fix: harden ordinary server setup

Author: misunders2d

.github/workflows/server-setup-e2e.yml

@@ -0,0 +1,109 @@
+name: Ordinary server setup E2E
+
+on:
+  push:
+    paths:
+      - ".github/workflows/server-setup-e2e.yml"
+      - "scripts/ci/ordinary-server-setup-e2e.sh"
+      - "npm/**"
+      - "src/agentnet/approval/cli_commands.py"
+      - "src/agentnet/cli.py"
+      - "src/agentnet/core/app.py"
+      - "src/agentnet/operations/server_setup.py"
+      - "src/agentnet/storage/postgres.py"
+      - "skills/agentnet-operator/**"
+      - "package.json"
+      - "package-lock.json"
+      - "pyproject.toml"
+      - "uv.lock"
+  pull_request:
+    paths:
+      - ".github/workflows/server-setup-e2e.yml"
+      - "scripts/ci/ordinary-server-setup-e2e.sh"
+      - "npm/**"
+      - "src/agentnet/approval/cli_commands.py"
+      - "src/agentnet/cli.py"
+      - "src/agentnet/core/app.py"
+      - "src/agentnet/operations/server_setup.py"
+      - "src/agentnet/storage/postgres.py"
+      - "skills/agentnet-operator/**"
+      - "package.json"
+      - "package-lock.json"
+      - "pyproject.toml"
+      - "uv.lock"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  ubuntu-24-postgresql-18:
+    name: Ubuntu 24.04 / PostgreSQL 18 clean install
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+
+      - name: Configure Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24.18.0"
+          package-manager-cache: false
+
+      - name: Configure uv and Python
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.11.28"
+          python-version: "3.13.13"
+          enable-cache: false
+
+      - name: Install PostgreSQL 18 and local route dependencies
+        shell: bash
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-common nginx jq openssl ca-certificates
+          sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
+          sudo apt-get update
+          sudo apt-get install -y postgresql-18
+          sudo systemctl start postgresql
+          sudo -u postgres psql -Atq --dbname=postgres -c "SHOW server_version" | grep -E '^18\.'
+
+      - name: Run clean installed-artifact setup lifecycle
+        shell: bash
+        run: scripts/ci/ordinary-server-setup-e2e.sh
+
+      - name: Verify E2E cleanup
+        if: ${{ always() }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          ! getent passwd agentnet >/dev/null
+          ! getent passwd agentnet-approval >/dev/null
+          ! getent group agentnet >/dev/null
+          ! getent group agentnet-approval >/dev/null
+          for path in \
+            /opt/agentnet-e2e \
+            /var/lib/agentnet \
+            /var/lib/agentnet-approval \
+            /var/lib/agentnet-setup \
+            /etc/agentnet-secrets \
+            /etc/systemd/system/agentnet-core.service \
+            /etc/systemd/system/agentnet-approval.service \
+            /etc/nginx/sites-enabled/agentnet-e2e \
+            /etc/nginx/sites-available/agentnet-e2e \
+            /usr/local/share/ca-certificates/agentnet-e2e.crt \
+            /etc/ssl/certs/agentnet-e2e.crt \
+            /etc/ssl/certs/agentnet-e2e.pem \
+            /etc/ssl/private/agentnet-e2e.key \
+            "$RUNNER_TEMP/agentnet-ordinary-server-e2e"; do
+            ! sudo test -e "$path"
+          done
+          ! grep -Fq '# agentnet-e2e' /etc/hosts
+          HBA_FILE="$(sudo -u postgres psql -Atq --dbname=postgres -c 'SHOW hba_file')"
+          ! sudo grep -Fq '# agentnet-e2e' "$HBA_FILE"
+          [[ "$(sudo -u postgres psql -Atq --dbname=postgres -c "SELECT count(*) FROM pg_roles WHERE rolname='agentnet'")" == "0" ]]
+          [[ "$(sudo -u postgres psql -Atq --dbname=postgres -c "SELECT count(*) FROM pg_database WHERE datname='agentnet'")" == "0" ]]

PUBLIC_RELEASE_STATUS.md

@@ -3,33 +3,33 @@
 Snapshot: 2026-07-24
 
 This additive status note reconciles public package availability with AgentNet's
-frozen `0.1.24` release evidence. It does not replace requirements, gate
+frozen `0.1.25` release evidence. It does not replace requirements, gate
 ledgers, or accountable-owner evidence.
 
 ## Current public package
 
 A read of the public npm registry on 2026-07-24 returned:
 
 - package: `@misunders2d/agentnet`
-- latest published version: `0.1.24`
-- published package `gitHead`: `9a948d59f81518b5ac6f46c6862004e3c3d62645`
+- latest published version: `0.1.25`
+- published package `gitHead`: `eed319a76e4fbd0495f4d1bc1862f4c5891444ff`
 
 Package availability does not authorize deployment and does not establish
 production readiness.
 
