empeira 0.1.0.pre.alpha.1 → 0.1.0.pre.alpha.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de7c894839d24da7b03726dc8daae007f1c3e97ecbca32330ae451b1265409c0
-  data.tar.gz: '008e104e79374009b3811f365df8e301cc9a78157af5f5b6d841d32c2367b54d'
+  metadata.gz: 4e4e7094658b9e3d8f4ee0edbafa3e4e45be28921900cce8eb4af7d66096cee6
+  data.tar.gz: 7f062dc35a9cef14ad52f55362beba6c4a5a0ab1b57225ce27a191123dc01fc9
 SHA512:
-  metadata.gz: 8d6a4db00084f8e013f208e655313edbaf032b320507840220a416e8eb98644ad2d6d9a74d5db21dbc9298e2d7aa5243d78d805e0da1c0dfc043501e2dfb8630
-  data.tar.gz: d452d8412d487fc9800fcc549b8be52f34068093f71fdca0b70778dadf941ce0c674cd87974dbe2b00bd0aea869d04e855aef8d03eecb3a0e79d624394f311a7
+  metadata.gz: 8410139aeffa1ccaab90f3ddac57a809a86420e385f1354f801f8181c936ecf5653762cc4dbade0178d6df99b2dad1cc8b68cb8d537013132ec09e2ed65aefa1
+  data.tar.gz: 52ba2b37546bc90263d9834193b5080440e2a66425c9f9403b19800e791bf5f26b895d4c4e1af4bc218951b3a0e433437c07c550f493f4577e4e8dfd156a06bb

data/README.md

@@ -5,8 +5,8 @@
 [![Build & Tests](https://img.shields.io/github/actions/workflow/status/c8m6/empeira/ci.yml?branch=main&label=Build%20%26%20Tests)](https://github.com/c8m6/empeira/actions/workflows/ci.yml)
 [![OpenVox E2E](https://img.shields.io/github/actions/workflow/status/c8m6/empeira/openvox.yml?branch=main&label=OpenVox%20E2E)](https://github.com/c8m6/empeira/actions/workflows/openvox.yml)
 [![Release](https://img.shields.io/github/v/release/c8m6/empeira?include_prereleases&sort=date&label=Release)](https://github.com/c8m6/empeira/releases)
-[![Ruby: 3.4 / 4.0](https://img.shields.io/badge/Ruby-3.4%20%7C%204.0-CC342D)](docs/installation.md)
-[![License: AGPL-3.0-only](https://img.shields.io/badge/License-AGPL--3.0--only-blue)](LICENSE)
+[![Ruby: 3.1–4.0](https://img.shields.io/badge/Ruby-3.1%20%7C%203.2%20%7C%203.3%20%7C%203.4%20%7C%204.0-CC342D)](docs/installation.md)
+[![License: AGPL-3.0-or-later](https://img.shields.io/badge/License-AGPL--3.0--or--later-blue)](LICENSE)
 
 **ἐμπειρία (empeiría)** — experience gained through practice. The name reflects
 learning about infrastructure by experimenting, testing and seeing what happens.
@@ -46,35 +46,37 @@ signed repositories or verified package artifacts are selected separately.
 - An internal Chromium desktop and small additional infrastructure services.
 - Explicit Puppetfile module and image updates.
 
-Hosts: Linux, macOS and Windows through WSL2/Linux. Ruby 3.4 is the minimum;
-Ruby 3.4 and 4.0 are supported; CI runs deterministic tests with both versions.
+Hosts: Linux, macOS and Windows through WSL2/Linux. Ruby 3.1 is the minimum; Ruby 3.1, 3.2, 3.3, 3.4 and 4.0 are supported;
+CI runs deterministic tests and official addon/Core acceptance on all five versions
+on Linux and macOS, plus the existing Linux Docker/OpenVox smoke on every Ruby.
 Podman with Netavark is the default; Docker requires a Linux engine 28+ with
 isolated bridge support. VMs require usable KVM or HVF. Platform setup and
 validation limits are in [installation](docs/installation.md).
 
 ## Installation
 
-Until a release is available, install from source with Ruby, Bundler and Git:
+The [Empeira gem on RubyGems.org](https://rubygems.org/gems/empeira) is the
+recommended installation. With Ruby 3.1, 3.2, 3.3, 3.4 or 4.0 already installed:
 
 ```bash
-git clone https://github.com/c8m6/empeira.git
-cd empeira
-bundle install
-export EMPEIRA_SOURCE="$PWD"
-empeira() { BUNDLE_GEMFILE="$EMPEIRA_SOURCE/Gemfile" bundle exec ruby "$EMPEIRA_SOURCE/bin/empeira" "$@"; }
+gem install --user-install empeira --pre
+export PATH="$(ruby -r rubygems -e 'puts Gem.user_dir')/bin:$PATH"
 empeira --version
 ```
 
-The function lets you invoke the source CLI from your control repository. See
-[installation](docs/installation.md) for runtime prerequisites, release-gem
-installation and Bash completion.
+`--pre` enables prerelease installation, including the first alpha
+[`v0.1.0-alpha.1`](https://github.com/c8m6/empeira/releases/tag/v0.1.0-alpha.1).
+No source checkout or Bundler is needed for a gem installation. Install Git,
+a supported container runtime and any optional VM tools separately; see
+[installation](docs/installation.md) for host prerequisites, exact-version
+installation and Bash completion. Developers can also
+[run from source](docs/installation.md#source-installation-and-project-opt-in).
 
