@microck/raft 0.0.0-stage → 0.2.0

package/docs/reference/cli.md

@@ -0,0 +1,279 @@
+---
+title: CLI command reference
+description: Complete command-line reference for the Raft controller CLI.
+---
+
+# CLI command reference
+
+Command-line reference for the `raft` controller tool.
+
+Syntax:
+`raft <subcommand> [options] [arguments]`
+
+Workspaces are referenced by location-qualified handles formatted as `<location>:<instance-name>` (for example `lab:rf-a1b2c3d4e5f60718`).
+
+## Command index
+
+| Task | Commands |
+| --- | --- |
+| Workspace lifecycle | [`new`](#new), [`stop`](#stop), [`resume`](#resume), [`extend`](#extend), [`destroy`](#destroy) |
+| Execution and inspection | [`exec`](#exec), [`ssh`](#ssh), [`info`](#info), [`usage`](#usage) |
+| Background job | [`status`](#status), [`logs`](#logs), [`cancel`](#cancel) |
+| File transfer | [`upload`](#upload), [`download`](#download) |
+| Snapshots and cloning | [`snapshot`](#snapshot), [`snapshots`](#snapshots), [`restore`](#restore), [`snapshot-delete`](#snapshot-delete), [`fork`](#fork) |
+| Port forwarding and desktop | [`forward`](#forward), [`desktop`](#desktop) |
+| Backup and recovery | [`backup`](#backup), [`recover`](#recover) |
+| Host inspection and maintenance | [`limits`](#limits), [`doctor`](#doctor), [`list`](#list), [`gc`](#gc), [`prune`](#prune) |
+
+## Workspace lifecycle commands
+
+### `new`
+
+Create and launch a new workspace container.
+
+`raft new [--location LOCATION] [--ttl TTL] [--cpu {1,2}] [--memory {1GiB,2GiB,4GiB}]`
+
+- `--location LOCATION`: Target host location in `~/.config/raft/incus.json`. Defaults to first configured location.
+- `--ttl TTL`: Lifetime in seconds before automatic stop (`60` to `2592000`). Default: `600`.
+- `--cpu {1,2}`: CPU core count managed by Incus. Default: `1`.
+- `--memory {1GiB,2GiB,4GiB}`: Memory limit. Default: `2GiB`.
+
+- `--disposable`: Delete the box and snapshots on stop or expiry. Off by default.
+- `--from LOCATION:BOX/SNAPSHOT`: Copy a named snapshot on its source host instead of the configured image. Normal creation sizing applies; the source can be running. Cannot target a different location.
+
+Returns the qualified workspace handle.
+
+### `stop`
+
+Stop a running workspace.
+
+`raft stop <box>`
+
+Terminates guest processes and stops the container. Persistent boxes retain filesystem contents, packages and snapshots. Disposable boxes are deleted, including their snapshots.
+
+### `resume`
+
+Start a stopped workspace with a renewed lifetime deadline.
+
+`raft resume <box> --ttl TTL [--cpu {1,2}] [--memory {1GiB,2GiB,4GiB}]`
+
+- `--ttl TTL`: Lifetime in seconds from resumption (`60` to `2592000`). Required.
+
+### `extend`
+
+Reset the expiration deadline for a running workspace without restarting it.
+
+`raft extend <box> --ttl TTL`
+
+- `--ttl TTL`: Lifetime in seconds from the current host timestamp. Required.
+
+### `destroy`
+
+Permanently delete a workspace container and its snapshots.
+
+`raft destroy <box>`
+
+Stops the container if running, removes all associated Btrfs snapshots, and releases host storage.
+
+CPU/RAM overrides on resume apply before startup. Omitted values stay unchanged. A running box is rejected before changing its limits.
+
+## Execution and inspection commands
+
+### `exec`
+
+Execute a command inside a workspace.
+
+`raft exec <box> [--detach] [--] <command ...>`
+
+- `--detach`: Run in background as a guest systemd unit. Returns a job ID immediately.
+- `<command ...>`: Command and arguments passed to `execve`. For shell features (pipes, redirects, variables), wrap with `bash -lc '...'`.
+
+Example:
+```sh
+job=$(raft exec "$box" --detach -- make test)
+```
+
+### `ssh`
+
+Open an interactive root terminal session inside the workspace over host SSH and Incus exec.
+
+`raft ssh <box>`
+
+### `info`
+
+Display container metadata from Incus in JSON format, including status, IP addresses, resource limits, and timestamps.
+
+`raft info <box>`
+
+### `usage`
+
+Display active resource consumption for a running workspace: cgroup memory, CPU microseconds, CPU affinity, and shared-pool disk space.
+
+`raft usage <box>`
+
+## Background job commands
+
+`status`, `logs` and `cancel` require a job ID returned by `exec --detach` in the selected running workspace. Unknown jobs return an error.
+
+Cancelled jobs remain inspectable while their guest journal records exist. Rotating old logs does not prevent inspection of a live job.
+
+### `status`
+
+Check the execution state of a detached background job.
+
+`raft status <box> <job>`
+
+Queries `systemctl show` inside the container and outputs `ActiveState`, `SubState`, and `ExecMainStatus`.
+
+### `logs`
+
+Retrieve journal output from a detached background job using `journalctl --no-pager -o cat -u <job>`.
+
+`raft logs <box> <job>`
+
+### `cancel`
+
+Terminate a running detached background job using `systemctl stop <job>`.
+
+`raft cancel <box> <job>`
+
+## File transfer commands
