ochenstarik-ui
45b1ad3abe
fix(ci): remove alpha.8 backward-compat test from manifest verification, bump to alpha.12
...
The alpha.8 backward-compat test in test-manifest-verification.sh was the
second copy that broke both alpha.10 and alpha.11 pipelines. The test fails
because verify-release checks for artifacts (bootstrap/*, mesh firewall unit)
that were added after alpha.8.
Per release-policy.md, tags are immutable — bump to alpha.12.
2026-08-12 00:52:03 +07:00
ochenstarik-ui
5349533994
Bump version to v0.1.0-alpha.11
...
alpha.10 tag produced a failed release pipeline (test-release-contract.sh
still asserted alpha.9, and run-negative-tests.sh test 5 failed on
cross-version verify-release). Per release-policy.md, published tags are
immutable — errors are fixed in the next tag.
2026-08-12 00:47:02 +07:00
ochenstarik-ui
48d096a06e
fix(ci): update release contract to alpha.10, remove backward compat test from bootstrap job
...
- test-release-contract.sh: update hardcoded DEFAULT_RELEASE_TAG assertion to v0.1.0-alpha.10
- run-negative-tests.sh: remove test 5 (alpha.8 backward compat) — verify-release checks
for artifacts added in later versions, making cross-version testing inherently fragile
2026-08-11 12:01:19 +07:00
ochenstarik-ui
e04037aec8
docs: add Debian VM reboot constraint section
2026-08-11 01:46:04 +07:00
ochenstarik-ui
bb672a299c
docs: sync translations and roadmap for release v0.1.0-alpha.10
2026-08-11 01:45:05 +07:00
ochenstarik-ui
e8f771b07d
Merge branch 'hermes/release-alpha10'
2026-08-11 01:40:57 +07:00
ochenstarik-ui
93b80e2dac
Bump version to v0.1.0-alpha.10
2026-08-11 01:40:28 +07:00
ochenstarik-ui
481d4b7c8a
Add alpha.8 backward compatibility test
2026-08-11 01:30:39 +07:00
ochenstarik-ui
7b322a69d3
Add release-verification workflow to main
2026-08-11 01:30:09 +07:00
ochenstarik-ui
6ca8ac8469
Add release verification workflow
2026-08-11 01:28:50 +07:00
ochenstarik-ui
61471f033d
Merge pull request #36 from ochenstarik-ui/fix/version-comparison
...
fix(bootstrap): compare release versions semantically against the installed one
2026-08-11 01:12:39 +07:00
Ochenstarik
b897b0ea88
fix(bootstrap): compare release versions semantically against the installed one
...
The update guard compared the archive version with PROGRAM_VERSION using shell
string ordering. Both halves were wrong.
PROGRAM_VERSION is a constant describing the bootstrap source tree ("0.2.0-dev"),
never the deployed component, so it could not represent what is installed. The
cross-role compatibility check compared it with a manifest field such as
"v0.1.0-alpha.9"; those can never be equal, so update-control on a host that also
runs the agent always failed. The downgrade guard compared the same mismatched
pair and passed only by accident, because "v" sorts above "0" in ASCII.
String ordering is also wrong for the version scheme in use: "0.1.0-alpha.10"
sorts below "0.1.0-alpha.9", so the next release after the ninth would have been
rejected as a downgrade.
- record the installed version per role at install and update time, and compare
against that instead of PROGRAM_VERSION;
- order versions with sort -V after stripping the leading "v", so prerelease
numbering and tag prefixes compare correctly;
- treat an unknown peer version as a warning rather than a failure, because
installations predating version recording have nothing to compare against;
- guard all of the above in the bootstrap contract test, including the six
ordering cases and a check that the lexicographic comparison is not restored.