 ## Quickstart
 
 Use a dedicated Git control repository and an empty configuration marker:
 
 ```bash
-cd ..
 mkdir control-repo
 cd control-repo
 git init
@@ -126,8 +128,10 @@ See [diagnostic access and recovery](docs/nodes.md#root-diagnostic-commands-and-
 
 ## Alpha status
 
-empeira is being prepared for its first public alpha. Interfaces and inventory
-schemas may change; unsupported inventory fails closed without automatic migration.
+The first public alpha, [`v0.1.0-alpha.1`](https://github.com/c8m6/empeira/releases/tag/v0.1.0-alpha.1),
+is available on [RubyGems.org](https://rubygems.org/gems/empeira). Interfaces
+and inventory schemas may change; unsupported inventory fails closed without
+automatic migration.
 Use synthetic control code and disposable credentials. The shared network is a
 cooperative lab, and its internal PuppetDB API is unauthenticated.
 
@@ -135,7 +139,7 @@ Container process mode does not provide a full booted OS. Systemd requires Podma
 and cgroup v2. VM and shared-network support require actual host capabilities;
 macOS/HVF and arm64 runtime validation are manual gates. Native Windows, automatic
 self-update, aggregate `update all` and standalone platform binaries are unavailable.
-The initial release distribution is a Ruby gem.
+Distribution is through RubyGems.org and the matching GitHub Release gem asset.
 
 ## Community and license
 
@@ -145,6 +149,6 @@ and [pull requests](https://github.com/c8m6/empeira/pulls) are welcome. Follow t
 [security policy](SECURITY.md).
 
 Project-owned code and documentation are licensed under
-[AGPL-3.0-only](LICENSE). Third-party packages and images retain their own licenses
+[AGPL-3.0-or-later](LICENSE). Third-party packages and images retain their own licenses
 and notices and are obtained from upstream; empeira does not bundle them or
 redistribute proprietary Puppet Enterprise software.

data/docs/addons.md

@@ -329,3 +329,15 @@ is incomplete, stop users of that source and remove only its affected source
 namespace before synchronizing again; never delete a live lock as recovery.
 For missing command completion, inspect `addons info NAME` and source the current
 Bash completion again after an Empeira upgrade.
+
+## Ruby support and addon development
+
+Core and the official Convert, Pre-Commit and Sync addons support Ruby 3.1, 3.2,
+3.3, 3.4 and 4.0 on Linux, macOS and WSL2. Ruby 3.1 is the minimum. Keep API 1
+entrypoints runnable directly, preserve argv, terminal streams, environment and
+exit status, and explicitly require libraries that newer Rubies no longer ship.
+Do not install gems implicitly. Convert's XML support needs user-installed REXML.
+Test complete standalone behavior and actual execution through Core on all five
+Rubies; syntax checks alone are insufficient. See the [development gate](development.md#ruby-compatibility)
+for the required Linux/macOS matrix, pinned source checkouts and local commands.
+Real container/VM and WSL2 capabilities require their own integration gates.

data/docs/architecture.md

@@ -184,9 +184,12 @@ there are no implicit database-major migrations or automatic node replacements.
 
 Managed servers disable environment caching through native Puppet configuration
 (`environment_timeout = 0` in `[server]`), applied by the startup wrapper before
-the configured image entrypoint. `up` checks the actual native setting and restarts
-only a server whose setting changed; it preserves every other configuration key
-and retained storage. The configured Puppet confdir must agree with Puppetserver
+the configured image entrypoint. An independent `environment.conf` copy in the
+managed environment enforces zero even when the control repository specifies
+`unlimited`; the original remains unchanged and read-only. `up` refreshes the copy,
+checks both native and selected-environment settings, and restarts only a server
+whose native setting changed. It preserves every other configuration key and
+retained storage. The configured Puppet confdir must agree with Puppetserver
 HOCON `master-conf-dir`. Catalog
 requests reload live code without repository hashes or environment-cache checkpoints.
 See [nodes](nodes.md#environment-cache-and-live-code).

data/docs/configuration.md

@@ -404,20 +404,25 @@ runtime values without inferring them from the image name. Missing or unsafe
 runtime fields fail configuration validation. Managed servers use
 `environment_timeout = 0` in the native `[server]` section. The startup wrapper
 uses `puppet config set` before the configured entrypoint, independently of image
-environment-variable mappings. Startup and `up` read Puppet's native server
-settings without selecting an environment override, against the
-confdir containing `server.runtime.paths.puppetdb_config`; custom Puppetserver
+environment-variable mappings. Empeira also prepares an independent copy of the
+project's `environment.conf` in its managed environment directory, replacing or
+adding only `environment_timeout = 0`. Other settings, including `modulepath` and
+`config_version`, are preserved. The original file and the control repository
+remain read-only in the server. The copy is refreshed during `up`, including when
+the project has no `environment.conf` or Hiera mounts.
+
+`up` verifies both the native server setting and the effective timeout for
+`server.environment`, against the confdir containing
+`server.runtime.paths.puppetdb_config`; custom Puppetserver
 `jruby-puppet.master-conf-dir` must refer to that same directory. Puppetserver
-HOCON master directories take precedence over Puppet CLI defaults. A changed
-effective timeout updates only that key and restarts the same owned server; an
+HOCON master directories take precedence over Puppet CLI defaults. Native setting
+drift updates only that key and restarts the same owned server; an
 entrypoint that overwrites it fails verification. CA, SSL and database storage
 are preserved. The next catalog request reloads live code without
-an Empeira content scan or admin API invalidation. An explicit `environment.conf`
-can override this server setting; keep its timeout at zero for immediate edits.
-Such overrides are preserved and do not prevent server startup or cause repeated
-restarts. `puppet config print environment_timeout --section server` includes the
-selected environment's override, so it can report `unlimited` while the native
-server setting is zero. Inspect both configuration layers when diagnosing caching.
+an Empeira content scan or admin API invalidation. A project timeout of `unlimited`
+therefore stays unchanged in the checkout while the managed server uses zero.
+To verify it, run `puppet config print environment_timeout --section server
+--environment ENVIRONMENT` inside the server with the configured environment name.
 
 `puppetdb.runtime` holds the independent OpenVoxDB process contract. Custom
 images may override its executable, numeric user, Java and main arguments,

data/docs/development.md

@@ -2,10 +2,10 @@
 
 ## Environment and quality checks
 
-Install Git, Ruby 3.4, Bundler and the platform prerequisites in
-[installation](installation.md). The gem requires Ruby 3.4+; Ruby 3.2 and 3.3 are
-unsupported. Normal Ubuntu CI runs deterministic RSpec on Ruby 3.4 and 4.0, with
-RuboCop and both dependency audits only on Ruby 3.4. Release builds use Ruby 3.4.
+Install Git, Ruby 3.1+, Bundler and the platform prerequisites in
+[installation](installation.md). The gem requires Ruby 3.1+; normal Ubuntu and macOS CI
+runs deterministic RSpec on Ruby 3.1, 3.2, 3.3, 3.4 and 4.0, with
+RuboCop and both dependency audits only on Ubuntu with Ruby 3.4. Release builds use Ruby 3.4.
 Use synthetic control repositories and disposable credentials.
 
 ```console
@@ -20,7 +20,7 @@ bundle exec bundler-audit check --gemfile-lock resources/modules/Gemfile.lock
 local child processes and loopback fixtures. Explicit integration gates are pending
 unless enabled; a pending test is not a successful runtime check. Security auditing
 covers known Ruby advisories in both resolutions, not all container OS packages.
-To reproduce either CI test job, activate the corresponding Ruby, install the locked
+To reproduce a CI test job, activate the corresponding Ruby, install the locked
 bundle and run `bundle exec rspec --exclude-pattern 'spec/integration/**/*_spec.rb'`.
 Runtime and VM compatibility remain separate manual gates.
 