+
+### `upload`
+
+Transfer a local file from the controller to an absolute path inside the workspace.
+
+`raft upload <box> <source> <destination> [--recursive]`
+
+- `<source>`: Path to local file on controller.
+- `<destination>`: Target absolute path inside container.
+
+### `download`
+
+Transfer a file from an absolute path inside the workspace to the local controller.
+
+`raft download <box> <source> <destination> [--recursive]`
+
+- `<source>`: Absolute path to file inside container.
+- `<destination>`: Local file destination path on controller.
+
+`--recursive` transfers a directory tree into a new destination directory. It requires a running workspace and Python 3.11.8+ in the guest. Parent directories must exist. Existing destinations are rejected, including empty directories and symlinks. Internal relative links, hardlinks, executable files and empty directories are supported; escaping links and special files are rejected. Archives use temporary controller disk space. Single-file transfers still work on stopped boxes.
+
+## Snapshots and cloning commands
+
+### `snapshot`
+
+Create a named point-in-time snapshot of a stopped workspace. Names use alphanumeric characters, underscores, or hyphens up to 64 characters.
+
+`raft snapshot <box> <name>`
+
+### `snapshots`
+
+List existing snapshots and creation timestamps for a workspace.
+
+`raft snapshots <box>`
+
+### `snapshot-delete`
+
+Delete one named snapshot without deleting the workspace. The box can be running.
+
+`raft snapshot-delete <box> <name>`
+
+### `restore`
+
+Roll back a stopped workspace filesystem to a named snapshot using `--diskonly`, preserving container configuration and MAC address.
+
+`raft restore <box> <name>`
+
+### `fork`
+
+Clone a stopped workspace into an independent container on the same host and start it.
+
+`raft fork <box> --ttl TTL [--cpu {1,2}] [--memory {1GiB,2GiB,4GiB}] [--disposable]`
+
+- `--ttl TTL`: Lifetime in seconds for the clone. Required.
+
+Omitted CPU/RAM values inherit the source limits. The clone is persistent unless `--disposable` is supplied, regardless of the source policy.
+
+Returns the qualified handle of the clone.
+
+## Port forwarding and desktop commands
+
+### `forward`
+
+Open a private SSH tunnel between a guest port and controller loopback (`127.0.0.1`).
+
+`raft forward <box> --remote REMOTE --local LOCAL`
+
+- `--remote REMOTE`: Port number inside the workspace (bound to `0.0.0.0` or container IP).
+- `--local LOCAL`: Port number on controller loopback (`127.0.0.1`).
+
+Runs in foreground; press `Ctrl+C` to close.
+
+### `desktop`
+
+Start `raft-desktop.service` inside the container and open a private tunnel for noVNC.
+
+`raft desktop <box> [--local LOCAL]`
+
+- `--local LOCAL`: Controller port to bind (default: `6080`). Access at `http://127.0.0.1:<LOCAL>/vnc.html`. Press `Ctrl+C` to close.
+
+## Backup and recovery commands
+
+### `backup`
+
+Export a stopped workspace and its snapshots to a compressed archive on the controller.
+
+`raft backup <box> <destination>`
+
+- `<destination>`: Output archive path (e.g. `./workspace.tar.gz`). Must not exist. Created with mode `0600`.
+
+### `recover`
+
+Import a portable backup archive onto a host as a fresh stopped workspace.
+
+`raft recover <source> --location LOCATION`
+
+- `<source>`: Path to archive file on controller.
+- `--location LOCATION`: Target host location. Required.
+
+Returns the qualified handle of the imported stopped workspace.
+
+## Host inspection and maintenance commands
+
+### `limits`
+
+Inspect host resource capacity, active allocations, and recommended workspace limits.
+
+`raft limits [--location LOCATION] [--json]`
+
+- `--location LOCATION`: Filter report to a specific host.
+- `--json`: Output report as JSON.
+
+### `doctor`
+
+Inspect host connectivity, Incus version, active systemd units (`incus`, `raft-expire.timer`, `raft-network.service`), root filesystem usage, storage pool status, and saved box count across configured hosts.
+
+`raft doctor`
+
+### `list`
+
+List existing workspace containers across configured hosts.
+
+`raft list [--location LOCATION]`
+
+### `gc`
+
+Enforce deadlines immediately. Persistent boxes stop; disposable boxes are deleted.
+
+`raft gc [--location LOCATION]`
+
+### `prune`
+
+Preview deletion of persistent stopped boxes older than the selected number of days.
+
+`raft prune --older-than DAYS [--location LOCATION] [--yes]`
+
+Days must be at least one. Without `--yes`, this only prints JSONL candidates. With `--yes`, it deletes matching boxes and their snapshots under the host lock. Running boxes and boxes without a recorded stop time are excluded. Stop timestamps come from Raft stop/expiry, not box creation. No automatic retention policy is enabled.
+
+Disposable creation/fork and prune require the current expiry worker installed through the deployer. A mismatch fails with deployment guidance; the CLI does not install or adapt an older worker.

