CHANGELOG обрывался на alpha.6 от 2026-07-31 при тегах до alpha.20.
Дописаны 14 версий по тегам и коммитам между ними; даты сверены с датами
тегов, расхождений нет. Сожжённые alpha.10, alpha.11 и alpha.19 помечены
как несопубликованные с указанием, чем упал пайплайн. Для опубликованных,
но дефектных версий записан сам дефект, иначе CHANGELOG подсказывал бы
ставить версию, которая не ставится.
В release-policy добавлена запись про alpha.20. В roadmap дописано
фактически поставленное: веб-консоль и её разделы, режим полного удаления
сервера, объединённый установщик.
README и переводы намеренно не тронуты: по release-policy строка статуса
релиза принадлежит владельцу релиза, изменение запрошено заданием Codex.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
PR #40 correctly publishes the keyless signing certificate and makes
verify_archive require manifest, signature and certificate together. Three
things around it were inconsistent.
The release-verification scripts fetched assets with `gh release download`.
The workspace-isolation step deliberately removes `.git` so that the install
comes from the release rather than the source tree, and `gh` resolves the
repository from that git context — the tool fought the isolation it runs
inside, which is what broke the first runs. An operator has neither `gh` nor a
token, so the scripts now use public `curl`, `sha256sum` and `cosign` only.
`verify-assets.sh` keeps `gh`: it runs before isolation and only lists assets.
The monitor check addressed a user and a home directory that do not exist.
The bootstrap creates `ochenstarik-monitor` with `/var/lib/ochenstarik-monitor`;
the script used `ochenstarik-smm-monitor` under the Control state directory, so
that section could never have passed. It now also asserts that the forced
command is pinned in `authorized_keys` before running it, and quotes the
command instead of splitting it on whitespace.
The expected asset list did not include the new certificate, so a correct
release would have been reported as unexpected.
Also: a negative case for an archive published without its certificate, removal
of drafting comments that quoted the task text, and documentation of the three
signature files, since `verify-release` now requires them beside the archive and
the documented download list stopped being sufficient.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Validate SHA256SUMS with GNU sha256sum before publishing and advance the immutable correction release to alpha.13.
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
Use a deterministic v1 release fixture, prepare alpha.12 version sources, and document release ownership and burned tags.
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
alpha.10 tag produced a failed release pipeline (test-release-contract.sh
still asserted alpha.9, and run-negative-tests.sh test 5 failed on
cross-version verify-release). Per release-policy.md, published tags are
immutable — errors are fixed in the next tag.
Adopt the reviewed parts of the external vision document as repository
specifications, and record the work-order gates that keep unimplemented
subsystems from starting before their prerequisites are closed.
- product-horizons.md: four horizons with hard exit criteria; Horizon 0
closes physical acceptance, signed delivery, the Monitor role and
certificate rotation before anything new begins.
- approval-policies.md: nine approval modes over the existing binary
confirmation, mapped onto ProvisioningJob, TTL and execution grants.
- integration-kagent.md: capability model split into read, request and
never-grantable; untrusted-executor invariant for KAgent Worker;
SO_PEERCRED on the discovery socket; API designed against entities
that exist today.
- security-model.md: untrusted executors on a Node, the public web
surface decision that must be recorded before that work starts, and
never-grantable capabilities.
- roadmap.md: stages 14-18 for the adopted scope, pinned to horizons.
All three new documents state that nothing in them is implemented.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