 ## Frozen release-input clarification
 
-The retained `0.1.24` wheel and sdist under
-`evidence/local/2026-07-23-v0.1.24/artifacts/` are immutable release evidence.
+The retained `0.1.25` wheel and sdist under
+`evidence/local/2026-07-24-v0.1.25/artifacts/` are immutable release evidence.
 Their packaged release inputs include older pre-publication wording such as
-"latest published package: 0.1.22" and "prepared 0.1.24". Those frozen bytes are
+"latest published package: 0.1.24" and "prepared 0.1.25". Those frozen bytes are
 not rewritten after publication. `scripts/verify_release.py` intentionally
 checks them against their release snapshot.
 
 Correcting that wording inside packaged release inputs requires a new version
 candidate, fresh artifacts, normal release verification, and separate
 publication by Sergey. This note records the post-publication registry fact
-without creating a second artifact under version `0.1.24`.
+without creating a second artifact under version `0.1.25`.
 
 ## Release and gate posture
 

README.md

@@ -198,9 +198,13 @@ identity or authority source. You can also load it explicitly with
 
 ### Product-owned ordinary Linux server setup
 
-After verifying system-wide root-owned AgentNet, Node.js, and `uv` executables, then
-resolving approved PostgreSQL, OIDC, scanner trust, secret-file, and distinct
-public HTTPS-route inputs, plan without writes:
+Follow the bundled canonical checklist in
+[`skills/agentnet-operator/references/ordinary-server-setup.md`](skills/agentnet-operator/references/ordinary-server-setup.md).
+First verify system-wide root-owned AgentNet, Node.js, and `uv` executables whose
+resolved paths are outside `/root`, `/home`, and `/run/user`. Prepare exact
+owner-only OIDC/scanner/environment inputs and the fixed local PostgreSQL peer
+contract (`agentnet` OS user → `agentnet` role/database through
+`/var/run/postgresql`). Then plan without privileged or managed-host writes (the npm launcher may materialize its caller-owned Python runtime):
 
 ```bash
 <resolved-root-owned-agentnet-path> server-agent setup --request /home/operator/.config/agentnet-setup/server-setup.json
@@ -215,15 +219,26 @@ sudo -- <resolved-root-owned-agentnet-path> server-agent setup \
   --apply --start
 ```
 
-This fixed wrapper creates only AgentNet's two locked identities, private roots,
-Approval/Core state, scanner trust, and two hardened systemd units. It starts
-loopback Core and Approval, verifies operator-owned public HTTPS routes, emits
-redacted resumable evidence, and rejects conflicting state without overwrite.
-It never mutates DNS, TLS certificates, proxy or firewall policy, PostgreSQL
-administration, identity, or authority. A remote Manager does not shell into
-the target. Human OIDC/WebAuthn and offline activation remain explicit steps in
-the bundled skill. Final setup status is `operational` with identity enrolled
-and authority still false.
+Plan and apply bind exact Node/uv/launcher/`systemctl`/`useradd` paths and
+content hashes plus the canonical full AgentNet package-tree content hash to
+approval digest v2. Apply
+repeats preflight under an exclusive lock, may create the fixed Core OS identity
+plus root-owned setup runtime/lock, and then blocks before AgentNet
+environments/config/database writes
+unless a read-only canary succeeds as that identity and parsed PostgreSQL
+HBA/ident views plus config-load freshness prove the exact loaded unshadowed
+`local agentnet agentnet peer` rule. PostgreSQL
+role/database/HBA edits and reload remain a separate operator-owned approval;
+rerun the same AgentNet digest afterward.
+
+The wrapper then owns only AgentNet's two locked identities, private roots,
+Approval/Core state, scanner trust, two hardened systemd units, bounded start,
+and exact loopback/public health. Retry reloads realized state and commits
+marker v2 only through same-request compare-and-swap; manual marker/unit surgery
+is unsupported. It never mutates DNS, TLS, proxy/firewall policy, PostgreSQL
+administration, identity, or authority. Human OIDC/WebAuthn and offline
+activation remain explicit. Final setup status is `operational` with identity
+enrolled and authority still false.
 
 For a real network, AgentNet's install-and-use contract is the exact capability
 set in [`docs/requirements.md`](docs/requirements.md)—no reduced messaging
@@ -291,7 +306,8 @@ always-on deployment—see the [implementation guide](docs/implementation-guide.
 ## Project status
 
 AgentNet is an early public implementation; latest published package is
-`0.1.24`. That release contains the product-owned ordinary Linux server setup:
+`0.1.25`. The current unpublished `0.1.26` candidate corrects ordinary Linux
+server setup convergence. The earlier `0.1.24` release introduced product-owned ordinary Linux server setup:
 fixed plan/apply/start convergence, Approval/Core separation, scanner trust,
 exact public HTTPS health identity, interruption recovery, redacted evidence,
 and bundled operator workflow. Setup grants neither identity nor authority.
@@ -302,7 +318,7 @@ runner where that path did not exist. No `0.1.23` package was staged or
 published. Published `0.1.24` changed only that fixture to mock AgentNet's
 validated host-tool resolver directly; runtime behavior was unchanged.
 
