fix(release): harden released upgrade probe

Author: misunders2d

PUBLIC_RELEASE_STATUS.md

@@ -1,10 +1,10 @@
 # Public Package Status
 
-Snapshot: 2026-08-01
+Snapshot: 2026-08-02
 
 This additive status note reconciles public package availability with AgentNet's
-published `0.1.35` setup-recovery release and corrective `0.1.36` strict
-identity-profile candidate. It does not replace requirements, gate ledgers, or
+published `0.1.35` setup-recovery release, immutable non-public `0.1.36` tag,
+and corrective `0.1.37` candidate. It does not replace requirements, gate ledgers, or
 accountable-owner evidence.
 
 ## Current public package
@@ -128,25 +128,38 @@ canonical `VerifiedActor` identity profiles forbid and never serialize
 private-key thumbprint. Five units remained inactive, authority stayed false,
 and no enrollment or C0 message occurred.
 
-Corrective candidate `0.1.36` rejects duplicate/non-finite JSON members,
+Immutable tagged candidate `0.1.36` rejects duplicate/non-finite JSON members,
 strictly parses the canonical actor, verifies its domain/harness/credential
 labels, retains exact profile shape and private P-256 key custody/readability
 checks, and removes only the impossible duplicate `actor.key_id` test. Active
 database credential-to-key binding remains proven by `server-agent activate`;
-setup does not manufacture a second self-asserted binding. This candidate adds
-only the exact released `0.1.33` five-unit marker migration to `0.1.36`, with
-provenance-checked retained-journal recovery; `0.1.34`, `0.1.35`, and direct
-legacy sources remain rejected. Because the current Hub committed a `0.1.35`
-marker, selected Hub recovery remains package-owned AgentNet-only reset,
-followed only under a separate exact destructive approval by clean AgentNet
-database/role init after public package verification; that approval requires
-sanitized exact target inventory, an explicit backup/rollback decision, and
-redacted audit evidence. Prior AgentNet state is intentionally disposable.
-Unrelated/shared/valuable database targets fail closed. No unrelated service,
-database, toolchain, proxy, TLS, enrollment, authority, or C0 mutation is
-authorized by this source change. Release requires external exact same-commit
-terminal-green cross-platform, clean-setup, and upgrade workflow evidence;
-post-push run IDs are not self-authored into candidate source.
+setup does not manufacture a second self-asserted binding. It admitted only the
+exact released `0.1.33` five-unit marker migration; `0.1.34`, `0.1.35`, and
+direct legacy sources remained rejected. Same-commit main-push cross-platform,
+clean-setup, and upgrade workflows passed. The immutable tag upgrade rerun then
+failed in the released `0.1.31` seed setup's post-start runtime sampling:
+`Type=simple` briefly exposed systemd's pre-exec shell as `MainPID` before Node
+replaced it. Cleanup passed, setup authority stayed false, and npm staging never
+ran. The tag remains immutable and non-public; no test waiver or tag rewrite is
+permitted.
+
+Corrective candidate `0.1.37` changes only that protected release gate and exact
+candidate migration edge. The upgrade E2E still performs one real released
+`0.1.31 --apply --start`; exact success evidence passes directly, while only
+exit 1 plus the exact `service_runtime` refusal and all three false safety flags
+may enter a bounded, non-mutating convergence probe. That probe imports the
+single root-owned released `0.1.31` private runtime and invokes its own exact
+Approval/Core systemd-runtime and loopback/public-health validators. It never
+restarts or reruns setup; malformed evidence, any other blocker, stable wrong
+runtime, health mismatch, module-provenance mismatch, or timeout fails closed.
+All command stderr is separately retained and included in synthetic-secret leak
+scanning. The candidate admits only exact `0.1.33` five-unit marker migration to
+`0.1.37`; `0.1.34`, `0.1.35`, `0.1.36`, and direct legacy sources are rejected.
+Local focused, source, recursive packed-package, direct-verifier, and
+byte-identical archive gates pass for this candidate. Exact same-commit CI, a
+new immutable tag, and trusted npm stage are still required. Hub recovery remains a separately approved action
+after exact public-package verification. No deployment, reset, database,
+enrollment, authority, C0, federation, production, or gate mutation is implied.
 
