45 Commits

Include renames

Author	SHA1	Message	Date
KyuubiYoru	e3b687c903	fix(release): keep publication off GitHub-only actions (#1) ... upload-artifact@v4 speaks the v2 artifacts API, which this Gitea answers only at its v3-era shape, so the sixth release attempt cleared every gate and then aborted at "Preserve verified candidate artifacts" with the GHES compatibility error. Move the step to v3.2.1, the commit the upstream v3 tag resolves to, which keeps name, path, if-no-files-found and retention-days unchanged. The step also becomes continue-on-error: it is a pre-publish debugging backstop, and publish-release.sh attaches the same directory as Gitea release assets, so losing it must never cost a release. Replace cosign-installer with the direct fetch the scanner already uses. The action issues no API call on this path, but it is a composite action resting on envsubst and a resolved runner.arch, neither of which this runner has exercised. Asked for the version it bootstraps, it downloads exactly cosign-linux-amd64 from the v3.0.6 release, compares it against c956e5df..., and exits; that digest matches the release checksums file, so fetching the asset directly verifies identically with nothing unproven left before the one-way publication gate. The binary joins the PATH that publish-release.sh already resolves dotnet through.	2026-08-22 22:10:00 +02:00
KyuubiYoru	747e3bb9c3	test(client): survive a starved stream handshake (#1) ... Opening an SSE stream is a single unretried request bounded by RendezvousClientOptions.RequestTimeout. On the release runner the suite shares a builder container with parallel image builds, so the loopback handshake can lose its whole wall-clock budget to thread-pool starvation; the client then reports a typed ServiceUnavailable that the test asserted against as if it were the reset event. Retry the open from the same replayable cursor, raise the per-request budget to the contract ceiling, and drop protocol keepalives so a slow interval between assertions cannot be mistaken for a session event. The retry only fires on the transport failure the stream endpoint can never produce as an envelope, is bounded, and yields the final failure verbatim, so a genuinely broken stream still fails.	2026-08-22 21:42:21 +02:00
KyuubiYoru	562b8308b7	fix(release): run trivy from a pinned verified binary (#1) ... trivy-action checks its own repository out of github.com using the runner token; on this self-hosted Gitea that token is a Gitea token, GitHub answers "Bad credentials", and both scan steps die before trivy is installed. Download the v0.69.3 release archive directly, verify it against a sha256 digest pinned inline, and unpack only the binary into .release-work/bin, which is gitignored and excluded from the Docker build context. The gate keeps its exact semantics: --exit-code 1, --severity HIGH,CRITICAL, table output, unfixed vulnerabilities still in scope. The SPDX step writes the same filename release_artifacts.py normalize-container-sbom consumes, and TRIVY_CACHE_DIR keeps the vulnerability DB inside the work directory.	2026-08-22 21:06:21 +02:00
KyuubiYoru	589f802e2e	fix(ci): smoke through service namespace (#1)	2026-07-17 02:16:21 +02:00
KyuubiYoru	4423503bba	fix(ci): reduce readiness probe pressure (#1)	2026-07-17 02:06:39 +02:00
KyuubiYoru	74ae126ea7	fix(ci): allow cold container startup (#1)	2026-07-17 01:59:30 +02:00
KyuubiYoru	a77d4b801c	fix(ci): isolate deployment smoke client (#1)	2026-07-17 01:53:50 +02:00
KyuubiYoru	769336e424	fix(ci): run smoke on Compose network (#1)	2026-07-17 01:42:28 +02:00
KyuubiYoru	41be7fbce5	fix(ci): join service to runner network (#1)	2026-07-17 01:36:47 +02:00