@@ -93,18 +93,73 @@ For workflow changes, parse `.github/workflows/*.yml` and run `actionlint` when
 available. Review action pins, triggers and permissions as well as YAML syntax.
 See [contributing](../CONTRIBUTING.md) for review, commit and label conventions.
 
-### Ruby 4.0 compatibility
+### Ruby compatibility
 
-Ruby 3.4 and 4.0 are supported. The deterministic suite passed locally on Linux
-x86_64 with Ruby 3.4.7 and 4.0.7. Ruby 4.0 validation used an official Ruby container;
-it does not establish macOS, container-engine or accelerated VM integration results.
+Ruby 3.1 is the minimum. Ruby 3.1, 3.2, 3.3, 3.4 and 4.0 run the complete
+deterministic suite on Ubuntu 24.04 and native macOS 15 in regular CI. Every
+combination is required, including Ruby 4.0. The suite covers the CLI, Bash
+completion, providers, networking, bootstrap, updates, addon contracts and gem
+build/install/start. The existing Docker/OpenVox node smoke also runs on all five
+Rubies on Ubuntu, with at most two concurrent jobs. Broader manual runtime
+integrations and release builds remain on Ruby 3.4;
+a unit test does not establish Docker, rootless Podman, KVM/HVF or WSL2 results.
 
-Source development uses Bundler 4.0.22 from `Gemfile.lock`, matching the existing
-module-helper tooling. With Ruby 4.0.7, the previous Bundler 2.4.19 redefined
-`Gem::Platform` constants and emitted warnings in child processes. This failed 14
-strict stderr, streaming, Bash completion and Puppetfile installer tests. Updating
-Bundler preserves those output assertions; no application output filtering or
-warning suppression is used. The dependency gem versions are unchanged.
+Both committed lockfiles use Bundler 2.6.9, compatible with Ruby 3.1. Ruby 4.0
+requires the explicit Bundler 4.0.22 selection to avoid RubyGems platform-constant
+warnings. Frozen installation keeps the same dependencies and lockfiles on every
+Ruby. To reproduce Ruby 4 CI without editing either lockfile:
+
+```sh
+gem install bundler -v 4.0.22 --no-document
+export BUNDLER_VERSION=4.0.22 BUNDLE_FROZEN=true
+bundle install
+bundle exec rspec --exclude-pattern 'spec/integration/**/*_spec.rb'
+```
+
+For Ruby 3.x, use `BUNDLER_VERSION=2.6.9` instead. The module-helper image uses
+Bundler 2.6.9 on its separately pinned Ruby base. r10k's transitive dependencies
+`fast_gettext` and `multi_json` remain on 3.1.x and 1.18.0 respectively because
+newer versions require Ruby 3.2. Other locked gem versions are retained. Ruby 3.1's
+internal Data compatibility implementation preserves positional and keyword
+constructors (including `[]` and custom initializers), frozen copies and empty
+record value semantics. Newer Rubies retain their native Data implementation. Both
+locks contain registry SHA-256 checksums generated by Bundler, not hand-entered:
+
+```sh
+bundle _2.6.9_ lock --add-checksums
+BUNDLE_GEMFILE=resources/modules/Gemfile bundle _2.6.9_ lock --add-checksums
+git diff -- Gemfile.lock resources/modules/Gemfile.lock
+```
+
+The real official addon acceptance gate is also required in every Linux/macOS
+matrix job. CI checks out reviewed addon commits, then installs them through
+Core's actual local Git acquisition, cache, manifest, configuration and execution
+paths. Synthetic control/Hiera repositories, a real PTY and a local rsync stub
+cover revision updates, failed-update retention, argv, inherited environment,
+configuration exports, native errors and signal-derived status. No real data or
+external synchronization endpoints are used. With the three addon checkouts
+under a common directory, run:
+
+```sh
+EMPEIRA_OFFICIAL_ADDON_ROOT=/path/to/checkouts \
+  bundle exec rspec spec/acceptance/official_addons.rb
+```
+
+Each checkout must be named `empeira-addon-convert`, `empeira-addon-pre-commit`
+or `empeira-addon-sync`. Set `EMPEIRA_OFFICIAL_ADDONS=sync` (or a comma-separated
+subset) to select checkouts; absent sources fail the gate. Addon CI uses the
+same gate against a pinned Core revision. Update the reviewed commit pins in
+CI when changing either side of API 1. Standalone addon unit tests remain in
+each addon's matrix. macOS installs GNU coreutils and GNU tar for fixtures that
+execute Linux guest package-manager commands against synthetic roots; these are
+test dependencies, not macOS product prerequisites. Fixtures canonicalize temporary
+paths, keep Unix socket names short and declare synthetic CPU architectures.
+The single Python Linux-guest adapter probe requires Linux `epoll` and `waitid`;
+it is explicitly unavailable on Darwin and remains required on every Ubuntu
+Ruby job. All other deterministic examples and official addon acceptance run
+natively on macOS. Pre-commit's real container integration remains required on
+Linux; hosted macOS has no configured Docker/Podman engine. No native Windows
+jobs are used, and WSL2 runtime validation remains a separate real-host gate.
 
 The test checkout must be writable: the QEMU monitor-directory cleanup fixture
 uses the checkout as a synthetic home. A read-only container bind mount caused one
@@ -198,6 +253,7 @@ The APT authentication regression uses a local HTTPS repository with synthetic B
 credentials and an ephemeral GPG signing key. It checks the helper's effective
 `auth.conf.d` configuration, private file mode and exact credential bytes, then
 verifies metadata returns 401 before one interactive login and 200 after the retry.
+The fixture omits the 401 reason phrase to exercise APT's bare status/IP diagnostic.
 The selected package download must reuse that login and pass its SHA-256 check.
 It requires host `gpg`/`gpgconf` and a locally reachable container engine; helper and
 host TLS verification remain enabled. Run it explicitly for either engine:
@@ -390,8 +446,35 @@ Title and release-note edits do not repair incorrect immutable assets.
 
