196 lines
12 KiB
Markdown
196 lines
12 KiB
Markdown
# IndeeHub private Yaya delivery — 8 October 2026
|
|
|
|
Status: optimized production build, inert Yaya backend/helper staging, existing-node public pin and fresh seven-member plan preparation passed; **not activated**.
|
|
This is private free/authenticated app testing;
|
|
paid viewing, publication and payment UAT remain separate. No funds or public
|
|
announcements are authorized by this runbook. Separately authorized inert Yaya
|
|
worker import and read-only preflight are completed (`6afb6abc`); no backend
|
|
deployment, app lifecycle change or catalog activation has occurred.
|
|
|
|
## Frozen inputs and prerequisite evidence
|
|
|
|
- Full same-boot post-target rollback: operation `5bd06edc`, qualified fixture
|
|
executable `dd94dc6d…`, embedded helper `6fc3f978…`, 2,031 backend tests passed.
|
|
- Successful full cutover and independent final checks now pass for `8b53579c`:
|
|
Committed/cleanup complete, Released maintenance, exact seven target images and
|
|
saved units, new runtime IDs, fresh DB/four-volume restore proofs and no holds.
|
|
Historical `f39bd824` timed out before target startup under host pressure, then
|
|
natively recovered cleanly; that failure is retained separately.
|
|
- Matching optimized backend build passed against all 536 unchanged inputs from
|
|
the 2,031-test snapshot. The production artifact and actual Yaya inert staging/
|
|
public-pin/fresh-plan evidence are recorded in the latest checkpoint below.
|
|
- Unsigned delivery catalog: worker runtime evidence directory,
|
|
`unsigned-full-candidate-with-worker-29627fc.json`, SHA256
|
|
`9967d06c8809d69cce6057b9f45a630e9ce21fd5cd33541e352e23336cd8eb07`.
|
|
Its frontend hooks exactly match qualified authoritative source, SHA256
|
|
`64015f79ca84c604cecd22e9e4a892644d485988f163c01e3d47277a64282747`.
|
|
- Existing frontend/API import evidence is in
|
|
`~/.local/state/archipelago/session-recovery/indeehub-yaya-private-staging-5d0ea64/`.
|
|
Worker import is complete (`6afb6abc`): qualified OCI SHA256
|
|
`6db29188c0e68ed8e9e8d84ea2e9c5c70695518e0930775bf6b3200d14d99527`.
|
|
Exact archive/blobs/image were verified; all 30 existing container identities,
|
|
start times/statuses, node identity/session, operator intent, management service
|
|
and catalogs were preserved. Receipt:
|
|
`~/.local/state/archipelago/release-qualification/worker-runtime-29627fc-20261008/yaya-worker-import-receipt-20261008.json`.
|
|
This is inert staging, not an app update or signed catalog selection.
|
|
- Preserve historical catalog signatures and all old failure journals. Require
|
|
reviewed local/ngit/Gitea main and applicable release refs to match before
|
|
catalog activation. Parent owns source acceptance and signature coordination;
|
|
check the existing signature request before requesting a new one.
|
|
|
|
## Fresh preflight before delivery mutations
|
|
|
|
The retained fresh inventory is
|
|
`~/.local/state/archipelago/release-qualification/indeehub-yaya-fresh-preflight-20261008/`.
|
|
It confirmed all seven legacy members running, original Quadlet hashes unchanged
|
|
and frontend/API pins matching their import receipt. Refresh relevant bindings
|
|
before generating/applying the final plan; an earlier snapshot is not a lease.
|
|
|
|
1. Verify actual hostname `yaya-server`, rootless Podman owner/storage, current
|
|
backend artifact/helper hashes and free durable disk capacity. The qualified
|
|
executable above is a fixture build, not an optimized release artifact.
|
|
2. Capture fresh seven-container IDs/images/start times, original Quadlet bytes,
|
|
exact volume identities, package state, lifecycle lock/journals/holds, operator
|
|
stop/uninstall intent, node identity/session hashes, active catalogs/drop-ins
|
|
and unrelated app/service identities. Compare to the retained baseline; any
|
|
unexpected drift requires review. Never print private manifests or secrets.
|
|
3. Verify frontend/API local alias@digest IDs against their import receipt. Verify
|
|
the worker archive, all OCI blob hashes and exact qualified digest. Do not pull
|
|
an unreviewed replacement or repoint an existing alias to another image.
