Creatidy/scarcity-router
5
0
Fork 0
Code Issues 13 Pull requests Projects Releases Packages Wiki Activity Actions

M10: Distribution, installation, update, and end-to-end acceptance #95

New issue
Closed
opened 2026-09-19 13:09:25 +00:00 by kilo · 1 comment
kilo commented 2026-09-19 13:09:25 +00:00
Member
Copy link

Goal

Provide a repeatable installation and update path rather than only a developer checkout, and prove the program end to end.

Module of the execution-gateway program; architecture and contracts come from A0 (#85).

User value

A user installs the server (one container) and, where needed, the worker (one native package), updates safely, and gets an honest acceptance matrix — not a README fiction.

Relationship to current code

  • Extends the existing packaging (D-034 wheel, make install from issue #74, make package-check) with server containerization and native worker packaging.
  • Recommendation-only installation remains exactly what exists today: installable without the server, a worker or Docker.

Scope

  • Server container image; minimal Docker Compose example; persistent data handling; backup/restore expectations; schema/config migrations; Windows worker packaging; Linux worker packaging; per-user autostart; uninstall; update path; version compatibility; CI coverage; integration fixtures; security acceptance scenarios.
  • Measure actual first-run steps and identify friction.

Non-goals

  • No fictional artifacts: no documented Winget package, PyPI publication or installer until that artifact actually exists (U-008/U-009 remain open for public-index naming/publication decisions).
  • No end-to-end scenario may depend on Creatidy, the author's private domain, the author's private VPN or private repositories.

Contracts / interfaces affected

Deployment/configuration contracts (A0); the migration plan (A0); no serialized-contract changes originate here.

Dependencies

  • Depends on: A0 (#85), M01 (#86), M02 (#87), M03, M04, M05 — the first full vertical slice plus the worker.
  • Deliberately NOT blocked by M06/M07: experimental adapters must never block distribution.
  • Feeds: the whole program's completion gate.

Acceptance criteria

  • Installation from README verified on clean environments.
  • Scenarios covered: API-only server with no worker; server and worker on one machine; server and worker on different hosts; client access through LAN/VPN; Windows 11 + WSL; Linux accessed through SSH; server restart; worker restart; worker offline; revoked credential; exhausted quota; invalid certificate/identity; version upgrade.
  • Recommendation-only operation remains installable without the server, a worker or Docker.
  • First-run friction measured and reported.
  • Paid-provider tests are explicit opt-in only.
  • Security acceptance scenarios from A0's threat model pass: authentication for administrator/client/worker identities, revocation, verified TLS, body/context/output/concurrency/time/spending limits, session/filesystem/tool isolation, and no secret/prompt leakage in logs or diagnostics — including logs created by local runtimes, not only server logs.
  • Full validation gate green; CI covers build, package and the deterministic suites.

Security considerations

This issue verifies the whole security posture end to end (A0's threat model as implemented by M03/M04/M05/M06/M07/M09). Security failures here are program blockers, not documentation notes.

Risks

  • Cross-platform packaging maintenance burden — mitigated by keeping the worker minimal and the protocol versioned.
  • Clean-environment test flakiness — mitigated by scripted environment provisioning in CI fixtures.