 ## Release and gate posture
 

README.md

@@ -162,7 +162,7 @@ controls.
 AgentNet package installation, local SQLite state, signed HTTP clients, and
 host-local binding adapters support Linux, macOS, and Windows. Node.js 22.19 or
 newer and [`uv`](https://docs.astral.sh/uv/) 0.11.28 or newer must be on `PATH`.
-Only non-EOL Node.js release lines are supported: current `0.1.36` coverage targets
+Only non-EOL Node.js release lines are supported: current `0.1.37` coverage targets
 Node.js 22 LTS, 24 LTS, and 26 Current; Node.js 23 and 25 are unsupported despite
 the broad npm engine floor. Minimum-floor CI uses Node.js 22.19.0 with its
 compatible npm 10.9.3; the deployed Hub compatibility target is reported
@@ -359,7 +359,7 @@ message path. Published `0.1.32` repairs the ceremony blockers. Published
 `0.1.33` adds the exact migration from the live `0.1.31` two-unit marker, but
 the Hub transition exposed a retained systemd failed latch after its
 forward-only boundary. Published `0.1.35` adds identity-preserving reconciliation
-for that exact state. Candidate `0.1.36` removes one unsatisfiable fresh-init
+for that exact state. Candidate `0.1.37` removes one unsatisfiable fresh-init
 identity-profile check. No release proves completed fresh-laptop enrollment, native
 cross-host message/ACK, production readiness, or ship eligibility. The earlier `0.1.24`
 release introduced product-owned ordinary Linux server setup: fixed
@@ -448,12 +448,12 @@ public `0.1.35` then reached marker and PostgreSQL migration on the Hub but
 failed because setup required `actor.key_id` even though strict canonical
 `VerifiedActor` profiles forbid and never serialize that field.
 
-Candidate `0.1.36` strictly validates the canonical actor and its current
+Candidate `0.1.37` strictly validates the canonical actor and its current
 binding labels, retains exact profile shape plus P-256 private-key custody and
 readability checks, and removes only that impossible duplicate field test.
 `server-agent activate` remains the database-backed credential-to-key binding
 proof. It adds only the exact released `0.1.33` five-unit marker migration to
-`0.1.36`, including provenance-checked retained-journal recovery; `0.1.34`,
+`0.1.37`, including provenance-checked retained-journal recovery; `0.1.34`,
 `0.1.35`, and direct legacy sources remain rejected. Because the current Hub
 committed a `0.1.35` marker, its intended recovery remains a package-owned
 AgentNet-only clean reset, followed only under a separate exact destructive
@@ -463,7 +463,7 @@ inventory, an explicit backup/rollback decision, and redacted audit evidence;
 unrelated/shared/valuable database targets fail closed. Release still requires
 external exact same-commit terminal-green cross-platform, clean-setup, and
 upgrade workflow evidence; post-push run IDs are not self-authored into source.
-Required runtime proof remains exact public `0.1.36`, clean five-unit readiness,
+Required runtime proof remains exact public `0.1.37`, clean five-unit readiness,
 fresh enrollment, one native
 signed message, recipient `recipient_committed`, exact
 `COMPLETED_C0_ROUND_TRIP`, then five-power revocation and post-revocation refusal.

RELEASE_MANIFEST.json

@@ -1,10 +1,10 @@
 {
   "$schema": "https://agentnet.invalid/schemas/release-manifest-v1.json",
   "manifest_version": "1.0",
-  "snapshot_date": "2026-08-01",
+  "snapshot_date": "2026-08-02",
   "release": {
     "name": "agentnet",
-    "version": "0.1.36",
+    "version": "0.1.37",
     "profile": "strict_identity_profile_fresh_init_candidate",
     "status": "BLOCKED",
     "production_ready": false,
@@ -32,12 +32,12 @@
   },
   "dependency_lock": {
     "path": "uv.lock",
-    "sha256": "aeecba8a1b1ab7163347f9727ab08a87ada0f6b5ab73b39181d7170bea1b9e02",
+    "sha256": "0d20da004cd1573020f366fef9b7a89f0955367cfb16e1720f546e3f62648f55",
     "format_version": 1,
     "revision": 3,
     "pyproject": {
       "path": "pyproject.toml",
-      "sha256": "66072a5744f37124767b6d6350f9a55e5827fc07e54d8c440a6e220ce0bfbcfa"
+      "sha256": "1c2c2b42543aa22d2b41a461173cd0945098ca1b6bf66194f65f6fbf34e9e1f6"
     },
     "direct_dependencies": {
       "build": {
@@ -193,11 +193,11 @@
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "6fe9fefa3982d2e9feafbd18dc684a71fac42ee5c99fbb3aa4cb314ed1857e9e"
+      "sha256": "2bc4d3064f5ceb35fb6f1b080308a8be4b5abffd71b66518c4044da59a223a22"
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "f5c51fa69fae8267e47f02579421a1a60602157352ebe0e4692e834f5bcba55a"
+      "sha256": "427f3f7ca853d7ee35af16388dc52f635f5f0a4f3756212c1ffdd1d08949ddee"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -217,11 +217,11 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "17224e8b8bf4b7b871b504ec3d720a38a9b3f590ebf0bab0eea632d6005f5ab6"
+      "sha256": "ae96a0b1c930e300f3fe52daa801442286f956e81d246380655f398d3dfc3615"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
-      "sha256": "61c99f67ec1902cd304c5ef399b87fa3864e30acbfc725e89160c292d3cd402f"
+      "sha256": "af067b1b36cfec1341174dbbccd54113adffb76ccef252128bd0efdc4947730f"
     },
     "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json": {
       "path": "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json",
@@ -245,13 +245,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "930b04d1660c101d031de152f047b1ddc3b4ffa6362831c01cee824f5f1ce5c4"
+      "sha256": "7568703efe8b4d9c250287fdb0bc37d03dc2244c2fd445f4d272ada5a677ded3"
     }
   },
   "release_source_tree": {
     "path": "src",
     "algorithm": "sha256(path NUL bytes NUL)",
-    "sha256": "a350849e5bc5e02fe486a5a5df6b1905b70030070093146fbd7c5011721f079a"
+    "sha256": "b9150543f59b41830fc4bfd622398626608dc0bf6557c758909a18a9aa936a77"
   },
   "protocols": {
     "a2a": {
@@ -410,7 +410,7 @@
     },
     "supervisor_harness_lifecycle": {
       "status": "BUILD_OWN_INTEGRATION",
-      "pin": "agentnet-0.1.36",
+      "pin": "agentnet-0.1.37",
       "boundary": "Exact human plus harness binding and foreground isolation remain owned."
     },
     "a2a_gateway": {