|
|
4. Resolve the API registration manifest using the existing node identity through
|
|
the qualified registration-pin path. Registration and publication flags remain
|
|
false. Preserve existing secrets, JWT identity and public installation pin.
|
|
5. Generate a new exact original-hash-bound seven-member plan from fresh units,
|
|
using the frozen candidate for frontend, API **and worker**, with existing
|
|
dependency image digests preserved. Review the full unit/manifest delta.
|
|
Merely changing image tags or reusing the archived October 7 plan is invalid.
|
|
|
|
The offline draft planner is in
|
|
`~/.local/state/archipelago/release-qualification/indeehub-delivery-tools-20261008/`.
|
|
It explicitly reports `activation_ready=false`: its original-state inputs are
|
|
archived, public registration pins are unresolved, and signature/final live
|
|
plan checks remain open. The earlier draft predates the completed worker import;
|
|
its false readiness flag is preserved rather than presented as a current import
|
|
failure. A new plan must bind fresh live evidence. Draft SHA256
|
|
`aae8cdeca470b30481042c62f040435aa2292180cb54f0f4496d86a2204c4b8b`.
|
|
All three delivery image pins and frontend hooks match the frozen candidate.
|
|
This corrects an old planner assumption that would otherwise retain the legacy
|
|
worker. It is preparation, not an executable deployment authorization flag.
|
|
|
|
## Qualified activation sequence
|
|
|
|
Native success/rollback qualification and inert worker import are complete.
|
|
Do not repeat import merely because the earlier prepared plan still records false
|
|
flags. Reverify the exact staged alias/digest against its receipt before delivery.
|
|
After the production artifact finishes and passes its frozen-input/hash checks,
|
|
the reviewed inert staging and existing-node API registration pin preparation
|
|
completed using `/tmp/indeehub-stage-production-and-prepare-pin.py`; do not repeat
|
|
that completed step.
|
|
Finish source/mirror/signature gates and review the fresh seven-member plan.
|
|
Deploy the reviewed matching backend/helper artifact through the existing
|
|
preserving deployment procedure. Install only the exact reviewed plan and
|
|
verified signed private candidate; preserve previous catalog/drop-in bytes.
|
|
Confirm catalog selection alone has not replaced any existing app runtimes.
|
|
|
|
Run **one** `package.update` for `indeedhub`. The native supervised operation must
|
|
capture local writable-layer recovery images, acquire its maintenance barrier,
|
|
drain all seven writers, create fresh coherent backups and prove fresh database
|
|
and volume restore before target startup. Do not substitute an ad hoc volume tar,
|
|
manually pause live writers, or perform a separate API update. Monitor the same
|
|
operation to a proven terminal outcome; a caller timeout is not proof that
|
|
background recovery failed or completed. Never start another update to recover
|
|
an unfinished one.
|
|
|
|
## Acceptance before handing over the test link
|
|
|
|
Require Committed with cleanup complete, released maintenance, exact saved target
|
|
units/images, seven healthy runtimes, and unchanged identity/session, volumes,
|
|
unrelated apps and operator intent. Verify original107 migrations are retained
|
|
with exactly3 approved additions, data/media preserved, new API settings/pins
|
|
actually used, one current provider script, and publication flags still false.
|
|
|
|
On Yaya's real desktop/mobile UI, check original Nostr login identity, Browse,
|
|
Backstage saved media/projects and free authenticated playback. Give the user
|
|
Yaya's actual launch link only after these checks pass. Keep paid checkout,
|
|
producer payout, discovery/announcement and timed paid viewing acceptance open;
|
|
none is required to spend funds merely to expose private app testing.
|
|
|
|
If failure occurs, use only the supported operation-bound native recovery and
|
|
inspect its exact journal/holds. Preserve data written after cutover; never
|
|
reinstall, wipe/recreate wallets, run migration-down or restore old DB/media over
|
|
new writes automatically. Retain private recovery images, backups and receipts.
|
|
|
|
|
|
## Concrete operator-signing preparation
|
|
|
|
The current worker-inclusive unsigned catalog has not been signed. The prior
|
|
October7 signing request was unanswered and named the older frontend/API-only
|
|
candidate; it cannot establish approval/signature for the current payload.
|
|
The independently reviewed helper is:
|
|
`~/.local/state/archipelago/release-qualification/indeehub-delivery-tools-20261008/sign-reviewed-worker-catalog.py`.
|
|
Helper SHA256: `2711cfc060b71dcb7c7397a62a65971645ff861e8db3670f960c5b13baf5c13f`.
