ochenstarik/server-monitor-manager
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases 17 Packages Wiki Activity Actions 2
150 commits 9 branches 20 tags 11 MiB
Commit graph

35 commits

Author SHA1 Message Date
ochenstarik-ui
432abb5283 Merge remote-tracking branch 'origin/main' into codex/unified-installer 2026-08-18 02:12:35 +07:00
ochenstarik-ui
1db48b9665 feat: add guided unified installer 2026-08-18 01:37:18 +07:00
ochenstarik-ui
e04bfcdc10 test: expect control mesh state initialization 2026-08-18 01:36:24 +07:00
ochenstarik-ui
b769d36522 test: stub mesh repair in migration fixtures 2026-08-18 01:21:57 +07:00
ochenstarik-ui
d16fe7e78e test: isolate control state fixture 2026-08-18 01:19:31 +07:00
ochenstarik-ui
c8149e3c16 test: extract complete mesh permission helpers 2026-08-18 01:17:01 +07:00
ochenstarik-ui
2bf3e1c20b fix mesh state permissions for Control 2026-08-18 01:13:54 +07:00
ochenstarik-ui
26a11b77e7 fix: select cosign v3 detached signing mode 2026-08-18 00:25:23 +07:00
ochenstarik-ui
ba0abd98f9 fix: preserve machine-readable installer output 2026-08-18 00:01:59 +07:00
ochenstarik-ui
7cb7173466 fix: clear cosign command cache in release verification 2026-08-17 23:37:57 +07:00
ochenstarik-ui
6bd58abe2f fix: provision cosign for verified installs 2026-08-15 23:29:49 +07:00
ochenstarik-ui
d206c2219e feat: add one-command alpha14 server installation 2026-08-15 22:04:25 +07:00
Ochenstarik
55cfdcffac test(release): add certificate fixture material 
Keep local signatures out of Rekor and satisfy the fail-closed certificate contract.
 2026-08-13 14:37:31 +07:00
Ochenstarik
e1359b1b5f fix(release): publish keyless signing certificate 
Close the producer/consumer certificate contract and advance the immutable correction release to alpha.14.
 2026-08-13 14:29:16 +07:00
ochenstarik-ui
56a29e2b33
fix(release): normalize Windows checksum asset (#39) 
Validate SHA256SUMS with GNU sha256sum before publishing and advance the immutable correction release to alpha.13.

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-13 13:53:16 +07:00
ochenstarik-ui
ecad5048cc
fix(release): replace alpha8 network compatibility test (#38) 
Use a deterministic v1 release fixture, prepare alpha.12 version sources, and document release ownership and burned tags.

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-13 13:22:48 +07:00
ochenstarik-ui
5349533994 Bump version to v0.1.0-alpha.11 
alpha.10 tag produced a failed release pipeline (test-release-contract.sh
still asserted alpha.9, and run-negative-tests.sh test 5 failed on
cross-version verify-release). Per release-policy.md, published tags are
immutable — errors are fixed in the next tag.
 2026-08-12 00:47:02 +07:00
ochenstarik-ui
48d096a06e fix(ci): update release contract to alpha.10, remove backward compat test from bootstrap job 
- test-release-contract.sh: update hardcoded DEFAULT_RELEASE_TAG assertion to v0.1.0-alpha.10
- run-negative-tests.sh: remove test 5 (alpha.8 backward compat) — verify-release checks
  for artifacts added in later versions, making cross-version testing inherently fragile
 2026-08-11 12:01:19 +07:00
Ochenstarik
b897b0ea88 fix(bootstrap): compare release versions semantically against the installed one 
The update guard compared the archive version with PROGRAM_VERSION using shell
string ordering. Both halves were wrong.

PROGRAM_VERSION is a constant describing the bootstrap source tree ("0.2.0-dev"),
never the deployed component, so it could not represent what is installed. The
cross-role compatibility check compared it with a manifest field such as
"v0.1.0-alpha.9"; those can never be equal, so update-control on a host that also
runs the agent always failed. The downgrade guard compared the same mismatched
pair and passed only by accident, because "v" sorts above "0" in ASCII.

String ordering is also wrong for the version scheme in use: "0.1.0-alpha.10"
sorts below "0.1.0-alpha.9", so the next release after the ninth would have been
rejected as a downgrade.

- record the installed version per role at install and update time, and compare
  against that instead of PROGRAM_VERSION;
- order versions with sort -V after stripping the leading "v", so prerelease
  numbering and tag prefixes compare correctly;
- treat an unknown peer version as a warning rather than a failure, because
  installations predating version recording have nothing to compare against;
- guard all of the above in the bootstrap contract test, including the six
  ordering cases and a check that the lexicographic comparison is not restored.

