-agent" +PKG = "felhom-agent" +TIMEOUT = 25 + +# One config the installer fetches. Its presence proves the TAG's tree carries the configs the +# sixteen `fetch_raw` calls will ask for — a tag that exists but predates them would 404 a box +# mid-install, on a virgin machine, as root. +PROBE_CONFIG = "configs/felhom-agent.service" + +TAG_RE = re.compile(r"^v(\d+\.\d+\.\d+)$") + +tried = [] + + +def _get(url, want_body=False): + """GET a URL. Returns (status, body_or_None). Network failure raises.""" + tried.append(url) + req = urllib.request.Request(url, method="GET") + try: + with urllib.request.urlopen(req, timeout=TIMEOUT) as r: + body = r.read() if want_body else None + return r.status, body + except urllib.error.HTTPError as e: + return e.code, None + + +def inconclusive(msg): + print("INCONCLUSIVE:", msg) + print(" URLs tried (a 'no access' claim must name its attempts):") + for u in tried: + print(" ", u) + sys.exit(2) + + +def main(): + print("check-published-versions — every released agent version must be INSTALLABLE") + print(" gitea:", GITEA_BASE) + + tags_url = "%s/api/v1/repos/%s/%s/tags?limit=200" % (GITEA_BASE, OWNER, REPO) + try: + status, body = _get(tags_url, want_body=True) + except Exception as e: + inconclusive("cannot reach Gitea to list tags: %s" % e) + if status != 200 or not body: + inconclusive("tags api returned HTTP %s — cannot enumerate releases" % status) + try: + tags = [t["name"] for t in json.loads(body.decode("utf-8"))] + except Exception as e: + inconclusive("tags api response is not the expected JSON: %s" % e) + + versions = sorted(m.group(1) for m in (TAG_RE.match(t) for t in tags) if m) + if not versions: + # Not a failure: a repo legitimately has no version tags before its first release. Say so + # loudly rather than reporting a vacuous pass — an empty check that prints OK is how an + # unexamined thing becomes a documented-clean one. + print(" no v tags in this repo yet — nothing to check, and nothing proven") + print("\ncheck-published-versions: NOTHING TO CHECK") + return 0 + print(" %d released version(s) to verify: %s" % (len(versions), ", ".join(versions))) + + bad = [] + for v in versions: + pkg_url = "%s/api/packages/%s/generic/%s/%s/%s" % (GITEA_BASE, OWNER, PKG, v, PKG) + raw_url = "%s/%s/%s/raw/tag/v%s/%s" % (GITEA_BASE, OWNER, REPO, v, PROBE_CONFIG) + try: + pkg_status, _ = _get(pkg_url) + raw_status, _ = _get(raw_url) + except Exception as e: + inconclusive("network failure while checking v%s: %s" % (v, e)) + + problems = [] + if pkg_status != 200: + problems.append("binary NOT downloadable (HTTP %s at %s)" % (pkg_status, pkg_url)) + if raw_status != 200: + problems.append("tag does not serve %s (HTTP %s) — a box would 404 mid-install" + % (PROBE_CONFIG, raw_status)) + if problems: + bad.append((v, problems)) + print(" FAIL v%s:" % v) + for p in problems: + print(" -", p) + else: + print(" ok v%s: binary downloadable + tag serves its configs" % v) + + print() + if bad: + print("check-published-versions: %d RELEASED VERSION(S) NOT INSTALLABLE" % len(bad)) + print(" A tagged version with no package is a release that was BUILT and never PUBLISHED —") + print(" the R-115 defect, three times in five days. Publish it with:") + print(" scripts/release-agent.sh ") + return 1 + print("check-published-versions: ALL RELEASED VERSIONS INSTALLABLE") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/release-agent.sh b/scripts/release-agent.sh new file mode 100755 index 0000000..ff39876 --- /dev/null +++ b/scripts/release-agent.sh @@ -0,0 +1,133 @@ +#!/usr/bin/env bash +# release-agent.sh — THE way to release a felhom-agent version. One act: build → tag → publish → +# verify by independent download. +# +# WHY THIS EXISTS (R-115). Publishing used to be a step someone had to remember, and it was +# forgotten THREE TIMES IN FIVE DAYS: +# +# * R-111 (2026-07-29) 17 releases v0.97.0-v0.113.0 built and never published, so a new customer +# would have installed without the whole R-82 tiered-backup arc, F-CRIT-2 and F-REBOOT. +# * 0.114.0 (same afternoon) built, deployed to felhom-pve, never published. +# * 0.120.0 (2026-08-03) built, committed and deployed to BOTH demo hosts, never published. A +# documented-path reinstall would have silently DOWNGRADED both boxes to the pre-merge +# agent — and would have *succeeded* while doing it, because the current `step_grows` +# sets SYSDATA_GROW=0 so the older agent's fatal mp1 resize never fires. +# +# R-111's own closing line said publishing should join the release train rather than stay a +# remembered step. It closed SHIPPED without that leg, and the leg recurred the same afternoon — +# which is the evidence that a note is not a mechanism. This file is the mechanism. The +# documentation now points here instead of at a raw `go build` line, so there is ONE documented way +# to release and it cannot complete without publishing. +# +# WHY IT TAGS (R-183). Since felhom-host-install.sh pins its sixteen agent-config fetches to +# `raw/tag/v`, a released version without a git tag 404s a box mid-install, as root, on a +# virgin machine. The tag and the package are two halves of one release and are created together. +# +# WHY IT DOES NOT VOUCH. Vouching is what