Ochenstarik
b897b0ea88
fix(bootstrap): compare release versions semantically against the installed one
...
The update guard compared the archive version with PROGRAM_VERSION using shell
string ordering. Both halves were wrong.
PROGRAM_VERSION is a constant describing the bootstrap source tree ("0.2.0-dev"),
never the deployed component, so it could not represent what is installed. The
cross-role compatibility check compared it with a manifest field such as
"v0.1.0-alpha.9"; those can never be equal, so update-control on a host that also
runs the agent always failed. The downgrade guard compared the same mismatched
pair and passed only by accident, because "v" sorts above "0" in ASCII.
String ordering is also wrong for the version scheme in use: "0.1.0-alpha.10"
sorts below "0.1.0-alpha.9", so the next release after the ninth would have been
rejected as a downgrade.
- record the installed version per role at install and update time, and compare
against that instead of PROGRAM_VERSION;
- order versions with sort -V after stripping the leading "v", so prerelease
numbering and tag prefixes compare correctly;
- treat an unknown peer version as a warning rather than a failure, because
installations predating version recording have nothing to compare against;
- guard all of the above in the bootstrap contract test, including the six
ordering cases and a check that the lexicographic comparison is not restored.
Verified by deliberately reintroducing each defect: lexicographic comparison,
sort without -V, and a missing version record are all caught by the contract test.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-11 01:05:22 +07:00
ochenstarik-ui
a6fca04bd6
Merge pull request #35 from ochenstarik-ui/antigravity/signed-delivery-queue-b
...
feat(security): Queue B signed delivery — DI updater, 10 desktop + 5 bootstrap tests
2026-08-11 00:52:11 +07:00
ochenstarik-ui
b314b4eb03
fix(tests): preserve SMM_ALLOW_UNSIGNED over sudo in native smoke tests
2026-08-10 23:12:59 +07:00
ochenstarik-ui
ff24aceaa3
fix(tests): Support hardened verify_archive in smoke and contract tests
...
- test-bootstrap-contract: Generate signed manifest.json with cosign test key
- systemd smoke tests: Pass SMM_ALLOW_UNSIGNED=1 fallback when manifest is missing (for CI PR runs)
2026-08-10 23:08:57 +07:00
ochenstarik-ui
d21c0c5d22
fix(security): Add version mismatch check, MSIX cleanup on hash failure, TraceSource diagnostics, csproj fix
...
- UpdateService: manifest version must match release tag_name (prevents cross-version attacks)
- UpdateService: corrupted MSIX deleted immediately on hash mismatch
- UpdateService: TraceSource logging for all verification steps
- UpdateService: Trust anchor constants with docs/release-policy.md reference
- Bootstrap: docs/release-policy.md reference next to identity constants
- Test csproj: add UpdateService.cs Compile Include (tests won't compile without this)
2026-08-10 20:12:18 +07:00
ochenstarik-ui
ad396fd6a2
fix(tests): Fix Test4 broken JSON, Test2 false positive, add cleanup trap and Test9/Test10
2026-08-10 20:07:49 +07:00
ochenstarik-ui
4f583c9a03
feat(security): Finalize Queue B signed delivery requirements
2026-08-10 19:58:58 +07:00
ochenstarik-ui
ef137bcf7a
fix(bootstrap): verify compatible component versions during updates
...
- Fixed archive hash extraction from manifest using archive basename
- Added version compatibility checks for Control/Agent/helper in update_role
- Expanded UpdateService tests to 4 unit tests
- Verified against alpha.8 manifest
2026-08-10 18:12:22 +07:00
ochenstarik-ui
2ca059f0b3
Merge pull request #33 from ochenstarik-ui/hermes/release-single-writer
...
Enforce a single immutable release publisher
2026-08-10 17:49:16 +07:00
Ochenstarik
004f01a842
[verified] Enforce a single release publisher
2026-08-10 17:43:18 +07:00
ochenstarik-ui
d0a46f511b
Merge pull request #32 from ochenstarik-ui/hermes/monitor-snapshot-contract
...
