archy/tests/apps/podsteadr/MANIFEST-PREPARATION.md

Fixture-only Podsteadr manifest preparation

These inputs are deliberately outside apps/ and every catalog. They are NOT an approved installation, first-start provisioning contract, data migration, public exposure, or publication. Do not copy them into a live catalog.

fixture_manifests.py writes three JSON-as-YAML manifests into an existing empty output directory, with exclusive creation and no engine/service/ownership action:

python3 tests/apps/podsteadr/fixture_manifests.py \
  --app-image <full-immutable-id> --mtx-image <nonroot-wrapper-immutable-id> \
  --blossom-image <full-immutable-id> --server-pubkey <synthetic-public-key-hex> \
  --data-root /var/lib/archipelago/fixture-podsteadr-example --output <empty-directory>

The data root is restricted to /var/lib/archipelago/fixture-podsteadr-* inside an approved disposable VM/engine; the generator never creates or populates it. The canonical parser deliberately rejects arbitrary /tmp host binds; do not relax that policy for a fixture. No generated file is installed on this host. All exposed ports bind loopback only. The named fixture network must be separately prepared in an approved disposable engine; network_policy: isolated is not itself proof of no egress. The currently qualified network-none media runner remains separate from manager acceptance.

Corrections relative to the old proposal:

• Explicit native administrator binding; no first-login administrator claim.
• Podsteadr carries its qualified canonical provider in the image; no attempted copy into a read-only root. Blossom receives a separately prepared read-only bridge directory, not a privileged write hook.
• Hardened Blossom uses /data, /config/config.json, and /bridge, nonroot image/data ownership, read-only root and no extra capabilities.
• Blossom's allowlist explicitly includes the distinct pre-existing synthetic Podsteadr public server key alongside the native uploaders. No secret key is read/exported or generated by this tool. An absent/malformed key is refused.
• Shared recordings are read-only in Podsteadr, writable in MediaMTX.
• MediaMTX remains the qualified 1.19.2. Build MediaMTX.fixture.Dockerfile from an exact immutable local upstream ID with --pull=never --network=none; its only change is USER 1000:1000. Verify the resulting immutable image's user. This avoids pretending that data_uid changes process UID, and does not add an unreviewed field to the shared renderer.
• Configuration files have overwrite:false; no recursive chown/migration hook.
• No relays or real mint endpoints: financial paths are outside this fixture.

Still required before managed acceptance:

1. Review the new durable service-key bootstrap and its managed binding contract. node dist/provision-server-key.js /data now prepares or loads the same key as the server, emitting only {version:1,publicKey}. The opt-in fixture mode PODSTEADR_KEY_BOOTSTRAP=1 in run-media-disposable.sh qualifies bootstrap → sidecars with that public allowlist → app, then actual media upload/recreation. It refuses unsafe existing keys and missing keys beside nonempty app data. This breaks the cycle in a disposable composition, NOT in the production manager: reviewed hook ownership, public-key receipt binding, interruption, rotation and restore behavior still need managed qualification. These manifests continue to require the explicit matching public key. Rotation to an unbound key must fail closed, not fall back to arbitrary uploads.
2. Independently qualify nonempty bind ownership, containment, backup/migration, rollback and startup/recreation in an approved disposable manager VM/engine. A wrapper image and parsed manifests are not those tests.
3. Preserve the qualified explicit upload-size contract: the general Blossom default remains16MiB. The separately qualified opt-in image supports2GiB; --large-upload-candidate sets it only for that fixture. Actual2GiB exact-byte upload/recreation and17MiB wizard checks are retained separately. This is not permission to change installed limits or use the flag with the old image.
4. Qualify production URL/origin/HTTPS/native consent/WHIP/ICE/device/payment reconciliation and accepted provenance. Loopback fixture URLs are not public podcast deployment configuration.

Pure preparation regression:

python3 tests/apps/podsteadr/test_fixture_manifests.py

The generated samples are checked against the canonical Rust parser by podsteadr_fixture_manifests_use_canonical_schema_without_relaxing_bind_policy; all 88 container-library tests passed on source bd143f197. The nonroot wrapper also passed the separate actual media-chain/recreation fixture. Run contributor preflight on actual generated inputs; neither parser nor media-fixture results qualify manager startup, managed key provisioning, bind migration or public deployment.