 Release notes use merged PR labels from `.github/release.yml`, independently of
 Conventional Commit types. See [label conventions](../CONTRIBUTING.md#release-note-labels).
-The first distribution is a GitHub-attached Ruby gem; RubyGems.org publication,
-standalone Linux/macOS binaries and automatic self-update are not implemented.
+The first alpha is distributed as a verified GitHub Release gem and published
+unchanged to [RubyGems.org](https://rubygems.org/gems/empeira) via OIDC Trusted
+Publishing. Standalone Linux/macOS binaries and automatic self-update are not
+implemented.
+
+### RubyGems.org distribution (manual)
+
+After a verified GitHub Release exists, use
+`.github/workflows/publish-rubygems.yml` via **Actions → Publish existing release to RubyGems.org → Run workflow**.
+Run it from `main`, entering the existing release tag (for example `v0.1.0-alpha.1`).
+The default `dry_run: true` checks the existing GitHub release, tag ancestry,
+uploaded gem SHA-256 and embedded build metadata; it never creates a tag,
+rebuilds a gem or contacts RubyGems with publishing credentials.
+
+For a new gem that has not yet been published, the owner must first configure a
+[Pending Trusted Publisher](https://rubygems.org/profile/oidc/pending_trusted_publishers)
+on RubyGems.org. Empeira's publisher is already configured for gem `empeira`,
+repository owner `c8m6`, repository `empeira`, workflow filename
+`publish-rubygems.yml` and no GitHub Environment. After a successful dry-run,
+run the same workflow with `dry_run: false`. Only its upload step receives
+short-lived RubyGems credentials via GitHub OIDC; no persistent API key is required.
+
+Publishing uploads the exact previously verified GitHub Release asset, not a
+second build, and does not modify GitHub Releases or source. It fails closed
+if the asset differs, the tag is not on `main`, or RubyGems rejects the upload.
+RubyGems does not allow uploading the same gem name/version twice; inspect
+the existing published version before rerunning a failed push. After success,
+install the alpha with `gem install empeira --pre`. GitHub Releases remain
+the authoritative archive of release artifacts.
 
 ## Dependency and image provenance
 
@@ -429,9 +512,10 @@ Run `EMPEIRA_INTEGRATION=server-environment bundle exec rspec spec/integration/s
 to check native timeout 0, live edits, CA retention, PuppetDB and idempotent up
 under Docker/rootless Podman with the default server and a custom entrypoint
 that ignores timeout environment mapping.
-The same gate verifies startup and idempotent `up` with an explicit
-`environment.conf` timeout override, preserving the file and distinguishing its
-effective value from the native server setting.
+The same gate verifies that an explicit `environment.conf` timeout of `unlimited`
+is zero in the managed copy while the original stays unchanged. It edits a Ruby
+Puppet function between catalogs and checks the changed result without `up` or a
+restart, followed by an idempotent `up`.
 
 Run the isolated diagnostics/recovery gate with each native runtime:
 
@@ -470,3 +554,8 @@ The DNS gate checks UDP/TCP, internal/external names, NXDOMAIN, large-answer fal
 unavailable/recreated CoreDNS, a second workspace with a different subnet and
 CoreDNS address, rule removal and idempotent reconciliation. Node identity also
 checks both virtual DNS transports before and after node stop/start.
+
+The VirtIO upload regression deliberately delays staged-file unlinking. Successful
+completion must follow both atomic installation and temporary-file cleanup; a
+cleanup failure cannot acknowledge success. The unchanged binary-upload/empty-stage
+assertions cover this ordering on Linux, independently from the real KVM gate.

data/docs/hiera-and-eyaml.md

@@ -105,7 +105,8 @@ An optional mount is not permission to ignore unsafe configuration.
 Puppet's [default modulepath](https://help.puppet.com/core/current/Content/PuppetCore/config_file_environment.htm)
 includes the environment's `modules` directory. Empeira checks explicit
 `environment.conf` modulepaths and reports a known exclusion before startup. It
-never rewrites that file. Expressions containing unresolved Puppet variables cannot
+never rewrites the original file. Its managed copy changes only
+`environment_timeout` to zero. Expressions containing unresolved Puppet variables cannot
 be verified completely from the CLI host; ensure the effective server modulepath
 includes the mount destination. Environment mounts can be referenced by ordinary
 relative paths in `hiera.yaml`, such as `data/external` or `external` when the datadir
@@ -117,7 +118,8 @@ an image rebuild, `up`, or a service restart.
 Empeira neither copies their data nor writes probe files into them. It uses a managed
 environment directory containing links to the read-only control repository so nested
 mount targets can exist without modifying control code. Existing control files and
-linked directories remain live. `up` refreshes links for new control entries under
+linked directories remain live; `environment.conf` is an independent copy refreshed
+by `up`. `up` also refreshes links for new top-level control entries and entries under
 projected ancestor directories. EYAML keys remain configured separately in `eyaml`,
 and decryption runs on the server.
 

data/docs/installation.md

@@ -1,36 +1,63 @@
 # Installation
 
 Empeira runs natively on Linux and macOS. Windows uses **WSL2 → Linux → Empeira**;
-native Windows Ruby is unsupported. The gemspec requires **Ruby >= 3.4**; the
-supported Ruby versions are **3.4 and 4.0**. Normal CI tests both on Ubuntu;
-release gems are built with Ruby 3.4. Use source installation until a release gem
-is available. No RubyGems.org publication is assumed.
+native Windows Ruby is unsupported. The gemspec requires **Ruby >= 3.1**; supported Ruby versions are **3.1, 3.2,
+3.3, 3.4 and 4.0**. Normal CI tests all five on Ubuntu and native macOS;
+release gems are built with Ruby 3.4. The first public alpha is
+[`v0.1.0-alpha.1`](https://github.com/c8m6/empeira/releases/tag/v0.1.0-alpha.1)
+and is available on [RubyGems.org](https://rubygems.org/gems/empeira).
+
+## Install from RubyGems.org (recommended)
+
+After installing Ruby 3.1+ and the appropriate host tools/container runtime
+described below, install Empeira from RubyGems.org:
+
+```bash
+gem install --user-install empeira --pre
+export PATH="$(ruby -r rubygems -e 'puts Gem.user_dir')/bin:$PATH"
+empeira --version
+empeira help
+```
+
+The `--pre` flag is needed while Empeira is available as a prerelease. For an
+exact installation of the first alpha, use:
+
+```bash
+gem install --user-install empeira --version 0.1.0.pre.alpha.1
+```
+
+A gem installation needs neither Bundler nor a Git checkout of Empeira. It
+installs the `thor` runtime dependency automatically; it does **not** install
+Git, Podman/Docker, QEMU, or Puppet/OpenVox node images. Do not use `sudo gem install` for a normal user installation. Keep the gem user's `bin` directory
+in your shell `PATH` to retain the command across new terminal sessions.
+
+If you previously used the source-installation `empeira()` shell function,
+remove that function from your shell configuration and start a new shell before
+testing the installed executable. The source function otherwise takes precedence.
 
 ## Linux and WSL2
 
-These commands target **Ubuntu 24.04 LTS** and **Debian 13 trixie**. Their default
-Ruby packages are below Empeira's minimum; Ruby 3.2 and 3.3 are unsupported.
-Install Ruby 3.4+ with your established Ruby version manager before using Empeira.
-Ubuntu 22.04 and Debian 12 also need a newer Ruby. Installing the distribution's
-default `ruby` package does not satisfy the gemspec on these hosts.
+These commands target **Ubuntu 24.04 LTS** and **Debian 13 trixie**. Use Ruby 3.1+ from the distribution or your established Ruby version manager.
+Check `ruby --version` before installing the gem. The distribution's default
+`ruby` package is suitable only when it meets the minimum; otherwise activate
+a compatible Ruby before proceeding.
 