points machines at a version, and it stays the operator's +# deliberate act — the same prove-then-vouch principle that governed the golden two sessions ago. +# This script prints the version and sha to vouch; a human decides when. +# +# Usage: +# GITEA_USER=admin GITEA_TOKEN= ./scripts/release-agent.sh +# +# Env: GITEA_USER/GITEA_TOKEN (package write) — same credentials publish-agent.sh already takes. +# GITEA_BASE / GITEA_OWNER override the defaults. +# RELEASE_ALLOW_DIRTY=1 skips the clean-tree gate (for a rehearsal; never for a real release). +set -euo pipefail + +GITEA_BASE="${GITEA_BASE:-https://gitea.dooplex.hu}" +GITEA_OWNER="${GITEA_OWNER:-admin}" +REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" + +die() { echo "[release-agent] ERROR: $*" >&2; exit 1; } +log() { echo "[release-agent] $*" >&2; } + +VERSION="${1:-}" +[[ -n "$VERSION" ]] || die "version required (usage: GITEA_USER=.. GITEA_TOKEN=.. $0 )" +[[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || die "version must be bare semver X.Y.Z (got '$VERSION')" +TAG="v$VERSION" + +cd "$REPO_ROOT" + +# ── 1. Clean-tree gate ────────────────────────────────────────────────────────────────────────── +# An unpushed change does not exist. Releasing a dirty tree publishes a binary whose source nobody +# else can obtain, and tags a commit that does not contain what was built. +if [[ "${RELEASE_ALLOW_DIRTY:-0}" != "1" ]]; then + [[ -z "$(git status --porcelain)" ]] || die "working tree is dirty — commit and push first" + local_head="$(git rev-parse HEAD)" + git fetch -q origin main + [[ "$local_head" == "$(git rev-parse origin/main)" ]] \ + || die "HEAD != origin/main — push first (an unpushed change does not exist)" +fi + +# ── 2. Refuse to re-release a version that already exists ─────────────────────────────────────── +# Silently overwriting a published artifact is how "the same version" comes to mean two different +# binaries on two different boxes. +if git rev-parse -q --verify "refs/tags/$TAG" >/dev/null; then + die "tag $TAG already exists — releasing over it would make one version name two binaries" +fi +existing="$(curl -fsS -o /dev/null -w '%{http_code}' \ + "$GITEA_BASE/api/packages/$GITEA_OWNER/generic/felhom-agent/$VERSION/felhom-agent" 2>/dev/null || true)" +[[ "$existing" != "200" ]] || die "version $VERSION is ALREADY PUBLISHED — bump the version instead" + +# ── 3. Build ──────────────────────────────────────────────────────────────────────────────────── +BIN="$(mktemp -t felhom-agent-XXXXXX)" +trap 'rm -f "$BIN"' EXIT +log "building $VERSION …" +go build -ldflags "-X main.version=$VERSION" -o "$BIN" ./cmd/felhom-agent \ + || die "go build failed" +built_ver="$("$BIN" --version 2>/dev/null | awk '{print $2}')" +[[ "$built_ver" == "$VERSION" ]] \ + || die "the built binary reports '$built_ver', not '$VERSION' — the ldflag did not take" +BUILT_SHA="$(sha256sum "$BIN" | awk '{print $1}')" +log "built ok: sha256 $BUILT_SHA" + +# ── 4. Tag (before publishing, so a published version always has a tag) ───────────────────────── +# Order matters in this direction only: a tag with no package is caught by +# scripts/check-published-versions.py on the next CI run; a package with no tag is invisible to it, +# because the Gitea package LISTING api needs a token the gate does not have. +log "tagging $TAG at $(git rev-parse --short HEAD) …" +git tag -a "$TAG" -m "agent $TAG + +Released by scripts/release-agent.sh. +sha256 of the published binary: $BUILT_SHA + +felhom-host-install.sh fetches this version's config files from raw/tag/$TAG/configs/, +so this tag is part of the released artifact, not a bookmark (R-183)." +git push origin "$TAG" || die "tag push failed — refusing to publish an untagged version" + +# ── 5. Publish (the existing script; deliberately not reimplemented) ──────────────────────────── +log "publishing …" +"$REPO_ROOT/scripts/publish-agent.sh" "$VERSION" "$BIN" || die "publish failed" + +# ── 6. Verify by an INDEPENDENT download ──────────────────────────────────────────────────────── +# The publish step's own success is not proof: it reports on its own write. What matters is that a +# box can now GET the bytes and that they are the bytes that were built. This is the same +# presence-is-not-success rule the project earned twice — a step that says "done" and a fetch that +# returns the right sha are different claims. +log "verifying by independent download …" +DL="$(mktemp -t felhom-agent-dl-XXXXXX)" +trap 'rm -f "$BIN" "$DL"' EXIT +curl -fsS -o "$DL" "$GITEA_BASE/api/packages/$GITEA_OWNER/generic/felhom-agent/$VERSION/felhom-agent" \ + || die "round-trip GET failed — the version is NOT installable" +DL_SHA="$(sha256sum "$DL" | awk '{print $1}')" +[[ "$DL_SHA" == "$BUILT_SHA" ]] \ + || die "published sha $DL_SHA != built sha $BUILT_SHA — the artifact is not what was built" + +# The tag must also serve the configs the installer will fetch from it. +cfg_code="$(curl -fsS -o /dev/null -w '%{http_code}' \ + "$GITEA_BASE/$GITEA_OWNER/felhom-agent/raw/tag/$TAG/configs/felhom-agent.service" 2>/dev/null || true)" +[[ "$cfg_code" == "200" ]] \ + || die "tag $TAG does not serve configs/felhom-agent.service (HTTP $cfg_code) — a box would 404 mid-install" + +cat <