Evidence still required

  • Windows autostart/service mechanism evidence; container base-image and data-volume layout decisions from A0.
## Goal Provide a repeatable installation and update path rather than only a developer checkout, and prove the program end to end. Module of the execution-gateway program; architecture and contracts come from A0 (#85). ## User value A user installs the server (one container) and, where needed, the worker (one native package), updates safely, and gets an honest acceptance matrix — not a README fiction. ## Relationship to current code - Extends the existing packaging (D-034 wheel, `make install` from issue #74, `make package-check`) with server containerization and native worker packaging. - Recommendation-only installation remains exactly what exists today: installable without the server, a worker or Docker. ## Scope - Server container image; minimal Docker Compose example; persistent data handling; backup/restore expectations; schema/config migrations; Windows worker packaging; Linux worker packaging; per-user autostart; uninstall; update path; version compatibility; CI coverage; integration fixtures; security acceptance scenarios. - Measure actual first-run steps and identify friction. ## Non-goals - No fictional artifacts: no documented Winget package, PyPI publication or installer until that artifact actually exists (U-008/U-009 remain open for public-index naming/publication decisions). - No end-to-end scenario may depend on Creatidy, the author's private domain, the author's private VPN or private repositories. ## Contracts / interfaces affected Deployment/configuration contracts (A0); the migration plan (A0); no serialized-contract changes originate here. ## Dependencies - Depends on: A0 (#85), M01 (#86), M02 (#87), M03, M04, M05 — the first full vertical slice plus the worker. - Deliberately NOT blocked by M06/M07: experimental adapters must never block distribution. - Feeds: the whole program's completion gate. ## Acceptance criteria - [ ] Installation from README verified on clean environments. - [ ] Scenarios covered: API-only server with no worker; server and worker on one machine; server and worker on different hosts; client access through LAN/VPN; Windows 11 + WSL; Linux accessed through SSH; server restart; worker restart; worker offline; revoked credential; exhausted quota; invalid certificate/identity; version upgrade. - [ ] Recommendation-only operation remains installable without the server, a worker or Docker. - [ ] First-run friction measured and reported. - [ ] Paid-provider tests are explicit opt-in only. - [ ] Security acceptance scenarios from A0's threat model pass: authentication for administrator/client/worker identities, revocation, verified TLS, body/context/output/concurrency/time/spending limits, session/filesystem/tool isolation, and no secret/prompt leakage in logs or diagnostics — including logs created by local runtimes, not only server logs. - [ ] Full validation gate green; CI covers build, package and the deterministic suites. ## Security considerations This issue verifies the whole security posture end to end (A0's threat model as implemented by M03/M04/M05/M06/M07/M09). Security failures here are program blockers, not documentation notes. ## Risks - Cross-platform packaging maintenance burden — mitigated by keeping the worker minimal and the protocol versioned. - Clean-environment test flakiness — mitigated by scripted environment provisioning in CI fixtures. ## Evidence still required - Windows autostart/service mechanism evidence; container base-image and data-volume layout decisions from A0.
kilo commented 2026-09-21 17:06:16 +00:00
Author
Member
Copy link

Closeout (v0.1.0 release-readiness reconciliation, 2026-09-21). M10 implementation and deterministic acceptance are complete; the explicit external gates are preserved below rather than treated as unfinished implementation. The authoritative record is docs/m10-acceptance.md (platform support table, all 19 issue scenarios dispositioned, measured first-run friction, external gates) and docs/m10-security-acceptance.md (26-row security matrix, every row mapped to a test).

  • Delivered: server container (built and live-verified on this host: non-root uid 10001, /data persistence, healthcheck, restart, verified-TLS/wrong-CA/plaintext discipline), compose example, wheel/sdist distribution with isolated uv tool install smoke (make package-check), four console scripts, systemd user-service worker path, update/uninstall discipline, version surface, GHCR/MSIX/PyPI recorded as honest future-or-external contracts.
  • Acceptance: the sixteen mission scenarios pass deterministically (60+ M10 acceptance tests, all synthetic/loopback/quota-free; no paid-provider test exists); the M06 Codex e2e layer (24 tests) completes the M10-B scope; first-run friction measured honestly (recommendation-only 2 commands, server 8 steps, worker 5 steps).
  • Preserved external gates (each blocks only its own acceptance item, none is unrecorded implementation work):
    • EXTERNAL_ACCEPTANCE_GATE: LIVE_CODEX_SUBSCRIPTION — one live turn-level Codex execution requires the owner's interactive codex login against the dedicated controlled home.
    • EXTERNAL_ACCEPTANCE_GATE: LIVE_WINDOWS_ACCEPTANCE — the release-built Windows worker ZIP/tray has not been exercised on a real Windows 11 host; packaging shape is verified statically.
    • EXTERNAL_RELEASE_GATE: WINDOWS_CODE_SIGNING — signing needs an owner-held certificate; the workflow MSIX seam fails closed; per D-046 this does NOT block an honestly-labeled portable-ZIP v0.1.0.
    • PYPI_TRUSTED_PUBLISHER (+ Forgejo/branch-protection owner actions) — publication stays workflow-gated and unexecuted; the owner checklist is in docs/release-engineering.md.
  • Validation gate green: make check 1868 tests OK, basedpyright clean, make package-check green; Forgejo CI green on develop (run #25).

Closing as complete subject to the recorded external gates; docs/roadmap.md now records M10 accordingly.