package/docs/reference/configuration.mdx

@@ -0,0 +1,77 @@
+---
+title: Configuration reference
+description: Schema, fields, and security requirements for controller configuration.
+---
+
+# Configuration reference
+
+The Raft controller CLI reads host inventory and image mappings from `~/.config/raft/incus.json`.
+
+## File location and security
+
+```text
+~/.config/raft/incus.json
+```
+
+Ensure the configuration file is accessible only by your user account:
+
+```sh title="CONTROLLER: Set strict file permissions"
+chmod 600 ~/.config/raft/incus.json
+```
+
+## Schema format
+
+The configuration file maps location names to host definition objects:
+
+```json title="Example ~/.config/raft/incus.json"
+{
+  "lab": {
+    "ssh": "ubuntu@192.0.2.10",
+    "image": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+  },
+  "remote-builder": {
+    "ssh": "builder.example.com",
+    "image": ""
+  }
+}
+```
+
+### Location keys
+
+- **Naming format**: Matches `^[a-zA-Z0-9][a-zA-Z0-9_-]*$`. Starts with an alphanumeric character and contains ASCII letters, digits, underscores, or hyphens.
+- **Default location**: The first location listed is the default for `raft new`. `raft list` and `raft limits` accept `--location` filters; `raft doctor` and `raft gc` check all configured hosts.
+
+### Host entry fields
+
+| Field | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| `ssh` | `string` | Yes | Non-empty SSH connection string (IP, `user@host`, or SSH host alias from `~/.ssh/config`). |
+| `image` | `string` | For `raft new` only | Full 64-character hexadecimal SHA-256 fingerprint (`^[a-f0-9]{64}$`). An empty string `""` is allowed during initial host provisioning. |
+
+<Callout type="warn" title="Replace placeholder image fingerprint">
+The `image` field requires the full 64-character hash for `raft new`; aliases such as `raft-dev` are rejected. Replace the example hash with the actual imported image fingerprint for that host.
+
+ARM64 and AMD64 images produce different fingerprints; do not reuse an ARM64 hash on an AMD64 host.
+</Callout>
+
+## SSH configuration and connection behavior
+
+Primary remote commands (`raft ssh`, `upload`, `download`, and control commands) run OpenSSH with `BatchMode=yes` and `-o ConnectTimeout=10` to fail fast on unreachable hosts. The timeout applies to initial connection establishment, not session or transfer duration.
+
+Other operations, recovery routines, and tunnels use standard SSH defaults without an explicit timeout flag.
+
+Configure host connections in `~/.ssh/config` for batch authentication:
+
+```text title="~/.ssh/config"
+Host lab-host
+    HostName 192.0.2.10
+    User ubuntu
+    IdentityFile ~/.ssh/id_ed25519
+    IdentitiesOnly yes
+```
+
+Verify passwordless batch SSH before running Raft commands:
+
+```sh title="CONTROLLER: Verify passwordless batch connection"
+ssh -o BatchMode=yes lab-host "echo SSH connection verified"
+```