Fix Monitor snapshot contract and alpha.9 release compatibility
2026-08-10 17:31:09 +07:00
Ochenstarik
12dfaf71e8
[verified] Fix monitor snapshot contract and release compatibility
2026-08-10 17:24:07 +07:00
ochenstarik-ui
ad180e9a7e
fix(ci): fix casing in windows artifacts download
2026-08-10 15:42:17 +07:00
ochenstarik-ui
1ff4391eba
Merge pull request #29 from ochenstarik-ui/feat/monitor-role
...
feat(monitor): implement monitor role
2026-08-10 15:04:28 +07:00
ochenstarik-ui
9c2440412d
feat(monitor): add monitor role installation
2026-08-10 15:04:08 +07:00
ochenstarik-ui
fda9c6dce8
Merge PR #28 : repair CycloneDX release jobs
2026-08-10 14:54:29 +07:00
ochenstarik-ui
a17efa0e5c
fix(ci): update CycloneDX release invocation ( #27 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-10 14:52:29 +07:00
ochenstarik-ui
04eab57ef1
Merge branch 'antigravity/signed-delivery-queue-a'
2026-08-10 14:34:57 +07:00
ochenstarik-ui
9972377e9e
Merge branch 'antigravity/cert-lifecycle'
2026-08-10 13:54:30 +07:00
ochenstarik-ui
f3aed21aea
style: fix trailing whitespace in SchemaCompatibilityTests.cs
2026-08-10 13:35:50 +07:00
ochenstarik-ui
dfab4f4a33
feat: Set PROGRAM_VERSION in dotnet publish and msix
2026-08-10 13:34:38 +07:00
ochenstarik-ui
39736dcee0
Fix CI failure in SQLite compat test
2026-08-10 13:32:36 +07:00
ochenstarik-ui
03e3683074
Add SQLite backward compatibility test (Hermes Task 1)
2026-08-10 13:26:21 +07:00
ochenstarik-ui
32ee96c039
fix: keep 5 workflows
2026-08-10 12:11:31 +07:00
ochenstarik-ui
79a5e8c071
feat: Manifest v2 and keyless signing
2026-08-10 12:06:53 +07:00
ochenstarik-ui
c30a1fc56e
feat(cert): refine certificate renewal endpoints, remove TEST_EVIDENCE.md, and add 401 rejection unit test
2026-08-10 12:01:44 +07:00
ochenstarik-ui
25a93f7b35
feat: client certificate lifecycle management, auto-renewal, and CA rotation guide
2026-08-10 12:01:43 +07:00
dependabot[bot]
df4dfd177a
Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5 ( #23 )
...
* Bump SQLitePCLRaw.bundle_e_sqlite3 from 2.1.12 to 3.0.5
---
updated-dependencies:
- dependency-name: SQLitePCLRaw.bundle_e_sqlite3
dependency-version: 3.0.5
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
* build: update Control.Tests lockfile for SQLite 3.0.5
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
2026-08-10 00:54:27 +07:00
dependabot[bot]
ebd9ae5ac4
Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1 ( #22 )
...
* Bump Microsoft.NET.Test.Sdk from 18.0.1 to 18.8.1
---
updated-dependencies:
- dependency-name: Microsoft.NET.Test.Sdk
dependency-version: 18.8.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* build: update Desktop Security lockfile for Microsoft.NET.Test.Sdk 18.8.1
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ochenstarik-ui <ochenstarik@gmail.com>
2026-08-10 00:45:57 +07:00
dependabot[bot]
3f338840c6
Bump actions/checkout from 6.1.0 to 7.0.1 ( #21 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.1.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](d23441a48e...3d3c42e5aa
2026-08-10 00:34:14 +07:00
dependabot[bot]
04a57f047b
Bump actions/upload-artifact from 6.0.0 to 7.0.1 ( #20 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](b7c566a772...043fb46d1a
2026-08-10 00:34:05 +07:00
dependabot[bot]
bcc79124c1
Bump actions/setup-dotnet from 5.4.0 to 6.0.0 ( #19 )
...
Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet ) from 5.4.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-dotnet/releases )
- [Commits](26b0ec14cb...a98b56852c
2026-08-10 00:33:48 +07:00
dependabot[bot]
a25f04e24b
Bump softprops/action-gh-release from 2.6.2 to 3.0.2 ( #18 )
...
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) from 2.6.2 to 3.0.2.
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](3bb12739c2...3d0d9888cb
2026-08-10 00:33:35 +07:00
ochenstarik-ui
80b4797f2a
fix(enrollment): repair node enrollment path ( #24 )
...
* fix(enrollment): repair node enrollment path
Make trimmed Agent configuration fail closed, harden Control URL validation, add device-code and bootstrap delivery, and make alpha.7 Control updates migration- and recovery-safe.
* fix(enrollment): allow agent token cleanup
---------
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-09 22:32:53 +07:00
ochenstarik-ui
1b798e7ee8
Merge pull request #15 from ochenstarik-ui/antigravity/reproducible-builds
...
feat: reproducible builds — central package versions and lock files
2026-08-09 19:08:08 +07:00
ochenstarik-ui
0f1a653eca
Merge pull request #14 from ochenstarik-ui/antigravity/repo-hygiene
...
chore: repo hygiene — pin actions, dependabot, SBOM, security docs
2026-08-09 19:08:02 +07:00
ochenstarik-ui
2ab32490a5
Merge pull request #13 from ochenstarik-ui/docs/product-horizons-and-integration
...
docs: product horizons, approval policies and KAgent integration spec
2026-08-09 19:07:55 +07:00
ochenstarik-ui
ec78537656
feat: reproducible builds — central package versions and lock files
2026-08-09 18:13:34 +07:00
ochenstarik-ui
d645812d29
test(helper): cover missing node row ( #17 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-09 17:56:13 +07:00
ochenstarik-ui
00dadf27ce
feat(control): reconcile links from factual state ( #16 )
...
Add fact-first Link reconciliation, duplicate and orphan cleanup, generation-aware scheduling, retention, Desktop drift visibility, and strict helper contracts. Preserve exact B-3R batching and lock-safe finalization with Linux/native trimmed evidence.
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-09 12:53:49 +07:00
ochenstarik-ui
2745ee55a5
fix: move permissions to job level, fix SBOM attachment
...
- permissions: contents: write moved from step to job level in
linux-release.yml (both 'bootstrap' and 'publish' jobs) and
windows-release.yml ('package' job); step-level permissions key
is not valid in GitHub Actions schema
- Remove redundant SBOM generation from 'bootstrap' job (no .NET
setup there; 'publish' job already covers the full solution)
- Remove '|| true' from SBOM steps — failures are now visible
- Add SBOM JSON to upload-artifact path and release files in
linux-release.yml (publish job) and windows-release.yml
Verified with actionlint 1.7.7 — 0 errors on all 5 workflow files
2026-08-07 12:03:50 +07:00
ochenstarik-ui
4cc873883c
chore: repo hygiene — pin actions, dependabot, SBOM, docs
...
- Pin all 23 GitHub Actions uses to 40-char commit SHA with tag comments:
actions/checkout@v6 -> d23441a48e516b6c34aea4fa41551a30e30af803 (v6.1.0)
actions/setup-dotnet@v5 -> 26b0ec14cb23fa6904739307f278c14f94c95bf1 (v5.4.0)
actions/upload-artifact@v6 -> b7c566a772e6b6bfb58ed0dc250532a479d7789f (v6.0.0)
actions/download-artifact@v8 -> 3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1)
softprops/action-gh-release@v2 -> 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2.6.2)
SHAs verified via gh api repos/<owner>/<action>/git/ref/tags/<tag>
- Move contents:write from workflow level to release steps only
- Add dotnet CycloneDX SBOM generation to linux-release and windows-release
- Add .github/dependabot.yml (github-actions + nuget, weekly, limit 5 PRs)
- Add SECURITY.md with private advisory channel, 72h SLA, threat model
- Add CHANGELOG.md from real git history (Keep a Changelog format)
- Add CONTRIBUTING.md with build/test instructions and Linux test note
- Add CODEOWNERS
- Add .github/ISSUE_TEMPLATE/{bug_report,feature_request}.md
- Add .github/PULL_REQUEST_TEMPLATE.md with mandatory verification checklist
2026-08-07 11:40:34 +07:00
Ochenstarik
4de849e3bf
docs: add product horizons, approval policies and KAgent integration spec
...
