feat: add deployer host installer (#22) - #69

Open

Nickfost wants to merge 90 commits into

mainfrom

feat/issue-22-deployer-host-installer

Commits on Aug 8, 2026

feat: add deployer host installer
Nicks Hermes
committed
73f45a1

Commits on Aug 9, 2026

fix: address deployer safety review findings
Nicks Hermes
committed
ed8c5e6
fix: harden deployer retained-state validation
Nicks Hermes
committed
777f8c5
fix: retain deployed safety evidence
Nicks Hermes
committed
19a0c4e
fix: close deployer runtime recovery gaps
Nicks Hermes
committed
08e1d5d
test: normalize deployer drain marker mode
Nicks Hermes
committed
37d2962
fix: serialize runtime policy and recovery state
Nicks Hermes
committed
773c3ae
fix: fail closed across deployer recovery paths
Nicks Hermes
committed
61b3d0e
fix: preserve validated deployer boundaries
Nicks Hermes
committed
5ddea4d
fix: pin deployer transaction inputs atomically
Nicks Hermes
committed
deb781c
fix: close deployer recovery and audit review gaps
Nicks Hermes
committed
817c0bf
fix: harden deployer runtime and rollback recovery review gaps
Nicks Hermes
committed
9d78330
fix: close deployer isolation and rollback recovery review gaps
Nicks Hermes
committed
efa5224
fix: harden deployer transactions, credentials, and audit identity
Nicks Hermes
committed
9e52f59
fix: track deployed pointer and validate state across recovery paths
Nicks Hermes
committed
0242374
fix: validate deployer identity, isolation, and boundaries end to end
Nicks Hermes
committed
c6cffb3
fix: preserve deployer recovery invariants across lifecycle paths
Nicks Hermes
committed
628791d

Commits on Aug 10, 2026

fix: close deployer publication, rollback, and uninstall safety gaps
Nicks Hermes
committed
b471007
test: make drifted-unit uninstall check shellcheck-clean
Nicks Hermes
committed
25335bf
fix: revalidate trust boundaries before every deployer adapter call
Nicks Hermes
committed
9c8c5d3
fix: fail closed across deployer recovery, signals, and read-only checks
Nicks Hermes
committed
24c2b4d
fix: harden deployer publication, recovery manifests, and convergence
Nicks Hermes
committed
48c686e

Commits on Aug 11, 2026

fix: close deployer recovery, snapshot, inhibition, and checkout race findings
Nicks Hermes
committed
aa7f1db
fix: drop redundant checkout ownership probe rejected on CI checkouts
Nicks Hermes
committed
aab1513
fix: harden checkout pinning, promotion, and convergence validation
Nicks Hermes
committed
4e0e1f7
test: expect credential-reference failure before cross-validation order change
Nicks Hermes
committed
8c09079
test: rotate credential fixture identity in deployed-pair drift regression
Nicks Hermes
committed
6fd3b5f
test: match candidate-first credential failure on upgrade path
Nicks Hermes
committed
63d5f80
test: exercise deployed-pair credential drift through the policy reference
Nicks Hermes
committed
aa9b129
test: clear recovered rollback state after credential drift regression
Nicks Hermes
committed
0074803
test: substituted live checkout now fails closed at the hash pin
Nicks Hermes
committed
d973349
test: clear drain fixture before final convergence check
Nicks Hermes
committed
cf07821
test: drop invalid trailing convergence check after approval rotation
Nicks Hermes
committed
913e798
fix: close checkout baseline, pointer, audit, uninstall, and recovery gaps
Nicks Hermes
committed
f61c025
fix: stop timers before removing the activation pointer on uninstall
Nicks Hermes
committed
8132bd5
fix: validate systemd boundary and finalize dependencies before recovery mutation
Nicks Hermes
committed
22aeef4

Commits on Aug 12, 2026

test: drifted adapter is caught at candidate validation before recovery
Nicks Hermes
committed
91707e8
test: tolerate absent retained pair in drifted-finalize regression
Nicks Hermes
committed
74fa0ff
test: tolerate absent retained pair in deployed-pair drift regressions
Nicks Hermes
committed
fd68749
test: order deployed-pair drift regressions before finalize recovery
Nicks Hermes
committed
e9e5d7a
test: rebuild retained rollback pair after finalize recovery fixture
Nicks Hermes
committed
42254a9
fix: replace-immune checkout pins, marker type checks, idempotent uninstall
Nicks Hermes
committed
2467f17
fix: propagate tree-read failures, tolerate absent timers, fsync consumption
Nicks Hermes
committed
4326f6b
fix: writability guard before backups, durable commit marker, stale-marker checks
Nicks Hermes
committed
3f038bd
fix: recovery boundary guards, durable journals, honest availability
Nicks Hermes
committed
4d22b56
test: install-root symlink is caught by the existing symlink guard
Nicks Hermes
committed
26c468e
test: availability regression uses a drifted retained policy digest
Nicks Hermes
committed
6a69612
fix: hook-free checkout validation, backup guards, durable state transitions
Nicks Hermes
committed
b037938
test: rebuild retained rollback pair before digest/credential drift fixtures
Nicks Hermes
committed
5945492
test: align rollback fixtures with publish-over-unusable-incumbent semantics
Nicks Hermes
committed
48c6c68
fix: durable rollback publication, boundary-ordered recovery, exact checkout snapshots
Nicks Hermes
committed
4a5e2f3
test: round-ten regressions for durability, boundaries, and checkout pinning
Nicks Hermes
committed
e736b1f

