ops(svos): main 33a7077 (v0.0.13+2) on nh3-svos + nh3-dev — kernel 0.0.13, interface 0.0.5 (briefs), postoffice 0.0.3, UI 0.0.18

On svos-dev's ask, under Prime's 0955 go. The interface unit gets SVOS_ARTIFACT_HOST=nh3-svos via a drop-in, and the briefs artifact mapping uses the same host. Both changed manifests were held for the owner, and each app read down (wrong-revision) until Prime approved its card: interface at 11:09:45, postoffice at 11:11:17. The postoffice was rolled only once he was at the board, since a held bridge carries no Miranda mail. Health: schema 13, config_gen 33f001f4e2dbc7dc, apps up 7.
2026-10-14 11:11:59 -07:00
parent a84f6b00df
commit dd816662dc
2 changed files with 89 additions and 1 deletions
@@ -0,0 +1,88 @@
+# nh3-svos -> SVOS main 33a7077 (v0.0.13 + 2): kernel 0.0.13 (no migration), connector base 0.0.9, app-interface 0.0.5
+# (needs SVOS_ARTIFACT_HOST), app-postoffice 0.0.3 wheel (runs on nh3-dev), UI 0.0.18. One config row: the interface briefs
+# artifact mapping (host = the interface's SVOS_ARTIFACT_HOST). svos-dev's ask on Prime's 0955 go (thread 01M4XSGTE30G33X6SR76B03JFJ).
+steps:
+  - name: Private staging dir
+    shell: install -d -m 0700 /tmp/svos-stage-33a7077
+  - {name: stage release, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-33a7077/svos-release-33a7077.tar.gz, dest: /tmp/svos-stage-33a7077/release.tar.gz, mode: "0644"}}
+  - {name: stage uv, upload: {src: /home/lkraven/bin/uv, dest: /tmp/svos-stage-33a7077/uv, mode: "0755"}}
+  - {name: stage installer, upload: {src: /tmp/claude-1000/-home-lkraven-development-eshpfi-management/a0a50e2d-b274-4f8c-b8e6-0606c48d35b5/scratchpad/svos-33a7077/install-release.py, dest: /tmp/svos-stage-33a7077/install-release.py, mode: "0644"}}
+  - name: Verify staged hashes
+    shell: cd /tmp/svos-stage-33a7077 && printf '%s  %s\n' abd2af171f3408431ab33ea097244692c846995c98308df1487413013fc5612c release.tar.gz 83aa128da93e168283ed32cf75cd819fe17b135b3fc1f7ccb3c912eec198d9fb uv | sha256sum -c -
+    changed_when: "false"
+  - name: Install release 33a7077 beside the live one (current NOT switched)
+    sudo: true
+    shell: python3 /tmp/svos-stage-33a7077/install-release.py
+  - name: New kernel accepts the live configuration as it is
+    sudo: true
+    shell: runuser -u svc-svos -- /opt/svos/releases/33a7077/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos
+  - name: The interface unit gets SVOS_ARTIFACT_HOST (0.0.5 fails closed without it); takes effect at the restart below
+    sudo: true
+    shell: |
+      install -d -m 0755 /etc/systemd/system/svos-interface.service.d
+      printf '%s\n' '# U16 (2026-10-14): names every task brief reference; must equal the instance.toml mapping host byte for byte' '[Service]' 'Environment=SVOS_ARTIFACT_HOST=nh3-svos' > /etc/systemd/system/svos-interface.service.d/20-artifact-host.conf
+      systemctl daemon-reload; systemctl show svos-interface -p Environment | tr ' ' '\n' | grep ARTIFACT
+  - name: Stop the local apps then the kernel (terminal, postoffice, miranda, agent run on nh3-dev since U13)
+    sudo: true
+    shell: systemctl stop svos-voice svos-knowledge svos-interface svos-kernel; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+  - name: Offline backup to /var/lib/svos/backup/pre-33a7077 (schema 13 database + config)
+    sudo: true
+    shell: |
+      set -e
+      d=/var/lib/svos/backup/pre-33a7077
+      runuser -u svc-svos -- install -d -m 0700 $d
+      runuser -u svc-svos -- python3 -c "
+      import sqlite3
+      src = sqlite3.connect('/var/lib/svos/state/svos.db'); dst = sqlite3.connect('/var/lib/svos/backup/pre-33a7077/svos.db')
+      src.backup(dst); dst.close(); src.close()
+      c = sqlite3.connect('file:/var/lib/svos/backup/pre-33a7077/svos.db?mode=ro', uri=True)
