diff --git a/.serena/memories/CORE-01-INDEX.md b/.serena/memories/CORE-01-INDEX.md index 31cd0cd..7ce1051 100644 --- a/.serena/memories/CORE-01-INDEX.md +++ b/.serena/memories/CORE-01-INDEX.md @@ -1,7 +1,7 @@ @@ -32,7 +32,7 @@ Durable Serena memory index for the `rldyour-new-mac-or-ubuntu` bootstrap module ## Current State - This module has three tracked memories: `CORE-01-INDEX.md`, `RELEASE-01-VALIDATION.md`, and `TECHDEBT-01-NOW.md`. -- The `2.2.0` contract composes Apple Silicon macOS desktop, Ubuntu 24.04/26.04 desktop, and Ubuntu 24.04/26.04 server roles. Desktop roles are source/LSP-only; the Ubuntu server role owns build/runtime and explicit Docker modes. +- The `2.2.1` contract composes Apple Silicon macOS desktop, Ubuntu 24.04/26.04 desktop, and Ubuntu 24.04/26.04 server roles. Desktop roles are source/LSP-only; the Ubuntu server role owns build/runtime and explicit Docker modes. - GUI is an optional desktop overlay. Ubuntu server is always headless. - The module owns exact AI CLI installation, terminal integration, language-server/tooling installation, and the mandatory CloakBrowser runtime. Native AI CLI configuration remains in sibling adapter repositories. - Serena indexes Bash and Python because the implementation is shell-first with Python validators and fault-injection tests. diff --git a/.serena/memories/RELEASE-01-VALIDATION.md b/.serena/memories/RELEASE-01-VALIDATION.md index 2d1e37e..8b8a9c6 100644 --- a/.serena/memories/RELEASE-01-VALIDATION.md +++ b/.serena/memories/RELEASE-01-VALIDATION.md @@ -1,7 +1,7 @@ @@ -46,7 +46,9 @@ Release, validation, CI, and public README contract for the macOS/Ubuntu bootstr - launchd forward and rollback handoffs use bounded loaded/unloaded state convergence instead of treating an immediate `launchctl` exit status as proof. ## Current State -- Current product/config version is `2.2.0` (`VERSION`, `config/rldyour-contract.json` -> `adapter`). The last published GitHub release tag is still `2.0.0`; the gitlink consumed by the GDS control plane is ahead of it by two unreleased contract versions. +- Current product/config version is `2.2.1` (`VERSION`, `config/rldyour-contract.json` -> `adapter`), and `2.2.1` is the published GitHub release tag — the published release and the contract agree. +- Contracts `2.1.0` and `2.2.0` were never released; `2.2.1` publishes their combined contents. Do not expect tags for them. +- Release `2.2.1` published five immutable checksummed assets in one create call: the source archive, `release-manifest.json`, `release-notes.md`, `sbom.spdx.json`, and `SHA256SUMS`. - Supported targets are Apple Silicon macOS desktop and Ubuntu 24.04/26.04 desktop/server on amd64 or arm64. Desktop Docker mode is always `none`; server Docker is explicit `none`, `rootful`, or `rootless`. - The active harness set is codex and zcode only (`harnesses.active`). Neither is installed inline: each is owned by an NDDev module pinned by exact `harnesses..module_commit`, and is self-materialized from `module_repo` at that commit when its `module_path_env` is unset. Exact commits and vendor runtime versions are read from the contract and the module's `build/version.json`; they are not duplicated here. - The mandatory browser baseline is CloakBrowser `0.4.12`, Chrome DevTools MCP `1.6.0`, and Playwright CLI `0.1.17` on loopback CDP `127.0.0.1:9222`; Webwright has no installed runtime or dependency tree. diff --git a/.serena/memories/TECHDEBT-01-NOW.md b/.serena/memories/TECHDEBT-01-NOW.md index a74a746..46d5331 100644 --- a/.serena/memories/TECHDEBT-01-NOW.md +++ b/.serena/memories/TECHDEBT-01-NOW.md @@ -1,7 +1,7 @@ @@ -39,8 +39,8 @@ Operational watchpoints and boundaries for the bootstrap module. - Managed shell integration edits only delimited source blocks, backs up pre-existing files, and verifies a fresh login shell. Interactive aliases activate only when their target executable exists. - ZCode remains an explicit integrity handoff because upstream publishes no checksum/signature manifest. Ubuntu can install it only with an independently supplied SHA-256. - A real Apple Silicon macOS desktop strict apply and an immediate non-interactive idempotent reapply were verified on 2026-07-10, including managed launchd/CDP health and cmux hooks. Representative Ubuntu 24.04/26.04 desktop/server runs with systemd, SSH/UFW, and each selected Docker mode remain required; container-only CI cannot prove those host boundaries. -- No current bootstrap contract/version drift: `VERSION`, contract, scripts, frozen locks, docs, SECURITY, and tests agree on `2.2.0` and its exact runtime pins. -- Open: no release tag is cut for `2.1.0` or `2.2.0`, so the published release trails the contract by two versions. +- No current bootstrap contract/version drift: `VERSION`, contract, scripts, frozen locks, docs, SECURITY, and tests agree on `2.2.1` and its exact runtime pins, and `2.2.1` is the published release tag. +- Resolved: release `2.2.1` publishes the combined contents of the unreleased `2.1.0` and `2.2.0` contracts, so the published tag no longer trails. - Resolved in `2.2.0`: `content_id()` and `regular_owned()` now take an explicit flag, and `cloak_runtime_identity()` — the only caller reading Git-tracked sources — passes it. The suite passes under `umask 002` and `umask 022` alike. Installed runtime paths still fail closed on a group- or world-writable file, pinned by `test_private_mode_is_enforced_for_installed_files_and_not_for_sources`. - Historical Webwright runtimes may remain on previously configured devices for preservation, but no managed command, dependency, or config path can execute them.