-Core/source development dependencies and SSH access:
+Host utilities and SSH access:
 
 ```bash
 sudo apt-get update
-sudo apt-get install -y git build-essential openssh-client iproute2
-# Activate Ruby 3.4+ using your Ruby version manager before continuing.
-gem install bundler
+sudo apt-get install -y git openssh-client iproute2
+# Activate Ruby 3.1+ when the distribution's Ruby is too old.
 ruby --version
 gem --version
-bundle --version
 git --version
 ssh -V
 ```
 
-The selected Ruby installation must supply `gem` and matching development headers;
-`gem install bundler` supplies `bundle`. `build-essential` builds native development
-gems; additional Ruby build prerequisites depend on your version manager.
+The selected Ruby installation must supply `gem`. Bundler, a source checkout and
+a C/C++ build toolchain are not required to install the published Empeira gem.
+They may be needed for source development or for setting up your Ruby environment;
+see [source installation](#source-installation-and-project-opt-in).
 `openssh-client` supplies `ssh` and `ssh-keygen` for regular node SSH. VM management
 uses private VirtIO-Serial and Python 3 already present in the selected cloud image.
 `iproute2` supplies host route inspection for automatic workspace subnet allocation. Coreutils supplies
@@ -131,11 +158,8 @@ Install Homebrew using its [official instructions](https://brew.sh/), then core:
 ```bash
 brew install git ruby@3.4 openssh
 export PATH="$(brew --prefix ruby@3.4)/bin:$PATH"
-gem install --user-install bundler
-export PATH="$(ruby -r rubygems -e 'puts Gem.user_dir')/bin:$PATH"
 ruby --version
 gem --version
-bundle --version
 git --version
 ssh -V
 ```
@@ -189,7 +213,13 @@ not establish those results. See the [VM validation gates](development.md#vm-and
 
 ## Source installation and project opt-in
 
+For development or unreleased changes, run Empeira directly from a Git checkout.
+This alternative requires Bundler and the development dependencies (including a
+build toolchain where native gems need it). Set up Bundler first, then:
+
 ```bash
+gem install --user-install bundler
+export PATH="$(ruby -r rubygems -e 'puts Gem.user_dir')/bin:$PATH"
 git clone https://github.com/c8m6/empeira.git
 cd empeira
 bundle config set --local path vendor/bundle
@@ -213,21 +243,22 @@ invocation and paths with spaces work. No Puppet-file heuristic or `--project`
 selector exists. The source shell function preserves the current directory.
 Version/help/self-update work outside Git (self-update currently reports unavailable).
 
-## Release gem installation
+## Install the GitHub Release gem (alternative)
 
-Download the `.gem` asset from a [GitHub release](https://github.com/c8m6/empeira/releases)
-when one is available, then install it with your existing Ruby environment:
+The [GitHub Releases](https://github.com/c8m6/empeira/releases) page also
+provides the exact `.gem` asset built and verified by the release pipeline.
+For example, after downloading the first alpha:
 
