Prepare guarded Fleet delivery plan and read-only preflight
This commit is contained in:
archipelago
@@ -0,0 +1,159 @@
|
||||
# Fleet guarded delivery plan and read-only dev preflight
|
||||
|
||||
Status: **prepared, not deployed**. No service was restarted and no live UI,
|
||||
backend, catalog, wallet, session, package download or application data was changed.
|
||||
The Framework startup incident remains separately closed with operator acceptance;
|
||||
the later paid-file/release checklist remains open. Artwork remains deferred.
|
||||
|
||||
## Verified artifact and dev checkpoint
|
||||
|
||||
Artifact directory:
|
||||
`~/.local/state/archipelago/release-qualification/fleet-final-ui-20261007/`.
|
||||
|
||||
- Archive SHA256: `063752912fdcae2d1abf2abaccd53bfad39acce23c9a5d896ce52ba1e1996080`
|
||||
- Candidate index SHA256: `2469e5f2ea2f16598982174e6a0944b3bddadc2e0e587e2f6b3a4253366f0078`
|
||||
- All **313 regular archive members** were streamed and checked against the
|
||||
qualified dist manifest. The archive has a `dist/` prefix, unlike the earlier
|
||||
flat deployment archive. No extraction into the live web root occurred.
|
||||
- Qualification remains full baseline **1,459/177** plus exact three-file delta
|
||||
**31/5** and app typecheck, frozen production build, and narrow source-browser
|
||||
layout evidence. No new tests or artwork acceptance are inferred here.
|
||||
|
||||
Read-only dev snapshots at 2026-10-08 07:29:25 and 07:30:15 UTC established:
|
||||
|
||||
- Host: `archi-dev-box` (192.168.63.240), not Framework.
|
||||
- Served and on-disk UI index:
|
||||
`92050cbda69954f57f4b0bdd73d89623f6aae9fc66e4c074ee4f46bdcb9c3b2a`.
|
||||
- Installed **and running-process** backend:
|
||||
`7b85bb0135743200620963ae836867175283d57b6a8534fee2a19b72c3ce77c3`.
|
||||
This is not the corrected Fleet backend. Delivery is therefore blocked.
|
||||
- Management health returned 200; 32 containers and 189 guarded paths were
|
||||
inventoried. Both snapshots had identical UI/backend hashes, preservation
|
||||
values, container IDs/start times/status and manager identity.
|
||||
- All paths shared with the prior delivery preflight were unchanged. Eleven
|
||||
additional guards cover node identity/installed-state/missing-path presence;
|
||||
these are expanded coverage, not eleven content changes.
|
||||
- Since the prior delivery preflight, eight containers independently changed
|
||||
IDs/start times: angor-indexer, botfights, strfry, archipelago-source,
|
||||
angor-relay, mempool, filebrowser and gashboard. Do not reuse that old
|
||||
preflight. The 50-second current stability observation does not guarantee
|
||||
future deployment stability.
|
||||
|
||||
Private detailed receipts contain hashes and inventories, not credential values:
|
||||
`/tmp/archy-fleet-dev-preflight-20261008.json` and
|
||||
`/tmp/archy-fleet-dev-preflight-20261008-stability.json` (mode 0600).
|
||||
Their `*-summary.json` files contain the concise results. These are observations,
|
||||
not deploy-ready backend qualification receipts.
|
||||
|
||||
## Required backend integration gates
|
||||
|
||||
Before the UI can be delivered, the backend owner must qualify and deploy the
|
||||
exact corrected binary. The UI helper never installs or restarts a backend.
|
||||
|
||||
1. Run the current combined suite through `scripts/test-backend-isolated.sh`;
|
||||
retain zero failures, explicit ignores and immutable source input hashes.
|
||||
The source must include the reviewed collector provenance patch and all later
|
||||
integrated backend fixes. Required Fleet tests are:
|
||||
`unsigned_and_legacy_reports_cannot_assign_their_own_trust`,
|
||||
`collector_cannot_claim_another_record_identity_or_malformed_id`,
|
||||
`collector_history_suffix_cannot_overwrite_another_nodes_history`, and
|
||||
`fleet_reads_do_not_promote_old_collector_spoofs_or_history`.
|
||||
2. Build from the same verified input manifest. Record the exact binary SHA256,
|
||||
source commit, test/build manifest hashes, result and embedded-helper hashes.
|
||||
A version string, a VM fixture binary, or an earlier passing suite is not proof
|
||||
of the final binary. Preserve required live ingress/guard/helper behavior.
|
||||
3. Use the separately reviewed backend deployment procedure and its protected
|
||||
backup/recovery arrangements. Establish lifecycle quiescence and preserve
|
||||
node/wallet identity, wallet/channel data, catalogs, sessions, stopped and
|
||||
uninstalled intent, application persistence and container identities. This
|
||||
document does not authorize a restart while an update/restore is active.
|
||||
4. After backend delivery, verify installed binary and `/proc/<MainPID>/exe`
|
||||
both match the qualified binary; verify expected embedded helper bytes,
|
||||
health, management ingress/auth and preservation receipts.
|
||||
5. With the existing owner session, make only read-only Fleet calls. Verify
|
||||
trusted federation records have server-owned federation/trusted/strict-true
|
||||
identity fields; collectors are collector/unverified/false; known federation
|
||||
identities cannot be shadowed by collectors. For a known federation identity,
|
||||
history must report `history_available=false` and empty entries; collector
|
||||
alerts retain unverified provenance. Absence of suitable live records is not
|
||||
a successful spoofing test: use isolated handler evidence, not live forged
|
||||
ingestion. Do not publish or ingest synthetic telemetry on personal nodes.
