fix: complete clean-host release verification #52

Merged

ochenstarik-ui merged 1 commit from codex/release-alpha16-cosign-verification into main

2026-08-17 16:49:38 +00:00

ochenstarik-ui commented

2026-08-17 16:39:04 +00:00

(Migrated from github.com)

Summary

clear Bash command lookup state after removing the test-provisioned cosign, so the clean-host install-node path actually runs;
add a regression contract for the command hash reset;
preserve immutable alpha.15 and record its automatically triggered false-negative acceptance result;
advance the convenience installer and documentation to correction release alpha.16.

Root cause

The alpha.15 workflow_run installed Hub successfully, provisioned cosign v3.1.3, and verified the signed manifest. Before install-node, the acceptance test deliberately removed /usr/local/bin/cosign but Bash still returned the cached command path. The test failed before install-node. Product provisioning was not the failing component.

Local verification

shell syntax checks — passed;
tests/bootstrap/test-cosign-provisioning.sh — COSIGN_PROVISIONING=PASS;
tests/bootstrap/test-release-contract.sh — RELEASE_CONTRACT=PASS;
tests/bootstrap/test-bootstrap-contract.sh — BOOTSTRAP_CONTRACT=PASS.

CI verification

Release safety

The dry run used codex/release-alpha16-cosign-verification at 7cb7173466. Publication was skipped because the ref was not a tag. alpha.15 remains immutable; alpha.16 has not been created.

Not verified

Physical acceptance on real servers remains outside this task.

## Summary - clear Bash command lookup state after removing the test-provisioned cosign, so the clean-host install-node path actually runs; - add a regression contract for the command hash reset; - preserve immutable alpha.15 and record its automatically triggered false-negative acceptance result; - advance the convenience installer and documentation to correction release alpha.16. ## Root cause The alpha.15 workflow_run installed Hub successfully, provisioned cosign v3.1.3, and verified the signed manifest. Before install-node, the acceptance test deliberately removed /usr/local/bin/cosign but Bash still returned the cached command path. The test failed before install-node. Product provisioning was not the failing component. ## Local verification - shell syntax checks — passed; - tests/bootstrap/test-cosign-provisioning.sh — COSIGN_PROVISIONING=PASS; - tests/bootstrap/test-release-contract.sh — RELEASE_CONTRACT=PASS; - tests/bootstrap/test-bootstrap-contract.sh — BOOTSTRAP_CONTRACT=PASS. ## CI verification - [Linux control and agent — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32046584732) - [Windows build — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32046584739) - [Linux platform matrix — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32046584603) - [Release pipeline workflow_dispatch dry run — passed](https://github.com/ochenstarik-ui/server-monitor-manager/actions/runs/32047097549) ## Release safety The dry run used codex/release-alpha16-cosign-verification at 7cb7173466b6b032d0a5a142efdc3d45df787093. Publication was skipped because the ref was not a tag. alpha.15 remains immutable; alpha.16 has not been created. ## Not verified Physical acceptance on real servers remains outside this task.