Verified by deliberately reintroducing each defect: lexicographic comparison,
sort without -V, and a missing version record are all caught by the contract test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-11 01:05:22 +07:00
ochenstarik-ui
b314b4eb03 fix(tests): preserve SMM_ALLOW_UNSIGNED over sudo in native smoke tests 2026-08-10 23:12:59 +07:00
ochenstarik-ui
ff24aceaa3 fix(tests): Support hardened verify_archive in smoke and contract tests 
- test-bootstrap-contract: Generate signed manifest.json with cosign test key
- systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)
 2026-08-10 23:08:57 +07:00
ochenstarik-ui
ad396fd6a2 fix(tests): Fix Test4 broken JSON, Test2 false positive, add cleanup trap and Test9/Test10 2026-08-10 20:07:49 +07:00
ochenstarik-ui
4f583c9a03 feat(security): Finalize Queue B signed delivery requirements 2026-08-10 19:58:58 +07:00
Ochenstarik
004f01a842 [verified] Enforce a single release publisher 2026-08-10 17:43:18 +07:00
Ochenstarik
12dfaf71e8 [verified] Fix monitor snapshot contract and release compatibility 2026-08-10 17:24:07 +07:00
ochenstarik-ui
79a5e8c071 feat: Manifest v2 and keyless signing 2026-08-10 12:06:53 +07:00
ochenstarik-ui
80b4797f2a
fix(enrollment): repair node enrollment path (#24) 
* fix(enrollment): repair node enrollment path

Make trimmed Agent configuration fail closed, harden Control URL validation, add device-code and bootstrap delivery, and make alpha.7 Control updates migration- and recovery-safe.

* fix(enrollment): allow agent token cleanup

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 22:32:53 +07:00
ochenstarik-ui
d645812d29
test(helper): cover missing node row (#17) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 17:56:13 +07:00
ochenstarik-ui
00dadf27ce
feat(control): reconcile links from factual state (#16) 
Add fact-first Link reconciliation, duplicate and orphan cleanup, generation-aware scheduling, retention, Desktop drift visibility, and strict helper contracts. Preserve exact B-3R batching and lock-safe finalization with Linux/native trimmed evidence.

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-09 12:53:49 +07:00
ochenstarik-ui
b11c277ac7
feat(control): add background link reconciliation (#12) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 13:55:48 +07:00
ochenstarik-ui
89ef2fd9d3
feat(control): reconcile link policies (#11) 
* feat(control): reconcile link policies

* test(control): align factual helper sequence

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-08-03 10:52:18 +07:00
ochenstarik-ui
ba14d29211
fix(security): close desktop and helper debts (#10) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 13:22:00 +07:00
ochenstarik-ui
93e0f8ddbd
fix(security): harden enrollment and provisioning helper (#7) 
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-31 02:32:47 +07:00
ochenstarik-ui
2d28b8d19c
Execute confirmed timezone provisioning safely (#6) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

* Execute confirmed timezone provisioning safely

* test: stabilize execution grant expiry boundary

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:40:30 +07:00
ochenstarik-ui
3851d87534
Add standalone Linux bootstrap foundation (#5) 
* Add standalone Linux bootstrap foundation

* Record bootstrap foundation progress

* Add single-code Node enrollment

* Validate bootstrap release payloads

* Add managed WireGuard mesh bootstrap

* Exercise repeated systemd installation in CI

* Expose systemd smoke failure diagnostics

* Fix bootstrap os-release variable collision

* Create policy helper directory during install

* Capture systemd smoke healthcheck errors

* Report Control listener diagnostics in CI

* Capture stalled Control process diagnostics

* Set service working directories

* Run protected CA healthcheck as root

* Add local Mesh emergency recovery

* Add multi-architecture Linux system matrix

* Add provisioning job control plane

* Stabilize Debian systemd smoke files

* Add node-scoped provisioning job channel

* Add provisioning progress state machine

* Reconcile expired provisioning jobs

* Add provisioning rollback workflow

* Add redacted provisioning event history

* Add restricted provisioning preflight helper

* Persist typed provisioning preflight facts

* Add preflight desired state drift detection

* Define strict base install schema catalog

* Add safe base install plan generation

* Add pre-confirmation base install plans

* Test base install plan API flow

* Authorize confirmed provisioning execution

---------

Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
 2026-07-30 21:18:39 +07:00