Verified by deliberately reintroducing each defect: lexicographic comparison,
sort without -V, and a missing version record are all caught by the contract test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 01:05:22 +07:00
ochenstarik-ui
a6fca04bd6
Merge pull request #35 from ochenstarik-ui/antigravity/signed-delivery-queue-b
...
feat(security): Queue B signed delivery — DI updater, 10 desktop + 5 bootstrap tests
2026-08-11 00:52:11 +07:00
ochenstarik-ui
b314b4eb03
fix(tests): preserve SMM_ALLOW_UNSIGNED over sudo in native smoke tests
2026-08-10 23:12:59 +07:00
ochenstarik-ui
ff24aceaa3
fix(tests): Support hardened verify_archive in smoke and contract tests
...
- test-bootstrap-contract: Generate signed manifest.json with cosign test key
- systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)
2026-08-10 23:08:57 +07:00
ochenstarik-ui
d21c0c5d22
fix(security): Add version mismatch check, MSIX cleanup on hash failure, TraceSource diagnostics, csproj fix
...
- UpdateService: manifest version must match release tag_name (prevents cross-version attacks)
- UpdateService: corrupted MSIX deleted immediately on hash mismatch
- UpdateService: TraceSource logging for all verification steps
- UpdateService: Trust anchor constants with docs/release-policy.md reference
- Bootstrap: docs/release-policy.md reference next to identity constants
- Test csproj: add UpdateService.cs Compile Include (tests won't compile without this)
2026-08-10 20:12:18 +07:00
ochenstarik-ui
ad396fd6a2
fix(tests): Fix Test4 broken JSON, Test2 false positive, add cleanup trap and Test9/Test10
2026-08-10 20:07:49 +07:00
ochenstarik-ui
4f583c9a03
feat(security): Finalize Queue B signed delivery requirements
2026-08-10 19:58:58 +07:00
ochenstarik-ui
ef137bcf7a
fix(bootstrap): verify compatible component versions during updates
...
- Fixed archive hash extraction from manifest using archive basename
- Added version compatibility checks for Control/Agent/helper in update_role
- Expanded UpdateService tests to 4 unit tests
- Verified against alpha.8 manifest
2026-08-10 18:12:22 +07:00
ochenstarik-ui
2ca059f0b3
Merge pull request #33 from ochenstarik-ui/hermes/release-single-writer
...
Enforce a single immutable release publisher
2026-08-10 17:49:16 +07:00
Ochenstarik
004f01a842
[verified] Enforce a single release publisher
2026-08-10 17:43:18 +07:00
ochenstarik-ui
d0a46f511b
Merge pull request #32 from ochenstarik-ui/hermes/monitor-snapshot-contract
...
Fix Monitor snapshot contract and alpha.9 release compatibility
2026-08-10 17:31:09 +07:00
Ochenstarik
12dfaf71e8
[verified] Fix monitor snapshot contract and release compatibility
2026-08-10 17:24:07 +07:00
ochenstarik-ui
ad180e9a7e
fix(ci): fix casing in windows artifacts download
2026-08-10 15:42:17 +07:00
ochenstarik-ui
1ff4391eba
Merge pull request #29 from ochenstarik-ui/feat/monitor-role
...