KyuubiYoru	1bca034a52	fix(ci): route smoke through Docker gateway (#1)	2026-07-17 01:29:30 +02:00
KyuubiYoru	8d98d888b3	fix(ci): resolve sibling-container bind sources (#1)	2026-07-17 01:23:16 +02:00
KyuubiYoru	ef07685d22	fix(ci): correct Docker inspect templates (#1)	2026-07-17 01:14:44 +02:00
KyuubiYoru	f9cb7f47e5	fix(ci): isolate Compose host ports (#1)	2026-07-17 01:07:56 +02:00
KyuubiYoru	de753b99e6	fix(deploy): validate complete smoke logs (#1)	2026-07-17 00:58:28 +02:00
KyuubiYoru	c3b3629515	fix(deploy): gate smoke readiness atomically (#1)	2026-07-17 00:54:04 +02:00
KyuubiYoru	e8c07ee22a	fix(deploy): synchronize smoke listing lookup (#1)	2026-07-17 00:48:13 +02:00
KyuubiYoru	d42e6c99a3	fix(ci): provision TestClient runtime (#1)	2026-07-17 00:42:16 +02:00
KyuubiYoru	c2f63db3ad	test(client): stabilize stream integration gate (#1)	2026-07-17 00:34:29 +02:00
KyuubiYoru	99885f8c8c	feat(observability): add diagnostic dashboards (#27)	2026-07-17 00:22:46 +02:00
KyuubiYoru	06c4ecf8f3	feat(browser): stream bounded live session updates (#26)	2026-07-16 23:25:48 +02:00
KyuubiYoru	95c3a4aed6	docs(operations): record v1 readiness evidence (#23)	2026-07-16 22:39:50 +02:00
KyuubiYoru	00d5ff7764	feat(operations): add production readiness gate (#23)	2026-07-16 22:19:51 +02:00
KyuubiYoru	6bad659c12	docs(integration): record Unscouted pilot evidence (#22)	2026-07-16 21:53:48 +02:00
KyuubiYoru	f368fec6eb	feat(deploy): provision Unscouted smoke tenant (#22)	2026-07-16 21:49:17 +02:00
KyuubiYoru	9e863ebf64	docs(integration): verify Godot and Linux SpaceGame pilot (#21)	2026-07-16 20:32:53 +02:00
KyuubiYoru	ebb5eb617c	docs(integration): record SpaceGame pilot checkpoint (#21)	2026-07-16 19:18:03 +02:00
KyuubiYoru	7fb85059fb	docs: add integration guides and incident runbooks (#20)	2026-07-16 18:25:10 +02:00
KyuubiYoru	cc5793f935	feat(release): add reproducible signed artifacts (#19)	2026-07-16 17:48:21 +02:00
KyuubiYoru	609dad7cf1	feat(operations): add capacity and resilience gates (#18)	2026-07-16 15:57:01 +02:00
KyuubiYoru	08729ae25c	feat(deployment): add secure Linux runtime (#17)	2026-07-16 15:03:04 +02:00
KyuubiYoru	be732de7c9	feat(server): add observability and operator controls (#16)	2026-07-16 13:22:16 +02:00
KyuubiYoru	88ef946af5	feat(server): harden hostile input and overload behavior (#15)	2026-07-16 12:37:38 +02:00
KyuubiYoru	2ff7cd6d9d	test(integration): add deterministic NAT topology harness (#14)	2026-07-16 11:50:53 +02:00
KyuubiYoru	7e3be2cad1	feat(tooling): add standalone rendezvous test client (#25)	2026-07-16 11:05:56 +02:00
KyuubiYoru	94aba8a3bb	feat(client): standardize connection outcomes (#13)	2026-07-16 10:18:41 +02:00
KyuubiYoru	b4b6072fe1	feat(client): add rendezvous traversal coordinators (#12)	2026-07-16 08:39:05 +02:00
KyuubiYoru	6d076c281a	feat: implement authenticated NAT mediator (#11) ... Closes #11	2026-07-16 07:37:02 +02:00
KyuubiYoru	1baa1055dc	feat: implement scoped join attempts and tickets (#10) ... Closes #10	2026-07-16 06:56:30 +02:00
KyuubiYoru	06c3973ce7	feat: add publisher and browser client SDK (#9) ... Closes #9	2026-07-16 06:27:44 +02:00
KyuubiYoru	a9a2b3db35	feat: add bounded compatible session browser (#8) ... Closes #8	2026-07-16 06:06:29 +02:00
KyuubiYoru	49564c7e7e	feat: add presence-gated session leases (#7) ... Closes #7	2026-07-16 05:58:47 +02:00
KyuubiYoru	02ca502a76	feat: add atomic ephemeral state (#6) ... Closes #6	2026-07-16 05:32:48 +02:00
KyuubiYoru	47382ddadc	feat: add tenant provisioning and key lifecycle (#5) ... Closes #5	2026-07-16 05:13:35 +02:00
KyuubiYoru	69c8b2d2bc	feat: freeze v1 transport contracts (#4) ... Closes #4	2026-07-16 04:52:38 +02:00
KyuubiYoru	e626b89909	build: bootstrap solution and quality gates (#3) ... Closes #3	2026-07-16 04:25:54 +02:00