Share release evidence across worktrees

Share release evidence across worktrees

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified ops/ci/release-smoke.sh
modified ops/deploy/build-image.sh
modified ops/production/preflight.sh
modified ops/relup-proof/common.sh
modified ops/relup-proof/install-proof.sh
modified ops/staging/publish-candidate.sh

Diff

6 files changed, +10 -7


trap cleanup EXIT INT TERM

if [ ! -d "$repo_root/.git" ]; then
if [ "$(git -C "$repo_root" rev-parse --is-inside-work-tree 2>/dev/null || true)" != "true" ]; then
  echo "release smoke must run from a Git worktree" >&2
  exit 1
fi


script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)
git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)

if [ -n "$(git -C "$repo_root" status --porcelain --untracked-files=all)" ]; then
  echo "image build requires a clean worktree" >&2

source_date_epoch=$(git -C "$repo_root" show -s --format=%ct "$git_sha")
platform=${OPENAGENTS_IMAGE_PLATFORM:-linux/amd64}
tag=${1:-"openagents:$git_sha"}
image_root="$repo_root/.git/openagents/images"
image_root="$git_common_dir/openagents/images"
result_path="$image_root/$git_sha.json"
iid_file=$(mktemp /tmp/openagents-image-iid.XXXXXX)


git_sha=$(git -C "$repo_root" rev-parse --verify HEAD)
git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)
candidate="$git_common_dir/openagents/staging-candidates/$git_sha/candidate-manifest.json"
isolation="$repo_root/.git/openagents/staging-isolation/$git_sha.json"
rehearsal="$repo_root/.git/openagents/production-rehearsal/$git_sha.json"
isolation="$git_common_dir/openagents/staging-isolation/$git_sha.json"
rehearsal="$git_common_dir/openagents/production-rehearsal/$git_sha.json"
run_root=$(mktemp -d /tmp/openagents-production-preflight.XXXXXX)

cleanup() {


script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)
git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)

proof_key() {
  git_sha=$(git -C "$repo_root" rev-parse --verify HEAD)


proof_root() {
  key=$(proof_key) || return $?
  printf '%s\n' "$repo_root/.git/openagents/relup-proof/$key"
  printf '%s\n' "$git_common_dir/openagents/relup-proof/$key"
}

require_proof_artifacts() {

set -eu

repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)
pkg="${RELUP_PROOF_PACKAGE_DIR:-$repo_root/.git/openagents/relup-package}"
git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)
pkg="${RELUP_PROOF_PACKAGE_DIR:-$git_common_dir/openagents/relup-package}"
node_name="${RELUP_PROOF_NODE:-openagents-relup-proof@127.0.0.1}"

if [ "${OPENAGENTS_RELUP_PROOF_DISPOSABLE:-}" != "1" ]; then

release_sha256=$(sha256sum "$candidate_temp/$archive_name" | cut -d ' ' -f 1)
sbom_sha256=$(sha256sum "$candidate_temp/sbom.cdx.json" | cut -d ' ' -f 1)
sbom_receipt_sha256=$(sha256sum "$candidate_temp/sbom.cdx.json.receipt" | cut -d ' ' -f 1)
gate_receipt="$repo_root/.git/openagents/release-gate-receipts/$git_sha.json"
gate_receipt="$git_common_dir/openagents/release-gate-receipts/$git_sha.json"
gate_receipt_sha256=$(sha256sum "$gate_receipt" | cut -d ' ' -f 1)
dockerfile_sha256=$(sha256sum "$repo_root/Dockerfile" | cut -d ' ' -f 1)
mix_lock_sha256=$(sha256sum "$repo_root/mix.lock" | cut -d ' ' -f 1)

29	29
30	30		`trap cleanup EXIT INT TERM`
31	31
32		-	`if [ ! -d "$repo_root/.git" ]; then`
	32	+	`if [ "$(git -C "$repo_root" rev-parse --is-inside-work-tree 2>/dev/null \|\| true)" != "true" ]; then`
33	33		`echo "release smoke must run from a Git worktree" >&2`
34	34		`exit 1`
35	35		`fi`