|
||||
|
||||
The backend owner supplies a private `backend-ready.json` derived from those
|
||||
actual receipts. The prepared UI guard requires `host`, `isolated_failed=0`,
|
||||
`isolated_passed>2006`, `production_build_passed`, `source_inputs_unchanged`,
|
||||
matching `test_source_manifest_sha256` and `build_source_manifest_sha256`, the
|
||||
four names in `fleet_provenance_tests_passed`, `contains_collector_provenance`,
|
||||
`fleet_contract_readonly_checks_passed`, `deployment_preservation_passed`,
|
||||
`embedded_helpers_match`, and matching `binary_sha256`/`running_sha256`.
|
||||
Do not manufacture these fields from intentions or waive a missing gate. The
|
||||
current old live binary is explicitly rejected.
|
||||
|
||||
## Prepared commands and transaction boundaries
|
||||
|
||||
Tools are isolated in `scripts/qualification/` on the Fleet acceptance branch:
|
||||
|
||||
- `fleet-ui-preflight.py`: read-only artifact and host verification; creates a
|
||||
new private evidence file and refuses to overwrite prior evidence.
|
||||
- `fleet-ui-guard.py`: prepared UI-only mutation/rollback helper, **not executed**.
|
||||
It derives from the earlier preservation helper but uses the final Fleet
|
||||
receipt, `dist/` prefix, current manager/running-binary checks and expanded
|
||||
identity/installed-state guards. It does not restart any service.
|
||||
- `test-fleet-ui-guard-refusal.py`: one test with five synthetic rejection cases
|
||||
passed; failed tests, mismatched source manifests, absent provenance tests,
|
||||
missing read-only contract acceptance, or helper mismatch stop before any
|
||||
mutation. Both tools also passed Python syntax checks. This is not live
|
||||
deployment or successful rollback execution evidence.
|
||||
|
||||
Run a **fresh preflight after qualified backend acceptance**, not either receipt
|
||||
above. Example commands from the reviewed worktree, using a new timestamped path:
|
||||
|
||||
```sh
|
||||
python3 scripts/qualification/fleet-ui-preflight.py \
|
||||
--host archi-dev-box \
|
||||
--artifact /home/archipelago/.local/state/archipelago/release-qualification/fleet-final-ui-20261007 \
|
||||
--out /tmp/fleet-dev-post-backend-preflight-UNIQUE.json
|
||||
```
|
||||
|
||||
Only after all backend gates and review of that new preflight, the prepared UI
|
||||
command is:
|
||||
|
||||
```sh
|
||||
python3 scripts/qualification/fleet-ui-guard.py deploy archi-dev-box \
|
||||
/tmp/fleet-dev-post-backend-preflight-UNIQUE.json \
|
||||
/home/archipelago/.local/state/archipelago/release-qualification/fleet-final-ui-20261007/qualification-final.json \
|
||||
/home/archipelago/.local/state/archipelago/release-qualification/fleet-final-ui-20261007/qualified-ui.tar.gz \
|
||||
/path/to/verified/backend-ready.json
|
||||
```
|
||||
|
||||
The guard rechecks every relevant byte and manager/container snapshot before
|
||||
writes, creates a protected `/var/lib/archipelago/support/fleet-ui-.../` backup
|
||||
and rollback script, copies assets, and atomically replaces entry points last.
|
||||
It excludes packages, AIUI and node-specific catalogs. It then verifies health,
|
||||
served index, backend bytes/running process, identities, intent, packages, AIUI
|
||||
and container IDs/start times/status immediately and after 15 seconds. Any
|
||||
independent drift fails the transaction; do not weaken those checks to force it
|
||||
through. Its automatic rollback restores prior UI bytes and verifies the old
|
||||
index hash; it cannot undo independent application or backend changes.
|
||||
|
||||
After success, verify the actual deployed UI in a disposable browser context at
|
||||
390px/1440px with narrowly mocked Fleet failure/provenance cases and payment/
|
||||
signing blocked. Keep actual backend authorization checks distinct from mocks.
|
||||
Verify APK/default-download hashes remain unchanged. Repeat fresh backend and
|
||||
UI gates separately on Yaya; no stale dev receipt is transferable to Yaya.
|
||||
|
||||
## Rollback ordering and cached clients
|
||||
|
||||
The UI helper emits the exact protected `rollback.sh` path. Running
|
||||
`sudo -n /var/lib/archipelago/support/fleet-ui-<receipt-id>/rollback.sh`
|
||||
restores UI bytes only. Recheck the previous served index hash, all preservation
|
||||
values and health afterward; do not report rollback success solely from an exit
|
||||
code. New unused fingerprinted assets may remain; old entry points are restored.
|
||||
|
||||
If UI delivery fails, retain the qualified corrected backend while restoring the
|
||||
old UI. A backend failure before new UI exposure can use its separate reviewed
|
||||
recovery procedure. **After any new UI has been served, blindly downgrading to
|
||||
an old backend without the provenance correction is unsafe:** active browser or
|
||||
PWA clients can retain new code even after old UI files are restored. Such a
|
||||
backend rollback needs a provenance-preserving qualified rollback binary or a
|
||||
separately reviewed recovery plan; restoring old index bytes alone is insufficient.
|
||||
Reference in New Issue
Block a user