nordisk/monetize
Commits
e755049865b7Merge secmon/held-stopped into main (lane SEC-FIX-MON, SEC-S1/S2 + watcher hold): the guardian starts only what monetize believes should rund5e3e600bd43SEC-S1/S2 GREEN: start only what monetize believes should run; back off, tell once, hand over8c1dfe0a30d4SEC-S1/S2 RED: the guardian starts what monetize stopped on purpose, and a box that will not start loopse9d2d1b14785Merge box-start/start-not-rebuild into main (lane BOX-START): start, don't rebuild + the ONE-box watcher514237074ba4BOX-START: every new ALERT has a code and a row in docs/alerts.mdf94c4cdfea99GREEN (lane BOX-START part 3): monetize-box-watcher starts a stopped ONE box, dry-run by default6f5c4081fb01RED (lane BOX-START part 3): the ONE-box watcher outside UpCloud, proven against mock-upcloude765595d30afBOX-START proof at mock-upcloud: a stopped estate is started front and main first, then its twin, and nothing is rebuiltdf45549fd0d6GREEN (lane BOX-START): start, don't rebuild — a stopped box is started, never fenced and laid again7ed88ba941e7RED (lane BOX-START, 2026-11-01): a stopped box is started, never fenced and laid againecfdda282941Merge mfix/publish-031 into main (lane MONETIZE-FIX): monetize-product/-embed/-estate-side/-product-guest 0.3.1, monetize-proto 0.3.4 for crates.io; ask_bytes instead of a new Asked field. Gate oden ci4: workspace lib 2058/1 (jobs::jobs_started_at_the_same_instant_all_start_at_once, load-timed, 1/1 alone), admin 92/0, cli 28/0, every detached workspace check --all-targets clean02822fe82436Publish prep (lane MONETIZE-FIX): monetize-product, -embed, -estate-side, -product-guest 0.3.1 and monetize-proto 0.3.4 carry the product order kinds (ProductOrder, Fetch, the fetch ask, Facts.orders, the ProductOrder RPCs); the box pulls a file's bytes through Link/Asker::ask_bytes (default methods: no consumer's Asked literal breaks); `site do` says a box's refusal as REFUSED by the site's box (<kind>). Locks followed for the 5 versions only7f8951b9b821monetize-estate-side: pump::fetch re-exported beside grow_set (lane MONETIZE-FIX: Holger's box pulls a product order's file)f840fe253cd3Merge mfix/product-orders into main (lane MONETIZE-FIX step 1a): product-declared order kinds pulled by the box, files pulled with the fetch ask; door /site/do, CLI site do/kinds/do-answer, console panel. The console relay stays until Holger's kinds and PMO gate_ds move (rickard-e6: they land together). Gate oden ci4: lib 2059/0, admin 92/0, cli 28/0b2b1024385edProduct-declared order kinds, PULLED by the box (lane MONETIZE-FIX step 1a, owner 2026-11-01: replaces the console relay's push). Facts.orders (kind, role, words, params, file) checked by OrderKindFacts::check/admits; EstateOrder.ProductOrder/ProductOrderAnswer/ProductOrderKinds (operator bearer alone) sign and queue monetize_product::pull::ProductOrder for the declared role, the box's ack is the answer; a file is kept on the ONE box by sha256 and pulled by the box with the new core ask `fetch` (FleetAskAnswer.answer; monetize-estate-side pump::fetch, client decode 64 MiB). Door POST /site/do, GET /site/do/<site>/<seq>, GET /site/kinds/<site>; CLI `site do|do-answer|kinds`; console /api/sites/kinds|do and a SiteOrders panel per ready site. Core kinds: 8 orders + 2 asks. Tests: server product_orders 3, estate-side fetch 1, guest facts 2, door 1, cli 1, web 1. Gate oden ci4: workspace lib 2059/0 (no-fail-fast), admin 92/0, cli 28/0, all detached workspaces check --all-targets cleand04752b3d23dMerge mfix/operator-change-plan into main (lane MONETIZE-FIX step 2): the operator changes the plan of his own site (door /site/change-plan, CLI site change-plan, --test with the vendor's test card). Gate oden ci4: workspace lib 2051/0, admin 91/0, cli 27/0af9681c55c8cOperator ChangePlan for his own sites (lane MONETIZE-FIX, owner 2026-11-01): EstateOrder.ChangePlan takes the operator bearer alone for an operator-site run, as Status/Cancel/Terminate; test_order holds a dearer change with the site vendor's TEST card. Door POST /site/change-plan, CLI `site change-plan <site> [--main-plan] [--front-plan] [--data-gib] [--set k=v] [--test]`. RED operator_change_plan 2/3 failed, GREEN 3/3; gate oden ci4: workspace lib 2051/0, admin 91/0, cli 27/09087e54abe84Merge hol311korp/korp-0211 into main (lane HOL-311-KORP, plan row HOL-CDS-6): the monetize-admin lock follows korp-installer 0.2.11 (tunnr main 2fc7d74), the korp-installer entry only. Gate (oden ci4): cargo metadata --locked on all 7 monetize workspaces, workspace lib tests 2047/0, monetize-admin check --locked8f91f49cb700monetize-admin lock follows korp-installer 0.2.11 (tunnr main 2fc7d74): the entry only; korp-installer drops wg-appliance-core without wg-identity (lane HOL-311-KORP)8f9e4105a9e7Merge lockfollow/sshsig-0.1.2 into main: every monetize lock follows