 ```bash
-gem install --user-install ./empeira-VERSION.gem
+gem install --user-install ./empeira-0.1.0.pre.alpha.1.gem
 export PATH="$(ruby -r rubygems -e 'puts Gem.user_dir')/bin:$PATH"
 empeira --version
 ```
 
-Replace `VERSION` with the downloaded asset's filename. RubyGems installs the Thor
-runtime dependency; no third-party agents, images or binaries are bundled. The
-release version is embedded in BuildInfo. Standalone binaries and automatic
-self-update are unavailable. Do not use `sudo gem install` for normal operation.
+Both distribution paths use the same verified gem for the corresponding release.
+The release version is embedded in BuildInfo. No third-party agents, images or
+binaries are bundled. Standalone platform binaries and automatic self-update
+remain unavailable.
 
 For other Linux distributions, install equivalent Ruby/Git/runtime packages through
 your established host setup. Guest OS support does not imply a tested host recipe.

data/docs/nodes.md

@@ -87,18 +87,22 @@ Managed servers enforce native `[server] environment_timeout = 0` before startup
 and verify the effective setting during `up`, independently of image environment
 variable support. Existing workspaces adopt it on
 their next `up`; run that once after updating from a version that enabled caching.
+Adopting the managed environment copy changes the server mount and recreates its
+container once, retaining CA, SSL and database storage.
 Each catalog request reloads live control code, modules and mounted Hiera data.
 Empeira does not hash these trees,
 persist content checkpoints or call the environment-cache admin API. Code edits
 need neither `up` nor a server restart, including for agents invoked manually.
 Empeira does not enable `use_cached_catalog`.
 
-A repository's own `environment.conf` can override the server timeout; use zero
-for immediate edits. Avoid concurrent edits during a catalog run. Existing files
-and directories in projected environments stay live through read-only links.
-New siblings under ancestors projected for nested Hiera mounts require `up` to
-create their links. `node start` resumes the node without invoking Puppet; Puppet
-services enabled by a catalog may run independently on startup.
+Empeira copies `environment.conf` into its managed environment and sets its timeout
+to zero there, preserving all other settings and the original file. Run `up` to
+refresh this copy after editing other environment settings. Avoid concurrent edits
+during a catalog run. Existing files and directories stay live through read-only
+links. New top-level entries and new siblings under ancestors projected for nested
+Hiera mounts require `up` to create their links. `node start` resumes the node
+without invoking Puppet; Puppet services enabled by a catalog may run independently
+on startup.
 
 ## Distribution package sources
 

data/docs/troubleshooting.md

@@ -33,6 +33,14 @@ HTTP 403 does not trigger login, and HTTP 407 identifies proxy authentication. R
 authentication continues to use native `docker login` / `podman login` and the reported
 registry host; Empeira does not log into registries automatically.
 
+APT can report an HTTP status without a reason phrase, for example
+`401 [IP: 192.0.2.1 443]`. This still triggers the single repository login attempt
+when no ENV credentials are set and both standard input and standard error are
+connected to a TTY. The corresponding `403` and `407` forms retain their access-denied
+and proxy-authentication diagnoses without prompting. A node retained as `incomplete`
+after an acquisition failure must be destroyed with `empeira node destroy HOSTNAME`
+and recreated with the original `empeira node run` arguments after resolving the cause.
+
 APT helper credentials use literal `login` and `password` tokens in a temporary
 0600 file under `/etc/apt/auth.conf.d`. APT treats surrounding quotes and added
 backslashes as credential bytes, so Empeira does not add them. A successful login
@@ -140,11 +148,14 @@ problem. A successful probe with different directory listings indicates a
 different engine view of the source. Empeira does not weaken mount checks or
 change host permissions automatically.
 
-An explicit `environment_timeout` in the project's `environment.conf` overrides
-the native server setting. Empeira preserves it. Bare `puppet config print`
-includes that override; server startup and reconciliation verify only the native
-server value. Set the environment override to zero or remove it when immediate
-code reloads are required. No explicit cache invalidation is performed.
+Empeira enforces `environment_timeout = 0` in both the native server setting and
+its independent copy of `environment.conf`. The project's original file remains
+unchanged, even when it specifies `unlimited`. Run `up` after updating Empeira or
+editing other settings in `environment.conf` to refresh the managed copy. Inside
+the server, `puppet config print environment_timeout --section server --environment
+ENVIRONMENT` must report `0` for the configured environment. A different value
+fails startup verification; check the custom server's confdir and environmentpath.
+No explicit cache invalidation is performed.
 
 `config show` includes `effective_hiera_mounts`. A skipped optional source is
 reported during `up`; mount it locally or correct the source path, then run `up`

data/lib/empeira/agent/native_commands.rb

@@ -39,11 +39,11 @@ module Empeira
         diagnostic = Execution::Diagnostics.native(result.with(stderr: text, stdout: ''),
                                                    operation: "Agent #{operation}", tool: arguments.first)
         case text
-        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b/i
+        when /407\s+Proxy Authentication Required|(?:HTTP|Status code|HTTP code)\s*:?\s*407\b|\b407[ \t]+\[IP:/i
           raise Error, "Host helper proxy authentication failed\n#{diagnostic}", cause: nil
-        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b/i
+        when /401\s+Unauthorized|(?:HTTP|Status code|HTTP code)\s*:?\s*401\b|\b401[ \t]+\[IP:/i
           raise Agent::AuthenticationRequired, diagnostic, cause: nil
-        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b/i
+        when /403\s+Forbidden|(?:HTTP|Status code|HTTP code)\s*:?\s*403\b|\b403[ \t]+\[IP:/i
           raise Error, "Agent repository access denied\n#{diagnostic}", cause: nil
         end
         raise Error, "Agent #{operation} failed\n#{diagnostic}", cause: nil

data/lib/empeira/build.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.1",
-  "revision": "7cd2d71ea0b7cfa7008f8faf18e975499c5af9c0",
-  "build_time": "2026-10-14T09:19:05Z"
+  "version": "0.1.0-alpha.4",
+  "revision": "b073c6a15db14c4dace4a732703240f4289cbb48",
+  "build_time": "2026-10-21T11:41:02Z"
 }

data/lib/empeira/compatibility/data.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Ruby 3.2 introduced immutable Data value objects. Keep Ruby 3.1 support
+# without replacing the native Data implementation on newer Rubies.
+module Empeira
+  module Compatibility
+    module DataFactory
+      module_function
+
+      # rubocop:disable-next Metrics/AbcSize, Metrics/MethodLength -- Ruby 3.1 must emulate Data initializer semantics.
+      def define(*members, &definition)
+        # The explicit nil class name also permits zero members and preserves
+        # Struct's value equality, hashing and pattern matching for empty records.
+        base_class = Struct.new(nil, *members, keyword_init: true)
+        base_class.class_eval do
+          def initialize(*positional, **keywords)
+            fields = self.class.members
+            raise ArgumentError, 'too many positional arguments' if positional.size > fields.size
+