3	3
4	4		`script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)`
5	5		`repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)`
	6	+	`git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)`
6	7
7	8		`if [ -n "$(git -C "$repo_root" status --porcelain --untracked-files=all)" ]; then`
8	9		`echo "image build requires a clean worktree" >&2`

13	14		`source_date_epoch=$(git -C "$repo_root" show -s --format=%ct "$git_sha")`
14	15		`platform=${OPENAGENTS_IMAGE_PLATFORM:-linux/amd64}`
15	16		`tag=${1:-"openagents:$git_sha"}`
16		-	`image_root="$repo_root/.git/openagents/images"`
	17	+	`image_root="$git_common_dir/openagents/images"`
17	18		`result_path="$image_root/$git_sha.json"`
18	19		`iid_file=$(mktemp /tmp/openagents-image-iid.XXXXXX)`
19	20

9	9		`git_sha=$(git -C "$repo_root" rev-parse --verify HEAD)`
10	10		`git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)`
11	11		`candidate="$git_common_dir/openagents/staging-candidates/$git_sha/candidate-manifest.json"`
12		-	`isolation="$repo_root/.git/openagents/staging-isolation/$git_sha.json"`
13		-	`rehearsal="$repo_root/.git/openagents/production-rehearsal/$git_sha.json"`
	12	+	`isolation="$git_common_dir/openagents/staging-isolation/$git_sha.json"`
	13	+	`rehearsal="$git_common_dir/openagents/production-rehearsal/$git_sha.json"`
14	14		`run_root=$(mktemp -d /tmp/openagents-production-preflight.XXXXXX)`
15	15
16	16		`cleanup() {`

3	3
4	4		`script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)`
5	5		`repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)`
	6	+	`git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)`
6	7
7	8		`proof_key() {`
8	9		`git_sha=$(git -C "$repo_root" rev-parse --verify HEAD)`

30	31
31	32		`proof_root() {`
32	33		`key=$(proof_key) \|\| return $?`
33		-	`printf '%s\n' "$repo_root/.git/openagents/relup-proof/$key"`
	34	+	`printf '%s\n' "$git_common_dir/openagents/relup-proof/$key"`
34	35		`}`
35	36
36	37		`require_proof_artifacts() {`

26	26		`set -eu`
27	27
28	28		`repo_root=$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)`
29		-	`pkg="${RELUP_PROOF_PACKAGE_DIR:-$repo_root/.git/openagents/relup-package}"`
	29	+	`git_common_dir=$(git -C "$repo_root" rev-parse --path-format=absolute --git-common-dir)`
	30	+	`pkg="${RELUP_PROOF_PACKAGE_DIR:-$git_common_dir/openagents/relup-package}"`
30	31		`node_name="${RELUP_PROOF_NODE:-openagents-relup-proof@127.0.0.1}"`
31	32
32	33		`if [ "${OPENAGENTS_RELUP_PROOF_DISPOSABLE:-}" != "1" ]; then`

288	288		`release_sha256=$(sha256sum "$candidate_temp/$archive_name" \| cut -d ' ' -f 1)`
289	289		`sbom_sha256=$(sha256sum "$candidate_temp/sbom.cdx.json" \| cut -d ' ' -f 1)`
290	290		`sbom_receipt_sha256=$(sha256sum "$candidate_temp/sbom.cdx.json.receipt" \| cut -d ' ' -f 1)`
291		-	`gate_receipt="$repo_root/.git/openagents/release-gate-receipts/$git_sha.json"`
	291	+	`gate_receipt="$git_common_dir/openagents/release-gate-receipts/$git_sha.json"`
292	292		`gate_receipt_sha256=$(sha256sum "$gate_receipt" \| cut -d ' ' -f 1)`
293	293		`dockerfile_sha256=$(sha256sum "$repo_root/Dockerfile" \| cut -d ' ' -f 1)`
294	294		`mix_lock_sha256=$(sha256sum "$repo_root/mix.lock" \| cut -d ' ' -f 1)`