feat(monitor): implement monitor role
2026-08-10 15:04:28 +07:00
ochenstarik-ui
9c2440412d
feat(monitor): add monitor role installation
2026-08-10 15:04:08 +07:00
ochenstarik-ui
fda9c6dce8
Merge PR #28 : repair CycloneDX release jobs
2026-08-10 14:54:29 +07:00
ochenstarik-ui
a17efa0e5c
fix(ci): update CycloneDX release invocation ( #27 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-10 14:52:29 +07:00
ochenstarik-ui
04eab57ef1
Merge branch 'antigravity/signed-delivery-queue-a'
2026-08-10 14:34:57 +07:00
ochenstarik-ui
9972377e9e
Merge branch 'antigravity/cert-lifecycle'
2026-08-10 13:54:30 +07:00
ochenstarik-ui
f3aed21aea
style: fix trailing whitespace in SchemaCompatibilityTests.cs
2026-08-10 13:35:50 +07:00
ochenstarik-ui
dfab4f4a33
feat: Set PROGRAM_VERSION in dotnet publish and msix
2026-08-10 13:34:38 +07:00
ochenstarik-ui
39736dcee0
Fix CI failure in SQLite compat test
2026-08-10 13:32:36 +07:00
ochenstarik-ui
03e3683074
Add SQLite backward compatibility test (Hermes Task 1)
2026-08-10 13:26:21 +07:00
ochenstarik-ui
32ee96c039
fix: keep 5 workflows
2026-08-10 12:11:31 +07:00
ochenstarik-ui
79a5e8c071
feat: Manifest v2 and keyless signing
2026-08-10 12:06:53 +07:00
ochenstarik-ui
c30a1fc56e
feat(cert): refine certificate renewal endpoints, remove TEST_EVIDENCE.md, and add 401 rejection unit test
2026-08-10 12:01:44 +07:00
ochenstarik-ui
25a93f7b35
feat: client certificate lifecycle management, auto-renewal, and CA rotation guide
2026-08-10 12:01:43 +07:00
dependabot[bot]
df4dfd177a
Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5 ( #23 )
...
* Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5
---
updated-dependencies:
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
dependency-version: 3.0.5
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* build: update Control.Tests lockfile for SQLite 3.0.5
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
2026-08-10 00:54:27 +07:00
dependabot[bot]
ebd9ae5ac4
Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1 ( #22 )
...
* Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1
---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.8.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* build: update Desktop Security lockfile for Microsoft.NET.Test.Sdk 18.8.1
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
2026-08-10 00:45:57 +07:00
dependabot[bot]
3f338840c6
Bump actions/checkout from 6.1.0 to 7.0.1 ( #21 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.1.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](d23441a48e...3d3c42e5aa
2026-08-10 00:34:14 +07:00
dependabot[bot]
04a57f047b
Bump actions/upload-artifact from 6.0.0 to 7.0.1 ( #20 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](b7c566a772...043fb46d1a
2026-08-10 00:34:05 +07:00
dependabot[bot]
bcc79124c1
Bump actions/setup-dotnet from 5.4.0 to 6.0.0 ( #19 )
...
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) from 5.4.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](26b0ec14cb...a98b56852c
2026-08-10 00:33:48 +07:00
dependabot[bot]
a25f04e24b
Bump softprops/action-gh-release from 2.6.2 to 3.0.2 ( #18 )
...
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) from 2.6.2 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](3bb12739c2...3d0d9888cb
2026-08-10 00:33:35 +07:00
ochenstarik-ui
80b4797f2a
fix(enrollment): repair node enrollment path ( #24 )
...
* fix(enrollment): repair node enrollment path
Make trimmed Agent configuration fail closed, harden Control URL validation, add device-code and bootstrap delivery, and make alpha.7 Control updates migration- and recovery-safe.
* fix(enrollment): allow agent token cleanup
---------
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-09 22:32:53 +07:00
ochenstarik-ui
1b798e7ee8
Merge pull request #15 from ochenstarik-ui/antigravity/reproducible-builds
...
feat: reproducible builds — central package versions and lock files
2026-08-09 19:08:08 +07:00
ochenstarik-ui
0f1a653eca
Merge pull request #14 from ochenstarik-ui/antigravity/repo-hygiene
...
chore: repo hygiene — pin actions, dependabot, SBOM, security docs
2026-08-09 19:08:02 +07:00
ochenstarik-ui
2ab32490a5
Merge pull request #13 from ochenstarik-ui/docs/product-horizons-and-integration
...
docs: product horizons, approval policies and KAgent integration spec
2026-08-09 19:07:55 +07:00
ochenstarik-ui
ec78537656
feat: reproducible builds — central package versions and lock files
2026-08-09 18:13:34 +07:00
ochenstarik-ui
d645812d29
test(helper): cover missing node row ( #17 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-09 17:56:13 +07:00
