Preserve mission input edits and publish verified release artifacts safely

Author: Shadowfetch

Makefile

@@ -74,11 +74,11 @@ PACKAGES_STAMP := $(BUILD_DIR)/.packages-$(VERSION)
 
 R2_BUCKET ?= shadowfetch-linux
 # Cloudflare R2 S3-compatible endpoint for this account.
-# (wrangler can't PUT > 300 MiB; aws-cli with R2's S3 API handles multipart.)
+# The release publisher uses the S3 API with multipart uploads.
 R2_ENDPOINT ?= https://<CLOUDFLARE_ACCOUNT_ID>.r2.cloudflarestorage.com
 R2_REGION   ?= auto
 
-# Used by sync-from-linux (Mac-side flow): host + path to the build box.
+# Used by sync-from-linux for read-only artifact inspection.
 LINUX_HOST ?= shadowfetch-linux
 LINUX_PATH ?= ~/projects/shadowfetch-4.0.0
 
@@ -321,31 +321,11 @@ pre-release-check: iso-gate
 	@ROOT=$(ROOT) CODENAME=$(CODENAME) REPO_DIR=$(REPO_DIR) REPO_MIN_VALID_FOR_SECONDS=$(REPO_MIN_VALID_FOR_SECONDS) \
 		$(ROOT)/tools/pre_release_check.sh
 
-# Upload ISO + APT repo to R2 via aws-cli (R2's S3-compatible API).
-# Requires: brew install awscli, and an R2 API token from the Cloudflare
-# dashboard (R2 → Manage R2 API Tokens → Create) exported as:
-#   AWS_ACCESS_KEY_ID=<R2 Access Key ID>
-#   AWS_SECRET_ACCESS_KEY=<R2 Secret Access Key>
-# aws-cli handles multipart automatically, so the 2.9 GB ISO uploads fine.
+# Publish only the accepted artifact from the authorized Linux source tree.
+# The publisher preserves historical ISO/package objects, verifies signatures,
+# and writes signed APT InRelease last. Credentials are process environment only.
 publish: pre-release-check
-	@command -v aws >/dev/null || { echo "aws not installed. Run: brew install awscli" >&2; exit 1; }
-	@test -n "$$AWS_ACCESS_KEY_ID" || { echo "AWS_ACCESS_KEY_ID not set (use your R2 API token Access Key ID)" >&2; exit 1; }
-	@test -n "$$AWS_SECRET_ACCESS_KEY" || { echo "AWS_SECRET_ACCESS_KEY not set (use your R2 API token Secret Access Key)" >&2; exit 1; }
-	@if [ ! -f $(ROOT)/$(ISO_NAME) ]; then echo "No ISO to publish ($(ROOT)/$(ISO_NAME))" >&2; exit 1; fi
-	@if [ ! -f $(ROOT)/$(ISO_NAME).asc ]; then echo "No signature ($(ROOT)/$(ISO_NAME).asc) — run 'make sign'" >&2; exit 1; fi
-	@echo ">>> Uploading small files first (sha256, signature, GPG key)"
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 cp $(ROOT)/$(ISO_NAME).sha256 s3://$(R2_BUCKET)/releases/$(ISO_NAME).sha256 --content-type "text/plain"
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 cp $(ROOT)/$(ISO_NAME).asc    s3://$(R2_BUCKET)/releases/$(ISO_NAME).asc    --content-type "application/pgp-signature"
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 cp $(REPO_DIR)/shadowfetch.gpg.asc s3://$(R2_BUCKET)/shadowfetch.gpg.asc --content-type "application/pgp-keys"
-	@echo ">>> Mirroring APT repo (dists/ + pool/) to R2 apt/"
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 sync $(REPO_DIR)/dists s3://$(R2_BUCKET)/apt/dists --delete
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 sync $(REPO_DIR)/pool  s3://$(R2_BUCKET)/apt/pool  --delete
-	@echo ">>> Uploading ISO ($(ISO_NAME), $$(du -h $(ROOT)/$(ISO_NAME) | cut -f1), multipart). Progress below."
-	@aws --endpoint-url=$(R2_ENDPOINT) --region=$(R2_REGION) s3 cp $(ROOT)/$(ISO_NAME) s3://$(R2_BUCKET)/releases/$(ISO_NAME) --content-type "application/x-iso9660-image"
-	@echo ">>> Done. Verify:"
-	@echo "    open $(PUBLIC_SITE)/"
-	@echo "    curl -I  $(ARTIFACT_BASE)/download/$(ISO_NAME)"
-	@echo "    curl -sI $(ARTIFACT_BASE)/apt/dists/$(CODENAME)/InRelease"
+	@python3 $(ROOT)/tools/publish_release_4_0_0.py --apply
 