nornir-auth-sshsig 0.1.2 (edda main 82bbc28), so gate holger builds monetize-ui-web with edda main again. Gate (oden ci4): metadata --locked x4, workspace lib tests 2047 ok, monetize-ui-web build --lockedf0e4680ad4a6lockfollow: nornir-auth-sshsig 0.1.1 -> 0.1.2 (edda main 82bbc28) in every monetize lock that names it42bfe1fce151Merge hol-pubsite/holger-takes-public-site into main (plan row HOL-PUBSITE-FEED): site refeed holger-rs --only public_site feeds console_public_site to Holger main and twin (Holger facts say public_site, holger d8060233). Gate (oden ci4): monetize-server lib 951/0 (RED be43dc2e), signed-guest op table 3/0 with public_site compared, Holger guest tests green, clippy -D warnings1966e71f422dHOL-PUBSITE-FEED GREEN: Holger facts say public_site = Some(true); the op table holds the guests public_site to the test factsbe43dc2e0400HOL-PUBSITE-FEED RED: a Holger site declared public_site is fed its public-site switch again (site refeed holger-rs --only public_site)95a34a0c7500Merge t2next/korp-0.2.10-2026-10-31 into main (lane TEST2-NEXT): monetize-admin's lock follows korp-installer 0.2.10. Gate (oden ci4): metadata --locked, monetize-admin tests green50d68bdadf3dmonetize-admin: the lock follows korp-installer 0.2.10 (tunnr main: the seccomp filter, seccompiler 0.5 + syscalls 0.8.1, the reboot handoff) (lane TEST2-NEXT)91a2f21c6bf8Merge t2next/www-hop-2026-10-31 into main (lane TEST2-NEXT, WWW-CANON): the sale check follows the bare host's one 301/308 to www.<host> (a site never reached ready behind estate-front 0.3.3). RED + GREEN; shop-pairing 57/0, clippy clean659a7ddd9f3eGREEN WWW-CANON: the sale check follows the bare host's one hop to www.<host> (sale_check::www_hop)63001fef5230RED WWW-CANON: the sale check follows the bare host's one hop to www (test3.holger.rs stayed installing (paired): its sale check got the front's 301)c3b50360fd98Merge ossfsilver/russh-065 (lane OSSF-SILVER-CODE): locks follow nornir-git 0.2.4 on russh 0.65 (the 2026-10-30 russh advisories)757c171ff929Merge remote-tracking branch 'origin/main' into ossfsilver/russh-065c3590beb20eflock follow: edda main 01f6d63, nornir-git 0.2.4 on russh 0.65 (lane OSSF-SILVER-CODE; GHSA-fw5c-8223-6h42, GHSA-4p9f-7p9m-5vfg, GHSA-9wfm-jcj8-jfv9, GHSA-vp5q-ff62-jwqv)050730b95509Merge hol-repo-name into main (lane HOL-REPO-NAME): every lay serves, routes and certifies the names the product guest says — Holger repo.<site> (DNS, repo_hosts, web_hosts, certificate), Gunnar git.<site> on the certificate as a redirect-only name; a sold estate never takes the serving estate repo.<apex>. RED 6c5215a9, GREEN eed8b83aeed8b83acc0dGREEN: the shop pairing routes and certifies the names the product guest says (repo_names -> repo_hosts, redirect_names -> web_callback_only), every served name on the front certificate, and the serving estate keeps its product names (lane HOL-REPO-NAME)2b732123d5cbMerge mon-ossf/fuzz-2026-10-31 into main (lane MON-OSSF): monetize to the OSSF-NEXT levelf9361b21de8dMON-OSSF: the build thing's lock re-resolved from main's (gix 0.90) with wasmtime 49.0.5 and pageant 0.2.563d63a0c4a3fMON-OSSF: the build thing is on gix 0.90 since GIX-090; GHSA-q54r stays triaged for xtask and monetize-fast only6bc14b7e5e56Merge remote-tracking branch 'origin/main' into mon-ossf/fuzz-2026-10-3116eb0b02ab02Merge mon-ossf/cov-2026-10-31 into mon-ossf/fuzz-2026-10-31 (MON-OSSF coverage: the four crates under 70 %)b9028ef31cdaMerge ossfsilver/lockfollow-gix-090 into main (lane OSSF-SILVER-CODE, row GIX-090): locks follow edda main fa656be (gix 0.90, GHSA-q54r-jf2p-rfr2); gate on the branch: cargo check --locked --workspace --all-targets per lock, then cargo metadata --locked after merging main6c5215a94a16RED: every Holger lay routes and certifies repo.<site>, a Gunnar front certifies git.<site> as a redirect-only name, and a sold estate never takes a served name of the serving estate (lane HOL-REPO-NAME)4aa36fdbe22fMON-OSSF coverage: lake-product, the Lake's whole life judged by a test53657f9f773bMON-OSSF coverage: monetize-cloud-guest, every error kind and every op through the switcha3cbae2b2ff2MON-OSSF coverage: monetize-pay-guest, every error arm and every op over the wire3c1e32bbd2c1MON-OSSF coverage: fast-edge tested end to end (TLS refusals, a real TLS client through it)172aadb7c016Merge remote-tracking branch 'origin/main' into mon-ossf/fuzz-2026-10-31ad8adf1d52f2lock follow: edda main fa656be, nornir-git 0.2.3 on gix 0.90 (lane OSSF-SILVER-CODE, row GIX-090, GHSA-q54r-jf2p-rfr2)a169963f3af6MON-OSSF GREEN: SECURITY.md, renovate.json, mirror-safety pinned and read-only670f21d99b38MON-OSSF RED: what the Scorecard reads is kept true (SECURITY.md, renovate.json, pinned workflows)2b9f543d492aMON-OSSF GREEN: wasmtime 49.0.5 and pageant 0.2.5 in every lock; the rest triaged in deny.toml and osv-scanner.toml