-Prepared `0.1.25` repairs two JSON-RPC interoperability defects exposed by the
+Published `0.1.25` repairs two JSON-RPC interoperability defects exposed by the
 pinned official A2A TCK: `/rpc` and `/rpc/` now use the same strict endpoint
 without POST redirects, and a blank SDK request tenant is restored only from an
 exact verified opaque route binding. Missing/spoofed bindings and tenant
@@ -313,10 +329,16 @@ release-manifest self-check reports `1386 passed, 15 expected host/PostgreSQL
 skips`. The focused official JSON-RPC lane reports `3 passed`, while the full
 MUST run remains non-green at `50 passed, 11 failed, 174 skipped`; G04 therefore
 remains `FAILED`. Exact prepublication, retained-artifact, recursive packed, and
-Pi-loader checks are recorded in the candidate evidence after they pass.
-Privileged clean-host apply, cross-SDK/public-peer evidence, live
-PostgreSQL/OIDC/WebAuthn/TLS ceremony, Sergey-only publication, and independent
-public-artifact deployment remain pending or separately gated. Repository
+Pi-loader checks are recorded in its immutable evidence.
+
+Unpublished `0.1.26` repairs runtime-bound setup approval, semantic broker
+preflight, exact PostgreSQL service-identity peer validation, safe same-digest
+resume, marker provenance/CAS, Windows CLI imports, and installer guidance.
+Local source/package evidence is recorded as working-candidate evidence only;
+clean Ubuntu 24.04/PostgreSQL 18 CI, cross-platform CI, retained-artifact refresh,
+Sergey-only publication, and independent public-artifact deployment remain
+pending. Cross-SDK/public-peer evidence and live OIDC/WebAuthn ceremony remain
+separately gated. Repository
 evidence is not a completed live cross-host journey or production certification.
 
 Production adoption still requires deployment-specific evidence such as a real

RELEASE_MANIFEST.json

@@ -4,7 +4,7 @@
   "snapshot_date": "2026-07-24",
   "release": {
     "name": "agentnet",
-    "version": "0.1.25",
+    "version": "0.1.26",
     "profile": "self_hosted_local_conformance_candidate",
     "status": "BLOCKED",
     "production_ready": false,
@@ -32,12 +32,12 @@
   },
   "dependency_lock": {
     "path": "uv.lock",
-    "sha256": "2db5b45786e7d90c466c12731ad15dc7187cb69ca10373f419c1a49845363605",
+    "sha256": "0435578badd41758f98601e69c8910b519c712110261f2997dccf58b6f374e11",
     "format_version": 1,
     "revision": 3,
     "pyproject": {
       "path": "pyproject.toml",
-      "sha256": "160953aa554cffe7b146bd7e5043aedadb7cab6daf3c5749ab5a214d77ef1395"
+      "sha256": "a9d2dde83596edafaeefa7bcfbfed7435d8ecc18380b4e5f5731d14949978470"
     },
     "direct_dependencies": {
       "build": {
@@ -193,11 +193,11 @@
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "2b381da77b3f31f7efb8c657b64e885a81ee0b466bfc298993fb2f11308accd9"
+      "sha256": "01f439a71f0af6b2734ae66f45480352fc2736db3dfc9dfc168e188485700f41"
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "f44432d291ab9b1a7ae097d87ae7d1eed33b66b1adb82dec06c86e5a58863e81"
+      "sha256": "4f9efed2516aa024cf6ddd2c7e7c717f37468004169af01aa1ee353e7582f071"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -217,11 +217,11 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "46eddac5af12dc11a9531137d8f2de672fcf421b69923b0cc5a19400a59f5d65"
+      "sha256": "730f88401bea7d62c8e16918151a36017de3853c2187b94f18a197f4398df41d"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
-      "sha256": "29e248de07d4766e8d84ed7240e362bf0f5441a12b75ca4ef13eaef842849c4c"
+      "sha256": "2578fc86f46b32779af0d485b14000ca0c9a29eae886697aef89401c7e25087b"
     },
     "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json": {
       "path": "evidence/gates/G01/2026-07-13-installed-harnesses/manifest.json",
@@ -245,13 +245,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "0a1c73440646d12d1956fe3fc95abb03e6796a1a61b878fadfc22a0682b89862"
+      "sha256": "7e7674575c7fc0bf20a9af9483b5ed2a289e415bc34019a3e0fb4de391a3e855"
     }
   },
   "release_source_tree": {
     "path": "src",
     "algorithm": "sha256(path NUL bytes NUL)",
-    "sha256": "58351234cd75447ff974416d1cbd3e59b9854c28be36e6bd1d94dfeaafa61742"
+    "sha256": "f871821eb22626249ee6e2b44aacd83383db487c778915cba977c8fd4f1b4417"
   },
   "protocols": {
     "a2a": {
@@ -410,7 +410,7 @@
     },
     "supervisor_harness_lifecycle": {
       "status": "BUILD_OWN_INTEGRATION",
-      "pin": "agentnet-0.1.25",
+      "pin": "agentnet-0.1.26",
       "boundary": "Exact human plus harness binding and foreground isolation remain owned."
     },
     "a2a_gateway": {