+      print('integrity', c.execute('pragma integrity_check').fetchone()[0], 'user_version', c.execute('pragma user_version').fetchone()[0])"
+      runuser -u svc-svos -- tar -C /var/lib/svos -cf $d/config-keys-apps.tar config state/keys state/apps state/config-generations apps
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml /var/lib/svos/config/instance.toml.pre-33a7077
+      ls -la $d | tail -3
+  - name: Config for U16 (the interface briefs mapping), then the NEW kernel must accept it (else restore + old kernel back)
+    sudo: true
+    shell: |
+      runuser -u svc-svos -- python3 - <<'PY'
+      import os
+      p = "/var/lib/svos/config/instance.toml"; s = open(p).read()
+      anchor = '[[notifications.artifacts]]\nhost = "nh3-svos"\nroot = "/var/lib/svos/apps/terminal/tasks"\napp = "app-terminal"\nverb = "artifact"\n'
+      assert s.count(anchor) == 1, s.count(anchor)
+      assert "interface/briefs" not in s
+      add = ('\n# U16 (main 33a7077, 2026-10-14): app-interface task briefs. host = the interface unit\'s SVOS_ARTIFACT_HOST (drop-in\n'
+             '# svos-interface.service.d/20-artifact-host.conf), byte for byte; root = its SVOS_DATA_ROOT + /state/apps/interface/briefs.\n'
+             '[[notifications.artifacts]]\nhost = "nh3-svos"\nroot = "/var/lib/svos/state/apps/interface/briefs"\napp = "app-interface"\nverb = "artifact"\n')
+      s = s.replace(anchor, anchor + add)
+      t = p + ".tmp"; fd = os.open(t, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+      with os.fdopen(fd, "w") as f: f.write(s)
+      os.replace(t, p); print("edited")
+      PY
+      if runuser -u svc-svos -- /opt/svos/releases/33a7077/kernel-env/bin/svos-kernel check-config --data-root /var/lib/svos; then exit 0; fi
+      runuser -u svc-svos -- cp -p /var/lib/svos/config/instance.toml.pre-33a7077 /var/lib/svos/config/instance.toml
+      systemctl start svos-kernel.service svos-interface svos-knowledge svos-voice; echo "RESTORED config, old kernel restarted"; exit 1
+  - name: Switch current to 33a7077
+    sudo: true
+    shell: ln -sfn /opt/svos/releases/33a7077 /opt/svos/current.new && chgrp -h svc-svos /opt/svos/current.new && mv -T /opt/svos/current.new /opt/svos/current && readlink /opt/svos/current
+  - name: Start the kernel (READY-gated; no migration) then the local apps
+    sudo: true
+    shell: |
+      t0=$(date +%s.%N); systemctl start svos-kernel.service; rc=$?; t1=$(date +%s.%N)
+      echo "kernel start rc=$rc after $(python3 -c "print(round($t1-$t0,2))") s"
+      systemctl start svos-interface svos-knowledge svos-voice
+      for i in $(seq 1 60); do h=$(curl -s http://127.0.0.1:8400/health); case "$h" in *'"down":0'*) case "$h" in *'"unknown":0'*) break;; esac;; esac; sleep 1; done
+      echo "$h"; systemctl is-active svos-kernel svos-interface svos-knowledge svos-voice | tr '\n' ' '; echo
+      journalctl -u svos-kernel --since "-90s" --no-pager -o cat | grep -i -E "migrat|0013|schema|error|refus" | tail -6 | cut -c1-200
+  - name: Regenerate the front door inventory (d95078c becomes the previous release)
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory 2>&1 | grep -E 'GENERATED|updated|root \*|path /assets' | head -6
+verify:
+  - name: Inventory current
+    sudo: true
+    shell: /usr/local/sbin/svos-front-inventory --check
+    changed_when: "false"
+  - name: Health is schema 13, status ok, nothing down
+    shell: h=$(curl -s http://127.0.0.1:8400/health); echo "$h"; echo "$h" | grep -q '"schema_version":13' && echo "$h" | grep -q '"status":"ok"' && echo "$h" | grep -q '"down":0'
+    changed_when: "false"
+  - name: App listener still refuses an uncredentialed kernel-key (401 from the kernel)
+    shell: test "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8410/auth/kernel-key)" = 401
+    changed_when: "false"