kayg/infraternal

Watch

Server self-update and lockstep agent updates from the signed builds host (D135, D184, D185) #102

New issue

Open

opened 2026-10-08 13:09:02 +00:00 by kayg · 1 comment

kayg commented

2026-10-08 13:09:02 +00:00

Owner

Server: check the builds host (configurable URL; channels stable/edge), verify minisign-style Ed25519 signatures with a built-in public key, update immediately, keep the previous binary for automatic rollback on a failed health check, and hand the CA key over in memory (D168). Agents: lockstep A/B slot swap with canary and rollback (D135), with every failure scenario tested (power or network loss mid-swap, corrupt or partial download, disk full or read-only slot, crash during the canary, concurrent root promotion, version jump, downgrade). Plus a release pipeline that builds, signs and publishes to the builds host (the private key never on a server). Numbers: update downtime, session continuity across a server update.

Server: check the builds host (configurable URL; channels stable/edge), verify minisign-style Ed25519 signatures with a built-in public key, update immediately, keep the previous binary for automatic rollback on a failed health check, and hand the CA key over in memory (D168). Agents: lockstep A/B slot swap with canary and rollback (D135), with every failure scenario tested (power or network loss mid-swap, corrupt or partial download, disk full or read-only slot, crash during the canary, concurrent root promotion, version jump, downgrade). Plus a release pipeline that builds, signs and publishes to the builds host (the private key never on a server). Numbers: update downtime, session continuity across a server update.

kayg commented

2026-10-08 13:14:46 +00:00

Author

Owner

Owner: builds host is builds.infraternal.com; signatures minisign-style Ed25519 (secure and fast). D184/D185.

Owner: builds host is builds.infraternal.com; signatures minisign-style Ed25519 (secure and fast). D184/D185.

kayg referenced this issue

2026-10-08 13:28:28 +00:00

Plan: make the canvas real, in parallel lanes, with add-host #109

kayg referenced this issue

2026-10-08 17:06:16 +00:00

Zero-downtime server restarts and updates (requests hang during a deploy) #111

kayg referenced this issue

2026-10-09 04:27:57 +00:00

SSH bootstrap: add a real host end to end (demo, D138-D141) #87

kayg referenced this issue

2026-10-10 17:36:50 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-10 22:08:30 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 00:25:03 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 02:41:57 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 04:37:12 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 13:46:54 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 16:59:19 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

kayg referenced this issue

2026-10-11 22:15:41 +00:00

Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157

~~kayg referenced this issue 2026-10-28 17:53:56 +00:00~~

Orchestrator handover 2026-10-28: moving to a new machine #254

kayg referenced this issue

2026-10-28 18:00:45 +00:00

Orchestrator handover 2026-10-28: moving to a new machine #254

Sign in to join this conversation.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

kayg/infraternal#102

No description provided.