|
|
Canonical unsigned payload SHA256:
|
|
`d373968ee7043242fc954c3b1f114e236dc21f8749ea584a00360bb4db48fe30`.
|
|
|
|
Read-only pinned-input/verifier preflight passes. Noninteractive signing refuses.
|
|
The helper uses hidden operator-terminal input, makes terminal-echo fallback
|
|
fatal, passes the phrase only through the pinned ceremony executable's stdin,
|
|
and verifies the expected root and exact payload. It preserves the immutable
|
|
unsigned input and creates a separate signed output without replacing an existing
|
|
file. No secret was read, signing performed or new operator request sent during
|
|
preparation. Finish the build/source/review gates before requesting this final
|
|
operator step; never request a mnemonic in chat.
|
|
|
|
|
|
## Passed production artifact and live preparation
|
|
|
|
The optimized release build exited successfully with all 536 qualified inputs
|
|
unchanged against the 2,031-test snapshot. Executable SHA256:
|
|
`75d4562ba606c48704ffe886f31de2b2fbe6fee81a5eb2d46371118df29ef50b`
|
|
(75,754,632 bytes). Exact embedded helper SHA256:
|
|
`6fc3f978cb88dbf022dc5bc07eaf0337c6b6b79ff42b20cee7b33ed7c100b879`.
|
|
An independent inode copy, helper and build receipt are retained privately at
|
|
`~/.local/state/archipelago/private-artifacts/indeehub-production-backend-75d4562b-20261008/`.
|
|
|
|
The reviewed staging/pin runner completed on actual `yaya-server`. It verified
|
|
the executable contains the exact helper bytes, staged both without activation,
|
|
and used only the existing node identity to prepare the stable public API pin.
|
|
All 31 runtime IDs/start times/statuses, identity/session, operator intents,
|
|
catalogs and management service remained unchanged. Registration/publication
|
|
remain false. Relative to the earlier 30-runtime import baseline, an unrelated
|
|
`justworks` runtime was added (`localhost/archipelago-justworks:0.1.0`, created
|
|
2026-10-08T12:42:16.228360672Z); all original 30 were independently unchanged.
|
|
The new app must also be preserved by deployment. Pin evidence:
|
|
`~/.local/state/archipelago/release-qualification/indeehub-production-pin-preparation-20261008/`.
|
|
|
|
Fresh live original units remain unchanged, all seven target image references
|
|
resolve locally, and the four unchanged dependency references resolve to their
|
|
current runtime image IDs. The exact fresh seven-member plan is retained under
|
|
`~/.local/state/archipelago/release-qualification/indeehub-yaya-final-plan-20261008/`:
|
|
`reviewed-unit-plan.draft.private.json`, SHA256
|
|
`f26b469a84833121db8df7e23e709d08eb6f40d9d12ddcb1b4263b685b398816`.
|
|
Worker app version is 1.0.1. API typed defaults were checked using the reviewed
|
|
strict canonicalization and all three public values bind to the live Yaya pin.
|
|
The plan has not been installed; final source/mirror, signature and plan review
|
|
remain required before activation.
|
|
|
|
Reviewed concrete tools are archived at
|
|
`~/.local/state/archipelago/release-qualification/indeehub-yaya-delivery-tools-reviewed-20261008/`.
|
|
They are source/syntax reviewed, not executed: preserving backend/helper/catalog
|
|
activation; one-shot native update with a durable no-resubmission marker;
|
|
independent runtime/identity/unit/image checks; and read-only database comparison.
|
|
Activation first refuses stopped/missing runtimes, existing plans/selectors,
|
|
pending journals/holds and inconsistent crash snapshots. It backs up the old
|
|
artifacts, stops management only, installs the matching helper before native
|
|
original-recipe preparation, then starts the matching backend with the reviewed
|
|
signed private selector. All existing app runtimes must remain unchanged until
|
|
the separate native update is explicitly submitted. Partial failures retain
|
|
private logs and do not automatically restore data or retry.
|
|
|
|
Execute database acceptance **before browser authentication**, since login can
|
|
legitimately change original database rows. It requires the exact committed
|
|
operation, original 107 migrations plus exactly three approved additions,
|
|
unchanged original table schemas/rows and all persistent volume identities.
|
|
Unexplained drift is a failed/inconclusive acceptance check, never authorization
|
|
to migrate, erase or restore data. Media/browser acceptance remains separate.
|