 qemu:
 	qemu-system-x86_64 \
@@ -357,32 +337,20 @@ qemu:
 		-drive file=$(ROOT)/$(ISO_NAME),media=cdrom,readonly=on \
 		-boot d
 
-# ---- Mac-side deploy flow ----
-# Run these from your Mac (where wrangler is logged in) to ship a release
-# that was built on $(LINUX_HOST).
-
-# Pull the latest ISO + checksum + signature + reprepro repo back from the
-# Linux build box. Idempotent.
+# Pull a read-only local copy of already built release artifacts for inspection.
 sync-from-linux:
-	@echo ">>> Pulling ISO + repo from $(LINUX_HOST):$(LINUX_PATH)"
-	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/shadowfetch-*.iso $(ROOT)/ 2>/dev/null || echo "(no ISO yet on Linux box)"
-	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/shadowfetch-*.iso.sha256 $(ROOT)/ 2>/dev/null || true
-	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/shadowfetch-*.iso.asc $(ROOT)/ 2>/dev/null || true
-	@rsync -avzh --delete $(LINUX_HOST):$(LINUX_PATH)/repo/ $(REPO_DIR)/
-	@ls -lh $(ROOT)/shadowfetch-*.iso 2>/dev/null || echo "(no ISO present)"
+	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/$(ISO_NAME) $(ROOT)/
+	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/$(ISO_NAME).sha256 $(ROOT)/
+	@rsync -avzhP $(LINUX_HOST):$(LINUX_PATH)/$(ISO_NAME).asc $(ROOT)/
 
-# Deploy the shadowfetch-linux Worker. Requires `wrangler login` (one time) or CLOUDFLARE_API_TOKEN.
+# Artifact routing is stable across distro releases. Deploying a Worker is a
+# separate reviewed change, never an implicit side effect of publishing an ISO.
 deploy-worker:
-	@command -v wrangler >/dev/null || { echo "wrangler not installed. Run: brew install cloudflare-wrangler2" >&2; exit 1; }
-	@cd $(ROOT)/web/shadowfetch-linux-worker && wrangler deploy
+	@echo "Artifact routing is unchanged. Review any Worker change separately." >&2
+	@exit 1
 
-# Full Mac-side ship: pull artifacts, publish to R2, deploy Worker.
-ship: sync-from-linux publish deploy-worker
-	@echo ""
-	@echo ">>> SHIPPED. Verify:"
-	@echo "    open $(PUBLIC_SITE)/"
-	@echo "    curl -I $(ARTIFACT_BASE)/download/$(ISO_NAME)"
-	@echo "    curl -sI $(ARTIFACT_BASE)/apt/dists/$(CODENAME)/InRelease"
+ship: publish
+	@echo ">>> Accepted artifacts published. Complete public byte verification, GitHub release, and canonical Linux website deployment per RELEASE-4.0.0.md."
 
 clean:
 	-cd $(LB_DIR) && sudo lb clean

packages/shadowfetch-control-center/data/usr/share/shadowfetch/control-center/sfcc/grok_bot_page.py

@@ -65,7 +65,7 @@ def __init__(self, open_route):
             ("Native app, native sign-in", "Sign in inside Grok Bot. A model API key does not replace the app's account or subscription."),
             ("A deliberate cloud connection", "Grok Bot uses its vendor's cloud services. Review its permissions and data handling before connecting projects."),
             ("Verified installation", "Shadowfetch checks the pinned download, package identity and installed version. Setup requires administrator approval and enables the vendor's package update source."),
-            ("Your local missions stay visible", "Mission Control runs scoped code, private reports and media workflows. Grok Bot tasks and permissions are managed in the official native app."),
+            ("Your local missions stay visible", "Mission Control runs scoped code, source reports and media workflows. Grok Bot tasks and permissions are managed in the official native app."),
         )):
             card = Card()
             row = QVBoxLayout(card)

