feat(svos): v0.0.14 (3726d73) release playbooks — staged on nh3-svos and built on nh3-dev; cutover in three phases held for Prime's card window

2026-10-17 07:50:44 -07:00
parent bc91b40ac5
commit b72783cb3c
4 changed files with 143 additions and 0 deletions
@@ -0,0 +1,53 @@
+# nh3-svos -> SVOS v0.0.14 (3726d73): kernel 0.0.14 (migration 0014, schema 14), app-interface 0.0.6 (briefs index v1->v2 at
+# its first start), connector base 0.0.10, UI 0.0.19. svos-dev's ask (thread 01M5558E19Q3ZK4RRZXQG6A2Y9), pushed on Prime's
+# 0245 go. PRE-REQ: nh3-svos-3726d73-v0.0.14-stage.yaml (installs the release beside the live one).
+# PHASE A of three, in svos-dev's order: A = this (kernel, knowledge, voice; the interface is LEFT STOPPED),
+# B = nh3-dev-svos-3726d73-v0.0.14.yaml (connector base + app-terminal; raises ONE card),
+# C = nh3-svos-3726d73-v0.0.14-interface.yaml (app-interface + the web build; raises ONE card).
+# Run A..C only while Prime can approve both cards within 15 minutes: a held app refuses wrong-revision (reads DOWN).
+steps:
+  - name: The release is staged and accepts the live config
+    sudo: true
+    shell: test -f /opt/svos/releases/3726d73/apps-env/pyvenv.cfg && runuser -u svc-svos -- /opt/svos/releases/3726d73/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
+    changed_when: "false"
+  - name: Stop the local apps then the kernel
+    sudo: true
+    shell: systemctl stop svos-voice svos-knowledge svos-interface svos-kernel; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+  - name: Offline backup to /var/lib/svos/backup/pre-3726d73 (schema 13 database, the v1 briefs index, config)
+    sudo: true
+    shell: |
+      set -e
+      d=/var/lib/svos/backup/pre-3726d73
+      runuser -u svc-svos -- install -d -m 0700 $d
+      runuser -u svc-svos -- python3 -c "
+      import sqlite3
+      for src, dst in (('/var/lib/svos/state/svos.db', '$d/svos.db'), ('/var/lib/svos/state/apps/interface/briefs.sqlite3', '$d/briefs.sqlite3')):
+          s = sqlite3.connect(src); t = sqlite3.connect(dst); s.backup(t); t.close(); s.close()
+          c = sqlite3.connect('file:' + dst + '?mode=ro', uri=True)
+          print(dst, 'integrity', c.execute('pragma integrity_check').fetchone()[0], 'user_version', c.execute('pragma user_version').fetchone()[0])"
+      runuser -u svc-svos -- tar -C /var/lib/svos -cf $d/config-keys-apps.tar config state/keys state/apps state/config-generations apps
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-3726d73
+      ls -la $d | tail -4
+  - name: Switch current to 3726d73
+    sudo: true
+    shell: ln -sfn /opt/svos/releases/3726d73 /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
+  - name: Start the kernel (READY-gated; migration 0014) then knowledge and voice (the interface waits for phase C)
+    sudo: true
+    shell: |
+      t0=$(date +%s.%N); systemctl start svos-kernel.service; rc=$?; t1=$(date +%s.%N)
+      echo "kernel start rc=$rc after $(python3 -c "print(round($t1-$t0,2))") s"
+      systemctl start svos-knowledge svos-voice
+      sleep 5; curl -s http://127.0.0.1:8400/health; echo
+      systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+      journalctl -u svos-kernel --since "-90s" --no-pager -o cat | grep -i -E "migrat|0014|schema|error|refus" | tail -6 | cut -c1-200
+      test $rc -eq 0
+verify:
+  - name: Health is schema 14, status ok
+    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"schema_version":14' && echo "$h" | grep -q '"status":"ok"'
+    changed_when: "false"
+  - name: GET /seats profiles.tasks publishes brief_max_chars and ceilings.check_seconds (read with the local admin path if open, else skip)
+    shell: curl -s http://127.0.0.1:8400/seats | python3 -c "import sys,json; d=json.load(sys.stdin); t=d.get('profiles',{}).get('tasks',{}); print('brief_max_chars', t.get('brief_max_chars'), 'check_seconds', (t.get('ceilings') or {}).get('check_seconds'))" 2>&1 || true
+    changed_when: "false"
+  - name: App listener still refuses an uncredentialed kernel-key (401 from the kernel)
+    shell: test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8410/auth/kernel-key)" = 401
+    changed_when: "false"