**Closeout (v0.1.0 release-readiness reconciliation, 2026-09-21).** M10 implementation and deterministic acceptance are complete; the explicit external gates are preserved below rather than treated as unfinished implementation. The authoritative record is `docs/m10-acceptance.md` (platform support table, all 19 issue scenarios dispositioned, measured first-run friction, external gates) and `docs/m10-security-acceptance.md` (26-row security matrix, every row mapped to a test). - Delivered: server container (built and live-verified on this host: non-root uid 10001, `/data` persistence, healthcheck, restart, verified-TLS/wrong-CA/plaintext discipline), compose example, wheel/sdist distribution with isolated `uv tool` install smoke (`make package-check`), four console scripts, systemd user-service worker path, update/uninstall discipline, version surface, GHCR/MSIX/PyPI recorded as honest future-or-external contracts. - Acceptance: the sixteen mission scenarios pass deterministically (60+ M10 acceptance tests, all synthetic/loopback/quota-free; no paid-provider test exists); the M06 Codex e2e layer (24 tests) completes the M10-B scope; first-run friction measured honestly (recommendation-only 2 commands, server 8 steps, worker 5 steps). - **Preserved external gates (each blocks only its own acceptance item, none is unrecorded implementation work):** - `EXTERNAL_ACCEPTANCE_GATE: LIVE_CODEX_SUBSCRIPTION` — one live turn-level Codex execution requires the owner's interactive `codex login` against the dedicated controlled home. - `EXTERNAL_ACCEPTANCE_GATE: LIVE_WINDOWS_ACCEPTANCE` — the release-built Windows worker ZIP/tray has not been exercised on a real Windows 11 host; packaging shape is verified statically. - `EXTERNAL_RELEASE_GATE: WINDOWS_CODE_SIGNING` — signing needs an owner-held certificate; the workflow MSIX seam fails closed; per D-046 this does NOT block an honestly-labeled portable-ZIP v0.1.0. - `PYPI_TRUSTED_PUBLISHER` (+ Forgejo/branch-protection owner actions) — publication stays workflow-gated and unexecuted; the owner checklist is in `docs/release-engineering.md`. - Validation gate green: `make check` 1868 tests OK, basedpyright clean, `make package-check` green; Forgejo CI green on `develop` (run #25). Closing as complete subject to the recorded external gates; `docs/roadmap.md` now records M10 accordingly.
kilo closed this issue 2026-09-21 17:06:25 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-246-authorized-receipt
issue-245-mi-startup
issue-226-administrator-ux
issue-183-observer-access
issue-183-event-acceptance
issue-183-internal-events
issue-183-resource-state
issue-242-secure-bootstrap
issue-238-mi-server
issue-239-architecture-reconciliation
issue-224-certificate-lifecycle
issue-224-origin-bound-worker
issue-224-worker-ca-trust
issue-234-evidenced-resources
issue-186-installed-lifecycle
issue-186-ghcr-distribution
issue-225-cancel-paths
issue-228-backlog-disposition
issue-222-active-mi
issue-176-mi-consumer
issue-185-contract-conformance
issue-219-project-security-audit
issue-181-responses-subset
issue-214-claude-subscription
issue-205-review-result-recovery
issue-174-executable-contract
issue-215-conversational-review
issue-210-d069-review-governance
issue-212-d069a-bootstrap
issue-202-dependency-eligibility
issue-184-strict-no-payg
issue-175-kernel-requirements
issue-180-native-authority-boundary
issue-182-readable-status
issue-195-post-selection-gates
issue-179-catalog-effort
issue-178-exact-target-pin
issue-190-workflow-self-remediation
task/168-capacity-controlled-home
fix/143-scenario11-cancel-race
policy/zai-model-governance-campaign
main
No results found.
Labels
Clear labels   
accessibility
Barrier affecting people with disabilities

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
P1
Owner-declared highest explicit implementation priority (loop ordering rank)

  
P2
Required product and integration work

  
P3
Deferred or producer-dependent work

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Depends on
#85 A0: Architecture, decisions, and contracts for the optional execution gateway
Creatidy/scarcity-router
#86 M01: Resource registry, state, and collectors for executable resources
Creatidy/scarcity-router
#87 M02: Routing core, policy, and client-requirement binding for executable targets
Creatidy/scarcity-router
#88 M03: OpenAI-compatible gateway and execution coordinator
Creatidy/scarcity-router
#89 M04: Generic OpenAI-compatible HTTP adapter and Ollama integration
Creatidy/scarcity-router
#90 M05: Native worker, pairing, and execution transport
Creatidy/scarcity-router
Reference
Creatidy/scarcity-router#95
No description provided.