REQUIREMENTS_STATUS.md

@@ -1,6 +1,6 @@
 # Requirements Status
 
-Snapshot: 2026-08-01. This is an implementation/evidence ledger, not a release
+Snapshot: 2026-08-02. This is an implementation/evidence ledger, not a release
 certificate. It contains the exact 85 stable requirement IDs from the preserved
 requirements reference. PD-001 through PD-011 are listed separately because
 they are accountable policy decisions, not additional requirements.
@@ -144,14 +144,14 @@ published and historical release evidence:
   canonical strict `VerifiedActor` profiles forbid and never serialize
   `actor.key_id`, while setup required that field. Units remained inactive,
   authority false, and no enrollment or C0 message occurred.
-- Candidate `0.1.36` affects `AUTH-007`, `SEC-007`, `OPS-003`, `OPS-006`,
+- Candidate `0.1.37` affects `AUTH-007`, `SEC-007`, `OPS-003`, `OPS-006`,
   `OPS-007`, and the same blocked first-message path. It rejects duplicate/non-finite managed
   profile JSON, strictly parses the canonical actor, verifies current
   domain/harness/credential labels, retains exact profile and P-256 private-key
   custody/readability checks, and removes only the impossible duplicate field
   test. Database-backed credential-to-key binding remains owned by
   `server-agent activate`. It adds only the exact released `0.1.33` five-unit
-  marker migration to `0.1.36`, with provenance-checked retained-journal
+  marker migration to `0.1.37`, with provenance-checked retained-journal
   recovery; `0.1.34`, `0.1.35`, and direct legacy sources remain rejected.
   Because the current Hub committed a `0.1.35` marker, selected Hub recovery
   remains package-owned AgentNet-only reset, followed only under separate exact

docs/ARCHITECTURE.md

@@ -620,16 +620,16 @@ After database gate, wrapper owns only locked Approval/Core/C0 service identitie
 
 Exact reruns do not trust old marker as realized state. Apply reruns bootstrap, reloads and validates Core configuration, reloads and validates Approval trust, and writes exact unit bytes before marker commit. Request-v1 marker-v2 retains original request/package/config/unit provenance and same-request v1 migration semantics. Request-v2 marker-v3 additionally binds explicit artifact mode and rejects marker-v1/v2 as evidence. Both preserve monotonic revision, previous-marker digest, and exact prior-byte compare-and-swap under setup lock. A root-owned current-package attempt record is written before first product mutation and removed only after marker commit, allowing exact interruption recovery while rejecting unowned pre-existing state.
 
-The `0.1.36` corrective migration boundary admits only the exact released
+The `0.1.37` corrective migration boundary admits only the exact released
 `0.1.33` five-unit marker. Earlier sources use the separately released 0.1.33
-boundary first; 0.1.36 does not add another direct legacy edge and does not
+boundary first; 0.1.37 does not add another direct legacy edge and does not
 accept 0.1.34 or 0.1.35 as source markers. Exact prior managed configs/units are
 journaled before writes. For this edge, the target marker is the forward-only
 boundary: successful or exactly reconciled marker commit disarms source-byte
 rollback; all five units are quiesced before Core bootstrap may migrate
 PostgreSQL; and the journal is retained until bootstrap succeeds. A retained
 journal whose exact committed target is 0.1.33 may be superseded only after its
-marker/config/unit provenance is revalidated; it remains durable until 0.1.36
+marker/config/unit provenance is revalidated; it remains durable until 0.1.37
 atomically replaces it with the separate new journal before changing managed
 bytes.
 Quiescence clears systemd's failed latch only after bounded stop/disable and
@@ -644,7 +644,7 @@ OIDC/WebAuthn, guided key-possession enrollment, and offline activation remain
 explicit ceremonies. Remote Managers may provide immutable package guidance
 and inspect sanitized evidence only; target coding agents own host execution.
 
-Candidate `0.1.36` adds only the exact `0.1.33` five-unit corrective migration edge above.
+Candidate `0.1.37` adds only the exact `0.1.33` five-unit corrective migration edge above.
 Setup rejects duplicate/non-finite JSON members, strictly parses the managed
 identity actor with canonical `VerifiedActor`, checks current
 domain/harness/credential labels, and retains exact profile shape plus private