+            supplied = fields.take(positional.size).zip(positional).to_h.merge(keywords)
+            missing = fields - supplied.keys
+            unexpected = supplied.keys - fields
+            raise ArgumentError, "missing keywords: #{missing.join(', ')}" unless missing.empty?
+            raise ArgumentError, "unknown keywords: #{unexpected.join(', ')}" unless unexpected.empty?
+
+            super(**supplied)
+            freeze
+          end
+
+          def with(**changes)
+            self.class.new(**to_h, **changes)
+          end
+
+          def initialize_copy(other)
+            super
+            freeze
+          end
+        end
+        value_class = Class.new(base_class)
+        define_constructors(value_class)
+        value_class.include(self)
+        value_class.class_eval(&definition) if definition
+        value_class
+      end
+
+      # rubocop:disable-next Metrics/AbcSize -- Normalize native Data constructors before custom initialization.
+      def define_constructors(value_class)
+        value_class.define_singleton_method(:new) do |*positional, **keywords|
+          raise ArgumentError, 'cannot mix positional and keyword arguments' unless positional.empty? || keywords.empty?
+          raise ArgumentError, 'too many positional arguments' if positional.size > members.size
+
+          keywords = members.take(positional.size).zip(positional).to_h unless positional.empty?
+          super(**keywords).freeze
+        end
+        value_class.define_singleton_method(:[]) { |*positional, **keywords| new(*positional, **keywords) }
+      end
+    end
+  end
+end
+
+Data = Empeira::Compatibility::DataFactory unless defined?(Data)

data/lib/empeira/control_plane/controller.rb

@@ -350,10 +350,11 @@ module Empeira
 
       def reconcile_server_environment
         environment = Server::EnvironmentConfiguration.new(runtime: @runtime, plan: @plan)
-        return unless environment.reconcile(@observed.fetch('server'))
+        if environment.reconcile(@observed.fetch('server'))
+          @changed = true
+          @health.wait('server', @observed)
+        end
 
-        @changed = true
-        @health.wait('server', @observed)
         environment.verify!(@observed.fetch('server'))
       end
 

data/lib/empeira/control_plane/environment.rb

@@ -9,7 +9,7 @@ module Empeira
       def initialize(context:, hiera:)
         @project = context.project.path
         @root = root(context)
-        @targets = mount_targets(hiera)
+        @targets = ['environment.conf', *mount_targets(hiera)]
         @modules = Modules::Storage.new(context: context).root if @project.join('Puppetfile').file?
         @targets |= ['modules'] if @modules
         @base = context.locations.workspace(context.workspace).join('environments')
@@ -17,14 +17,11 @@ module Empeira
       end
 
       def mounts
-        return [bind(@project, @root)] if @targets.empty?
-
         [bind(@project, CONTROL), bind(@directory, @root),
          *(@modules ? [bind(@modules, "#{@root}/modules")] : [])]
       end
 
       def prepare
-        return if @targets.empty?
         raise Error, 'Managed environment directory must not be a symlink' if @directory.symlink?
 
         FileUtils.mkdir_p(@directory, mode: 0o755)
@@ -81,13 +78,36 @@ module Empeira
       end
 
       def create_entry(relative, destination)
-        if @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
+        if relative == 'environment.conf'
+          prepare_configuration(destination)
+        elsif @targets.any? { |target| target == relative || target.start_with?("#{relative}/") }
           create_target(relative, destination)
         else
           create_link(relative, destination)
         end
       end
 
+      def prepare_configuration(destination)
+        content = environment_configuration
+        return if !destination.symlink? && destination.file? && destination.binread == content
+
+        Tempfile.create('environment-', @directory) do |file|
+          file.chmod(0o644)
+          file.write(content)
+          file.flush
+          File.rename(file.path, destination)
+        end
+      end
+
+      def environment_configuration
+        source = @project.join('environment.conf')
+        content = source.exist? ? source.binread : ''
+        content = content.gsub(/^[ \t]*environment_timeout[ \t]*=[^\r\n]*/, 'environment_timeout = 0')
+        content += "\n" unless content.empty? || content.end_with?("\n")
+        content += "environment_timeout = 0\n" unless content.match?(/^environment_timeout = 0\r?$/)
+        content
+      end
+
       def create_target(relative, destination)
         raise Error, 'Managed environment destination is unsafe' if destination.symlink?
 

data/lib/empeira/network/peer/backend.rb

@@ -6,7 +6,7 @@ module Empeira
       class Backend
         attr_reader :context, :runtime, :runner, :store
 
-        def self.build(context:, **)
+        def self.build(context:, **options)
           klass = if context.container_engine == 'docker'
                     DockerAdapter
                   elsif context.platform.os == :macos
@@ -14,7 +14,7 @@ module Empeira
                   else
                     LinuxPodman
                   end
-          klass.new(context: context, **)
+          klass.new(context: context, **options)
         end
 
         def initialize(context:, runtime:, runner:, store:)

data/lib/empeira/network/peer/linux_podman.rb

@@ -92,8 +92,8 @@ module Empeira
           raise Providers::OwnershipError, 'VM TAP already exists; inspect its owning process'
         end
 
-        def namespace(*, **)
-          command('podman', '--remote=false', 'unshare', '--rootless-netns', *, **)
+        def namespace(*arguments, **options)
+          command('podman', '--remote=false', 'unshare', '--rootless-netns', *arguments, **options)
         end
 
         def attached?(record, links)

data/lib/empeira/network/peer/podman_machine.rb

@@ -98,13 +98,13 @@ module Empeira
           raise Error, 'Podman Machine cannot verify the peer helper at its host path; configure its shared mount'
         end
 
-        def namespace(*)
-          executable, *arguments = namespace_command(@machine, *)
-          command(executable, *arguments)
+        def namespace(*arguments)
+          executable, *command_arguments = namespace_command(@machine, *arguments)
+          command(executable, *command_arguments)
         end
 
-        def namespace_command(machine, *)
-          ['podman', 'machine', 'ssh', machine, Shellwords.join(['podman', 'unshare', '--rootless-netns', *])]
+        def namespace_command(machine, *arguments)
+          ['podman', 'machine', 'ssh', machine, Shellwords.join(['podman', 'unshare', '--rootless-netns', *arguments])]
         end
       end
     end

data/lib/empeira/node/definition.rb

@@ -5,10 +5,10 @@ module Empeira
     class Definition < Services::Definition
       attr_reader :hostname
 
-      def initialize(hostname:, workspace:, **)
+      def initialize(hostname:, workspace:, **options)
         @hostname = hostname
         super(key: "node-#{Digest::SHA256.hexdigest(hostname)[0, 24]}", workspace: workspace,
-              hostname: hostname, **)
+              hostname: hostname, **options)
       end
 
       def ownership_labels

data/lib/empeira/server/environment_configuration.rb

@@ -24,10 +24,10 @@ module Empeira
       end
 
       def verify!(resource)
-        return if current(resource) == '0'
+        return if current(resource) == '0' && effective(resource) == '0'
 
         raise Error, 'Puppetserver environment_timeout is not 0 after startup; the custom entrypoint or ' \
-                     'server confdir overrides the managed setting; inspect the server runtime contract'
+                     'server confdir/environment overrides the managed setting; inspect the server runtime contract'