Adopt the reviewed parts of the external vision document as repository
specifications, and record the work-order gates that keep unimplemented
subsystems from starting before their prerequisites are closed.
- product-horizons.md: four horizons with hard exit criteria; Horizon 0
closes physical acceptance, signed delivery, the Monitor role and
certificate rotation before anything new begins.
- approval-policies.md: nine approval modes over the existing binary
confirmation, mapped onto ProvisioningJob, TTL and execution grants.
- integration-kagent.md: capability model split into read, request and
never-grantable; untrusted-executor invariant for KAgent Worker;
SO_PEERCRED on the discovery socket; API designed against entities
that exist today.
- security-model.md: untrusted executors on a Node, the public web
surface decision that must be recorded before that work starts, and
never-grantable capabilities.
- roadmap.md: stages 14-18 for the adopted scope, pinned to horizons.
All three new documents state that nothing in them is implemented.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-06 18:31:09 +07:00
ochenstarik-ui
b11c277ac7
feat(control): add background link reconciliation ( #12 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-03 13:55:48 +07:00
ochenstarik-ui
89ef2fd9d3
feat(control): reconcile link policies ( #11 )
...
* feat(control): reconcile link policies
* test(control): align factual helper sequence
---------
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-08-03 10:52:18 +07:00
ochenstarik-ui
ba14d29211
fix(security): close desktop and helper debts ( #10 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-07-31 13:22:00 +07:00
ochenstarik-ui
c320b7df9c
chore(release): bump MSIX version to 1.0.0.6 ( #9 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-07-31 02:43:04 +07:00
ochenstarik-ui
c13501e529
fix(security): pin SSH trust and protect session keys ( #8 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-07-31 02:36:52 +07:00
ochenstarik-ui
93e0f8ddbd
fix(security): harden enrollment and provisioning helper ( #7 )
...
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-07-31 02:32:47 +07:00
ochenstarik-ui
2d28b8d19c
Execute confirmed timezone provisioning safely ( #6 )
...
* Add standalone Linux bootstrap foundation
* Record bootstrap foundation progress
* Add single-code Node enrollment
* Validate bootstrap release payloads
* Add managed WireGuard mesh bootstrap
* Exercise repeated systemd installation in CI
* Expose systemd smoke failure diagnostics
* Fix bootstrap os-release variable collision
* Create policy helper directory during install
* Capture systemd smoke healthcheck errors
* Report Control listener diagnostics in CI
* Capture stalled Control process diagnostics
* Set service working directories
* Run protected CA healthcheck as root
* Add local Mesh emergency recovery
* Add multi-architecture Linux system matrix
* Add provisioning job control plane
* Stabilize Debian systemd smoke files
* Add node-scoped provisioning job channel
* Add provisioning progress state machine
* Reconcile expired provisioning jobs
* Add provisioning rollback workflow
* Add redacted provisioning event history
* Add restricted provisioning preflight helper
* Persist typed provisioning preflight facts
* Add preflight desired state drift detection
* Define strict base install schema catalog
* Add safe base install plan generation
* Add pre-confirmation base install plans
* Test base install plan API flow
* Authorize confirmed provisioning execution
* Execute confirmed timezone provisioning safely
* test: stabilize execution grant expiry boundary
---------
Co-authored-by: Ochenstarik <ochenstarik@inbox.ru>
2026-07-30 21:40:30 +07:00