Commits on Aug 13, 2026

fix: durable journal retirement, boundary sync before finalize, honest marker reports
Nicks Hermes
committed
f4b3df2
test: marker-committed rollback reports change; regression coverage
Nicks Hermes
committed
33d54ab
fix: durable restore retirement, failed-deploy audit, capability binding, honest reload
Nicks Hermes
committed
5e1b765
test: capability cross-installation rejection, reload-failure uninstall, live-checkout trap restoration
Nicks Hermes
committed
e574a7d
fix: recovery without deployed dependencies, durable uninstall, key parsing, pointer names
Nicks Hermes
committed
41601a3
test: uninstall without configuration directory removes the deployment surface
Nicks Hermes
committed
f0ca8c4
fix: fail-closed durability for journals, drain markers, consumption, uninstall
Nicks Hermes
committed
e5e722a
fix: rollback core durable before commit marker, audit inode restore, timer and deployed boundaries
Nicks Hermes
committed
c5097c4
test: audit-inode restore, drifted-timer uninstall stop, deployed-boundary recovery guard
Nicks Hermes
committed
edede66
fix: production gate, drift-unit role rejection, snapshot and availability validation
Nicks Hermes
committed
fc43923
test: round-fifteen regressions; state-snapshot helper for recovery fixtures
Nicks Hermes
committed
acd287f
fix: reject ordinary-CI timers, timer-aware uninstall no-op, document production disabled
Nicks Hermes
committed
d4f00d6
test: ordinary-CI drift timer rejection fixture
Nicks Hermes
committed
146dd29
fix: fail-closed mixed-role helper in runtime, policy snapshot removed before re-exec
Nicks Hermes
committed
48a538d
fix: timer enablement scope, Docker pull-in for scheduled services, repair over damaged release
Nicks Hermes
committed
1dc18a0
test: repair replaces a damaged active release from the validated checkout
Nicks Hermes
committed
376eeae
fix: marker after boundary durability, active-marker sync, timer probes, rollback inhibitor
Nicks Hermes
committed
399cd41
fix: inhibited adapter call, durable marker clearing, honest uninstall, consumption audit
Nicks Hermes
committed
42be82d
fix: last-known-good validation before deploy, production rollback gate, credential-marker rejection, replay protection
Nicks Hermes
committed
5275e21
test: marker-deleting adapter cannot replay; regressions pass
Nicks Hermes
committed
3938a7d
fix: full retained-pair validation before deploy, audit prefix integrity, request snapshot digest, rollback baseline
Nicks Hermes
committed
b968ff2
test: rollback baseline gate, consumption-marker replay guard, audit-change fixtures
Nicks Hermes
committed
0ebff52
fix: directory-level marker restore, full release validation, availability gate, identity grammar, pointer restore
Nicks Hermes
committed
53cf72b
test: directory-level consumption restore, regressions for round twenty-two
Nicks Hermes
committed
381ac8b
fix: pointer restore ordering, full release predicate, audit prefix restore, production cleanup gate, lock-preserving re-exec
Nicks Hermes
committed
f9ea431
fix: retire incumbent snapshot only after the durable success audit
Nicks Hermes
committed
ae6302c
fix: post-publication pointer truth, success-path marker preservation, state validation, drain start failure
Nicks Hermes
committed
f0b62de
fix: incumbent-based retirement, controller-side deployer guard, bounded stop
Nicks Hermes
committed
d119c29
test: controller installer rejects a deployer host
Nicks Hermes
committed
886a95d
fix: controller rollback guard, incumbent content restore, audit ordering, shortcut metadata, local Docker
Nicks Hermes
committed
16d5851
fix: shared role-admission lock, maintenance Docker sanitization, per-file incumbent restore, shortcut metadata, pre-adapter durability
Nicks Hermes
committed
5c8302c
fix: incumbent metadata restore, audit metadata repair, retained-pair preservation
Nicks Hermes
committed
d46ed5d

Commits on Aug 14, 2026

fix: restore recovery metadata after adapter drift
Nicks Hermes
committed
abb8dd7

Commits on Aug 15, 2026

test: separate recovery metadata fixture paths
Nicks Hermes
committed
ee99bfc

Commits on Aug 16, 2026

fix: preserve deployer rollback across adapter updates
Nicks Hermes
committed
b58e8d2
fix: retain completed deployment rollback marker
Nicks Hermes
committed
515b071

Commits on Aug 17, 2026

fix: accept canonical Debian os-release symlink
Nicks Hermes
committed
668213b
test: exercise os-release symlink during install
Nicks Hermes
committed
2ad48c7