       end
 
       private
@@ -36,6 +36,12 @@ module Empeira
         execute(resource, [ControlPlane::Health::RUBY, READER, '--confdir', confdir]).stdout.strip
       end
 
+      def effective(resource)
+        arguments = [PUPPET, 'config', 'print', 'environment_timeout', '--section', 'server',
+                     '--confdir', confdir, '--environment', @plan.config.dig('server', 'environment')]
+        execute(resource, arguments).stdout.strip
+      end
+
       def execute(resource, arguments)
         result = @runtime.service_exec(resource, arguments)
         return result if result.success?

data/lib/empeira/updates/images.rb

@@ -73,9 +73,9 @@ module Empeira
          { label: 'VM network helper', image: adapter.image, recipe: adapter.recipe, files: adapter.files }]
       end
 
-      def utility_artifact(key, label, **)
+      def utility_artifact(key, label, **options)
         Empeira::Images::Configuration.artifact(
-          @config.dig('images', key), registry: @config.dig('images', 'registry'), **
+          @config.dig('images', key), registry: @config.dig('images', 'registry'), **options
         ).merge(label: label)
       end
 

data/lib/empeira.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'empeira/compatibility/data'
 require_relative 'empeira/errors'
 require_relative 'empeira/progress'
 require_relative 'empeira/build_info'

data/resources/modules/Containerfile

@@ -5,7 +5,7 @@ RUN apk add --no-cache git ca-certificates
 WORKDIR /opt/empeira-modules
 COPY Gemfile Gemfile.lock ./
 RUN apk add --no-cache --virtual .build-deps build-base libffi-dev \
-    && gem install bundler -v 4.0.22 --no-document \
+    && gem install bundler -v 2.6.9 --no-document \
     && bundle config set deployment true && bundle install --jobs 2 \
     && apk del .build-deps
 COPY worker.rb ./

data/resources/modules/Gemfile

@@ -3,3 +3,9 @@
 source 'https://rubygems.org'
 
 gem 'r10k', '5.0.3'
+
+# r10k's newer fast_gettext 4.x dependency requires Ruby >= 3.2.
+# Keep the module helper usable with the oldest supported Ruby (3.1).
+gem 'fast_gettext', '~> 3.1.0'
+# Newer multi_json requires Ruby >= 3.2.
+gem 'multi_json', '1.18.0'

data/resources/modules/Gemfile.lock

@@ -13,9 +13,8 @@ GEM
       faraday (>= 1, < 3)
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
-    fast_gettext (4.1.1)
+    fast_gettext (3.1.0)
       prime
-      racc
     fiddle (1.1.8)
     forwardable (1.4.0)
     gettext (3.5.2)
@@ -36,7 +35,7 @@ GEM
     log4r (1.1.10)
     logger (1.7.0)
     minitar (1.1.0)
-    multi_json (1.21.2)
+    multi_json (1.18.0)
     net-http (0.9.1)
       uri (>= 0.11.1)
     prime (0.1.4)
@@ -68,18 +67,19 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  fast_gettext (~> 3.1.0)
+  multi_json (= 1.18.0)
   r10k (= 5.0.3)
 
 CHECKSUMS
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
-  bundler (4.0.22) sha256=d8d5ec84c8555e0af71db63ed7aee4d1a8fb839ec46d84212d61979242a5d75a
   colored2 (4.0.3) sha256=63e1038183976287efc43034f5cca17fb180b4deef207da8ba78d051cbce2b37
   cri (2.15.12) sha256=8abfe924ef53e772a8e4ee907e791d3bfcfca78bc62a5859e3b9899ba29956e5
   erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
   faraday (2.14.4) sha256=9bb4408c44621b0dbaaaa39e5dbfc4dbe58cc6751b6eb94d16ae9e1f2f2fab6e
   faraday-follow_redirects (0.5.0) sha256=5cde93c894b30943a5d2b93c2fe9284216a6b756f7af406a1e55f211d97d10ad
   faraday-net_http (3.4.4) sha256=0e78af151747ed1b00f33e25973b4bc220d7f16c00c39676817c8b12331eb588
-  fast_gettext (4.1.1) sha256=e8c532f6945b0dc31efb2e91366bd56630bc3ae6a05a4126937124e40366efd8
+  fast_gettext (3.1.0) sha256=9c4c84c33a875cc9edc062179229f9d373179a624d3c961eed747cddbab72ac5
   fiddle (1.1.8) sha256=7fa8ee3627271497f3add5503acdbc3f40b32f610fc1cf49634f083ef3f32eee
   forwardable (1.4.0) sha256=f1cd40cc9812937980e1c76f1aa053660990a7c9b6a98fc37d945468afcce838
   gettext (3.5.2) sha256=ada02c59aa7e9f56bd2522faedaed16421dd2f3ddb5fe28628c0be5abcbf3c74
@@ -90,7 +90,7 @@ CHECKSUMS
   log4r (1.1.10) sha256=9b452928c964b7c54c09aeb25ff045b5a722b387b16c9ce37cb1baec00062966
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
   minitar (1.1.0) sha256=38db0cfb6f3801017946cdcd8dc53f2cf3fd41ff752892312bf9a1639c9ea23e
-  multi_json (1.21.2) sha256=245531eaf54bdba57aba515ff08b4503505c5e09911daa89c5a561e2f85bea8e
+  multi_json (1.18.0) sha256=23f70cf73e2895a33e6d10f0ec955b28ef5627ca4bbad0f292e7d16f4675596f
   net-http (0.9.1) sha256=25ba0b67c63e89df626ed8fac771d0ad24ad151a858af2cc8e6a716ca4336996
   prime (0.1.4) sha256=4d755ebf7c2994a6f3a3fee0d072063be3fff2d4042ebff6cd5eebd4747a225e
   puppet_forge (6.2.0) sha256=9cde4841a7a6950afeb0c4fec02449931179863918c0a6e6909cb2a6c6998a0c
@@ -102,4 +102,4 @@ CHECKSUMS
   uri (1.1.1) sha256=379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6
 
 BUNDLED WITH
-  4.0.22
+   2.6.9

data/resources/nodes/management/guest_agent.py

@@ -316,6 +316,7 @@ def handle(message):
         active['file'].close()
         active = None
         pending = None
+        status = 0
         try:
             with tempfile.NamedTemporaryFile(dir=os.path.dirname(destination), delete=False) as target:
                 pending = target.name
@@ -326,14 +327,16 @@ def handle(message):
                 os.fsync(target.fileno())
             os.replace(pending, destination)
             pending = None
-            send({'type': 'exit', 'status': 0, 'timed_out': False})
         except OSError as error:
             send({'type': 'stderr', 'data': base64.b64encode((os.strerror(error.errno) + '\n').encode()).decode()})
-            send({'type': 'exit', 'status': 1, 'timed_out': False})
+            status = 1
         finally:
             os.unlink(staged)
             if pending:
                 os.unlink(pending)
+        # Completion includes staging cleanup; an unlink failure must never
+        # acknowledge success to a controller that is already enrolling/Puppet.
+        send({'type': 'exit', 'status': status, 'timed_out': False})
     else:
         raise ValueError('Unexpected protocol operation')
 

data/resources/proxy/Containerfile

@@ -1,10 +1,7 @@
 ARG EMPEIRA_BASE_UBUNTU=library/ubuntu@sha256:da6fc2be547864451aa253836dd926da33623312df4a9a243e35dc877c378a78
 FROM ${EMPEIRA_BASE_UBUNTU}
 ENV DEBIAN_FRONTEND=noninteractive
-RUN ["apt-get", "-o", "APT::Update::Error-Mode=any", "update"]
-RUN ["apt-get", "install", "--yes", "--no-install-recommends", "ca-certificates"]
-RUN ["sed", "-i", "/Types: deb/a Snapshot: yes", "/etc/apt/sources.list.d/ubuntu.sources"]
-RUN ["apt-get", "--snapshot", "20261001T000000Z", "-o", "APT::Update::Error-Mode=any", "update"]
-RUN ["apt-get", "--snapshot", "20261001T000000Z", "install", "--yes", "--no-install-recommends", "squid=7.2-2ubuntu2.2"]
-RUN ["apt-get", "clean"]
+RUN apt-get -o APT::Update::Error-Mode=any update \
+    && apt-get install --yes --no-install-recommends ca-certificates squid \
+    && rm -rf /var/lib/apt/lists/*
 USER proxy

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: empeira
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.alpha.1
+  version: 0.1.0.pre.alpha.4
 platform: ruby
 authors:
 - Christian Meißner (c8m6)
@@ -72,6 +72,7 @@ files:
 - lib/empeira/cli/progress.rb
 - lib/empeira/cli/proxy.rb
 - lib/empeira/cli/update.rb
+- lib/empeira/compatibility/data.rb
 - lib/empeira/completion/addons.rb
 - lib/empeira/completion/bash.rb
 - lib/empeira/completion/catalog.rb
@@ -303,7 +304,7 @@ files:
 - resources/relay/server_start.sh
 homepage: https://github.com/c8m6/empeira
 licenses:
-- AGPL-3.0-only
+- AGPL-3.0-or-later
 metadata:
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -313,7 +314,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.4'
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="