packages/shadowfetch-defaults/tests/test_fire_edition_2_1_5.py

@@ -1598,6 +1598,7 @@ def _buzz_failure_env(self, root: Path, listener_port=None, free=100000):
             "DISPLAY": ":1",
             "HOME": str(home),
             "XDG_RUNTIME_DIR": str(root / "run"),
+            "DBUS_SESSION_BUS_ADDRESS": f"unix:path={root}/run/bus",
             "PATH": f"{fake}:/usr/bin:/bin",
             "SHADOWFETCH_BUZZ_COMPOSE_SOURCE": str(compose),
         })

packages/shadowfetch-missions/README.md

@@ -60,7 +60,9 @@ State progression is `queued → running → waiting-review → completed`. Erro
 A restarted worker marks interrupted executions failed and asks for inspection.
 It never automatically replays an interrupted code edit or external network action.
 An explicit Retry retains the original checkpoint. Previously published reports
-and individual media exports are resumed only when their recorded hashes match.
+and individual media exports are resumed only when their recorded input and output
+hashes match. Changed report sources or edited output refuse retry before inference;
+start a new mission to preserve those edits as a fresh recovery baseline.
 
 Accept marks successful work reviewed. Undo restores the original workspace using
 its checkpoint, after proving no newer mission or manual file change intervened.

packages/shadowfetch-missions/data/usr/lib/shadowfetch/missions/sf_missions.py

@@ -387,6 +387,7 @@ def __init__(self, store, mission):
         self.artifacts = []
         self.tests = []
         self.inferences = []
+        self.preserve_recovery_index = False
 
     def check(self):
         if self.store.get(self.mid)["cancel_requested"]:
@@ -524,9 +525,26 @@ def publish(self, name, content):
 
     def report(self):
         previous = self.store.step(self.mid, "report-published")
-        if previous and all(Path(p).is_file() and digest(p) == h for p, h in previous.items()):
+        if previous:
+            # Do not overwrite a person's updated sources or output on retry.
+            # Keep the old recovery index so Undo also refuses those newer edits.
+            self.preserve_recovery_index = True
+            if not all(Path(p).is_file() and not Path(p).is_symlink() and digest(p) == h for p, h in previous.items()):
+                raise MissionError("Published report files changed after this attempt. Preserve those edits and create a new mission with a fresh recovery checkpoint")
             self.artifacts.extend(previous)
-            self.event("step-resumed", "Verified existing report hashes; skipped repeated inference")
+            register = next((Path(p) for p in previous if Path(p).name == "sources.json"), None)
+            if register is None:
+                raise MissionError("The prior report has no source register. Create a new mission to establish a verified baseline")
+            sources = self.input_text()
+            try:
+                original = {row["path"]: row["sha256"] for row in json.loads(register.read_text())}
+            except (ValueError, KeyError, TypeError):
+                raise MissionError("The prior report source register is invalid; create a new mission")
+            current = {row["path"]: row["sha256"] for row in sources}
+            if current != original:
+                raise MissionError("Source inputs changed after this report. Create a new mission to preserve the updated files as a fresh recovery baseline; no inference was replayed")
+            self.preserve_recovery_index = False
+            self.event("step-resumed", "Verified report and source hashes; skipped repeated inference")
             return
         sources = self.input_text()
         context = "\n\n".join(f"[{source['id']}] {source['path']}\n" + "\n".join(f"{number}: {line}" for number, line in enumerate(source["text"].splitlines(), 1)) for source in sources)
@@ -701,13 +719,15 @@ def receipt(self, state, error=None):
         before = json.loads(before_path.read_text()) if before_path.exists() else {}
         try:
             after = tree_index(self.ws)
-            atomic(self.directory / "changes.diff", difference(before, after))
-            atomic(self.directory / "after-index.json", json.dumps(recovery_index(self.ws)))
+            diff = difference(before, after) if before_path.exists() else "No recorded execution baseline; workspace changes cannot be attributed to this attempt.\n"
+            atomic(self.directory / "changes.diff", diff)
+            if not self.preserve_recovery_index:
+                atomic(self.directory / "after-index.json", json.dumps(recovery_index(self.ws)))
         except OSError as exc:
             after = {}
             error = (error or "") + "; diff unavailable: " + clean(exc)
         records = [{"path": p, "sha256": digest(p), "bytes": Path(p).stat().st_size} for p in self.artifacts if Path(p).is_file()]
-        receipt = {"schema": 1, "mission": self.mid, "title": self.mission["title"], "kind": self.mission["kind"], "state": state, "workspace": str(self.ws), "checkpoint": self.store.get(self.mid)["checkpoint"], "started_at": self.mission["updated_at"], "finished_at": now(), "runtime": self.mission["config"]["runtime"], "network": self.mission["config"]["network"], "error": error, "artifacts": records, "tests": self.tests, "inferences": self.inferences, "diff": str(self.directory / "changes.diff"), "review_required": state == "waiting-review", "limits": {"timeout_seconds": self.mission["config"]["timeout"], "sandbox_address_space_mb": 3072, "sandbox_processes": 96, "queue_concurrency": 1}, "recovery_scope": "Workspace files only; external network effects cannot be undone"}
+        receipt = {"schema": 1, "mission": self.mid, "title": self.mission["title"], "kind": self.mission["kind"], "state": state, "workspace": str(self.ws), "checkpoint": self.store.get(self.mid)["checkpoint"], "started_at": self.mission["updated_at"], "finished_at": now(), "runtime": self.mission["config"]["runtime"], "network": self.mission["config"]["network"], "error": error, "artifacts": records, "tests": self.tests, "inferences": self.inferences, "diff": str(self.directory / "changes.diff"), "review_required": state == "waiting-review", "recovery_index_preserved": self.preserve_recovery_index, "limits": {"timeout_seconds": self.mission["config"]["timeout"], "sandbox_address_space_mb": 3072, "sandbox_processes": 96, "queue_concurrency": 1}, "recovery_scope": "Workspace files only; external network effects cannot be undone"}
         path = self.directory / "receipt.json"
         atomic(path, json.dumps(receipt, indent=2) + "\n")
         self.store.update(self.mid, receipt=str(path), artifacts=json.dumps([r["path"] for r in records]))

