From 373c3bb3022978b356297889e6bcd349f63b67f1 Mon Sep 17 00:00:00 2001
From: archipelago <archipelago@localhost>
Date: Sun, 2 Aug 2026 15:04:14 -0400
Subject: [PATCH] fix(10-04): ship the host-secrets audit unit in the OTA
 runtime payload
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[Rule 3 — blocking] bootstrap.rs installs systemd units from the runtime
payload at image-recipe/configs/, but create-release-manifest.sh copies only
archipelago-doctor.service and .timer into that directory. The new
archipelago-host-secrets-audit.service would therefore never exist on any
node: bootstrap looks for it, `src.exists()` is false, and it silently
installs nothing. No error, no log line — the whole deployed-node half of
10-04 would have been inert on arrival.

Two enumerations of the same list in two languages in two files is the drift
that caused it, so the loop now carries a KEEP IN SYNC pointer naming the
array in bootstrap.rs, and the redundant `if [ -f doctor.service ] || [ -f
doctor.timer ]` wrapper is gone — the per-unit `-f` test inside the loop
already does that job, and the wrapper would have skipped the whole block on
a tree that had the new unit but not the doctor ones.

Outside 10-04's declared files_modified. Taken because the alternative was to
ship a deliverable that cannot reach its target and file the gap as a
follow-up. Staged by path; no other agent had uncommitted work in this file.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 scripts/create-release-manifest.sh | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/scripts/create-release-manifest.sh b/scripts/create-release-manifest.sh
index 309286d9..b2c147b2 100755
--- a/scripts/create-release-manifest.sh
+++ b/scripts/create-release-manifest.sh
@@ -99,16 +99,19 @@ if [ -z "$FRONTEND_ARCHIVE" ]; then
                 cp -r "$PROJECT_ROOT/$runtime_path" "$RUNTIME_DIR/$runtime_path"
             fi
         done
-        if [ -f "$PROJECT_ROOT/image-recipe/configs/archipelago-doctor.service" ] || \
-           [ -f "$PROJECT_ROOT/image-recipe/configs/archipelago-doctor.timer" ]; then
-            mkdir -p "$RUNTIME_DIR/image-recipe/configs"
-            for unit in archipelago-doctor.service archipelago-doctor.timer; do
-                if [ -f "$PROJECT_ROOT/image-recipe/configs/$unit" ]; then
-                    echo "  Including runtime unit $unit"
-                    cp "$PROJECT_ROOT/image-recipe/configs/$unit" "$RUNTIME_DIR/image-recipe/configs/$unit"
-                fi
-            done
-        fi
+        # KEEP IN SYNC with the `for unit in [...]` array in
+        # core/archipelago/src/bootstrap.rs (run_runtime_assets). A unit that
+        # bootstrap installs but this list does not ship simply never reaches a
+        # node: bootstrap looks for it in the runtime payload, does not find
+        # it, and silently installs nothing. There is no error to notice.
+        mkdir -p "$RUNTIME_DIR/image-recipe/configs"
+        for unit in archipelago-doctor.service archipelago-doctor.timer \
+                    archipelago-host-secrets-audit.service; do
+            if [ -f "$PROJECT_ROOT/image-recipe/configs/$unit" ]; then
+                echo "  Including runtime unit $unit"
+                cp "$PROJECT_ROOT/image-recipe/configs/$unit" "$RUNTIME_DIR/image-recipe/configs/$unit"
+            fi
+        done
         if [ -f "$PROJECT_ROOT/image-recipe/configs/nginx-archipelago.conf" ]; then
             mkdir -p "$RUNTIME_DIR/image-recipe/configs"
             echo "  Including runtime nginx-archipelago.conf"