4 Commits

Include renames

Author	SHA1	Message	Date
admin	feaaa0e8ff	D50 = A (R-1290): the published gate asserts the newest 5 released versions plus the pinned MinAgent (0.158.1) and day-0 agent (0.165.0); a pin with no tag fails; decoys red-proved. No binary change.	2026-10-25 20:20:30 +01:00
admin	53d047a6c1	Two guards, one number: bound the published check to the retention it must live with ... Gates only. No release, no version bump, no binary published; the agent stays v0.128.0 at 28ba8593b8 and nothing on a customer's machine changes. THE COUPLING DEFECT. The registry stopped serving 0.120.0 and older while check-published-versions.py demanded every tag still be downloadable. Both rules are sensible and together they are impossible, so CI went red at a commit whose own run had been GREEN the day before -- and would have gone red again at the next publish when 0.121.0 was evicted. scripts/retention-policy.json is now THE number and both readers take it from there. WHAT CI NO LONGER COVERS, and it prints this on every run rather than leaving it to be discovered: a released version older than the retention window is no longer asserted downloadable. Its git tag and its config tree ARE still asserted -- only the binary's presence is dropped. A missing policy file is INCONCLUSIVE (exit 2), never silently unbounded. THE NUMBER IS NOT A LOCATED RULING and the file says so in its own header. Ten is what the registry demonstrably holds; no register row records a prune, R-210 says "Nothing was deleted; this is a list, not an action" and concerns local Docker images, and container packages hold 19 each. The principled bound is the hub's vouched min_agent floor -- nothing can install below it -- and that is the recorded follow-up. check-release-complete.py is the tag half as a machine. release-agent.sh already warned that "a released version without a git tag 404s a box mid-install, as root" and the step was still missed, so this is a gate and not a reminder. Legs 1-2 need no network and run in --fast, so the pre-push hook is the earliest catch. Red-proved by repointing the CHANGELOG head at an unreleased v0.129.0: both legs convicted and each named its fix command. Three controls run: green at 10 naming what it dropped; widened to 11 the evicted version re-enters and convicts; policy removed gives INCONCLUSIVE naming the path.	2026-08-09 19:05:05 +02:00
admin	7581f8140a	v0.122.0: three ways the signals lied about themselves (R-189, R-188, R-186) ... All three are the reporting and release path misreporting its own work. No customer machine, no backup, no restore, no data. The restore-test itself and when it runs are unchanged. R-189 — a passing restore-test no longer vanishes on a restart. restore_tests[] came only from the in-memory store, whose comment ("lost on restart; the cadence re-populates") was true under a timer and stopped being true when R-86 made the agent refuse to re-test a proven archive: the proof is then not repeated for a whole archive generation. Observed live — a 14.5 GB offsite PASS reached no host-report because the agent was restarted 2m43s later. RestoreTestState now carries tier + verified beside the archive and renders reportable entries; the collector merges them, one per tier, newest by TestedAt. It refuses to lie: a record missing archive-or-tier produces no entry, and run mechanics are not re-invented. Only successes are persisted, and the asymmetry is now written where it will be read. R-188 — a correct release stops emailing a failure. Only the tag PUSH moved (build -> tag locally -> publish -> push tag): the push wakes CI, and a tag visible before its package made the gate correctly fail a correct release about half the time. The old order's invariant is asserted directly instead — the gate now refuses a published version with no tag, as a bounded probe that prints its own coverage, because the package listing api is still 401 without a token. R-186 — a released binary can be verified by rebuilding it. -trimpath -buildvcs=false: same source, same bytes, tag or no tag. Measured. publish-agent's fallback also forced CGO_ENABLED=0 and produced a 74 KB different binary for the same version; both paths now build identically. CLAUDE.md records the command.	2026-08-03 16:40:18 +02:00
admin	dd2d1feb6e	release path publishes, and an unreleasable version fails CI (R-115, R-183) ... NO VERSION BUMP and nothing built: no Go code changed. The agent stays v0.120.0. scripts/release-agent.sh — THE way to release. build -> tag -> publish -> verify by INDEPENDENT download. Publishing was a separate remembered step and was forgotten three times in five days (R-111's 17 stranded releases, 0.114.0, and 0.120.0 — deployed to both demo hosts and undownloadable, so a documented-path reinstall would have silently downgraded them WHILE REPORTING SUCCESS). R-111's own closing line named this leg and closed SHIPPED without it; it recurred the same afternoon, which is the evidence that a note is not a mechanism. It tags because felhom-host-install.sh now fetches the sixteen agent config files from raw/tag/v<version>/ (R-183): a released version with no tag 404s a box mid-install, as root, on a virgin machine. It verifies by downloading what it just published and comparing the sha to what it built — the publish step's own success is a report on its own write; a fetch returning the right bytes is a different claim. It refuses a dirty/unpushed tree and refuses to re-release an existing version. It does NOT vouch: that points machines at a version and stays the operator's act. scripts/check-published-versions.py — the gate. Every v<semver> tag must have a downloadable package AND a tag tree serving the agent's configs. Registered as NOT --fast (needs network; a push must not fail because Gitea blinked), and the CI workflow now runs the FULL gate set instead of --fast — otherwise the gate would have been registered and never run, the built-but-never-wired failure this project has shipped four times. The invariant is not the one specified, and the reason was measured, not assumed: the hub artifact manifest is 401 without a per-customer passphrase and Gitea's package LISTING api is 401 without a token, while the package DOWNLOAD url and the git TAGS api are anonymous. So CI cannot ask "what is vouched" without an operator credential — whose addition is the operator's call. The tag-based invariant needs none and catches all three recorded instances. What it does not catch (the hub vouching a version never released at all) is filed as R-184.	2026-08-03 12:34:20 +02:00