packages/shadowfetch-missions/tests/test_missions.py

@@ -170,6 +170,33 @@ def test_resume_only_after_published_hash_verification(self):
             result = m.run_mission(self.store, mission["id"])
         self.assertEqual(result["state"], "waiting-review", result["error"])
         self.assertTrue(any(e["event"] == "step-resumed" for e in self.store.events(mission["id"])))
+    def test_changed_report_inputs_refuse_resume_and_preserve_manual_edits(self):
+        mission = self.create()
+        with patch.object(m.Executor, "infer", return_value="Friday. [S1:L1]"):
+            first = m.run_mission(self.store, mission["id"])
+        report_path = next(Path(path) for path in first["artifacts"] if path.endswith("report.md"))
+        report_before = report_path.read_text()
+        self.store.update(mission["id"], state="failed")
+        (self.ws / "facts.md").write_text("Updated launch is Saturday.\n")
+        self.store.retry(mission["id"])
+        with patch.object(m.Executor, "infer", side_effect=AssertionError("must not replay inference")):
+            result = m.run_mission(self.store, mission["id"])
+        self.assertEqual(result["state"], "failed")
+        self.assertIn("Source inputs changed", result["error"])
+        self.assertEqual(report_path.read_text(), report_before)
+        self.assertEqual((self.ws / "facts.md").read_text(), "Updated launch is Saturday.\n")
+        with self.assertRaisesRegex(m.MissionError, "changed after"):
+            m.review(self.store, mission["id"], "undo")
+        self.assertTrue(json.loads(Path(result["receipt"]).read_text())["recovery_index_preserved"])
+    def test_missing_execution_baseline_does_not_claim_added_files(self):
+        mission = self.create()
+        executor = m.Executor(self.store, mission)
+        executor.receipt("cancelled", "Cancelled before execution")
+        diff = (self.store.directory(mission["id"]) / "changes.diff").read_text()
+        self.assertIn("No recorded execution baseline", diff)
+        self.assertNotIn("+ facts.md", diff)
+        self.assertNotIn("after/facts.md", diff)
+
     def test_undo_refuses_newer_manual_file_changes(self):
         mission = self.create()
         with patch.object(m.Executor, "infer", return_value="Friday. [S1:L1]"):