package/docs/reference/meta.json

@@ -0,0 +1,10 @@
+{
+  "title": "Reference",
+  "collapsible": true,
+  "defaultOpen": false,
+  "pages": [
+    "cli",
+    "configuration",
+    "capacity-limits"
+  ]
+}

package/docs/releases/0.2.0.md

@@ -0,0 +1,22 @@
+---
+title: Raft 0.2.0
+---
+
+# Raft 0.2.0
+
+Install the CLI with `npm install -g @microck/raft` on Linux with Python 3.11.8+, or use the Python wheel/source archive attached to this release. The command remains `raft`.
+
+- Disposable boxes delete themselves on stop or expiry. Persistent boxes keep their files by default.
+- `prune --older-than DAYS` previews stopped boxes eligible for deletion. Add `--yes` to apply it.
+- Create boxes from named snapshots and delete snapshots directly.
+- Upload and download directories, with no-overwrite publication and rejection of unsafe links, special files, incomplete streams and source-replacement races.
+- Resize CPU/RAM on resume or fork. Omitted limits are preserved.
+- `raft --version` reports the installed release.
+
+Redeploy the host worker from this release before using disposable creation or retention cleanup. npm installation does not configure hosts or install Python; follow the [setup guide](https://raft.micr.dev/docs/operations).
+
+ARM64 and AMD64 development images, manifests, package inventories and startup reports accompany this release. Verify `SHA256SUMS` before importing the archive for your host architecture.
+
+Both architectures pass native lifecycle, desktop, development-tool, capacity, directory-transfer and full-image recovery checks. Fresh provisioning, image import, firewall ordering and reboot pass on a disposable AMD64 host.
+
+Raft is an independent open-source alternative to boat.dev. Containers share the host kernel. Physical storage capacity, ARM64 host reboot and cross-architecture recovery are outside the verified scope.

package/docs/requirements.mdx

@@ -0,0 +1,47 @@
+---
+title: System requirements
+description: Hardware, operating system, network, and tool requirements for running Raft.
+---
+
+# System requirements
+
+Raft coordinates unprivileged Linux containers across two environments: dedicated Incus workspace hosts, and a controller running the Raft CLI.
+
+## Workspace host requirements
+
+Each workspace host must be a dedicated physical machine or virtual instance:
+
+| Component | Requirement | Notes |
+| :--- | :--- | :--- |
+| **Architecture** | ARM64 or AMD64 | Workspaces run native binaries matching the host CPU architecture. |
+| **Operating system** | Ubuntu 22.04 LTS or 24.04 LTS | The deployer installs Incus 6.0 LTS and nftables bridge isolation rules. |
+| **CPU** | At least 2 CPU cores | Capacity calculations reserve 1 CPU core for the host OS and services (an advisory estimate, not an enforced host reservation). |
+| **RAM** | At least 8 GiB | Sizing calculations reserve the larger of 2 GiB or 10% of host RAM (an advisory estimate, not an enforced host reservation). |
+| **Free disk** | At least 80 GiB on host disk | The deployer provisions a 60 GiB dedicated Btrfs pool (`raft-data`). |
+
+Host CPU and RAM reserves are advisory estimates for `raft limits`, not enforced cgroup locks.
+
+<Callout type="warn" title="Dedicated host requirement">
+Do not deploy Raft on hosts with existing Incus storage pools or shared virtualization workloads. Deployment configures dedicated nftables rules, storage pools, and system services.
+</Callout>
+
+### Host access and permissions
+
+- **SSH access**: SSH access with passwordless `sudo` (`sudo -n true`).
+- **Security model**: Single operator with root access. Deploy only on trusted hardware and networks.
+- **Network connectivity**: Outbound internet for Debian packages, Incus releases, and container images. Inbound SSH from the controller. No public Incus listener or cloud account needed.
+
+## Controller machine requirements
+
+The controller is your local workstation, developer machine, or CI runner:
+
+| Component | Requirement | Notes |
+| :--- | :--- | :--- |
+| **Operating system** | Linux | Controller CLI commands invoke standard Linux utilities. |
+| **Python** | Python 3.11.8 or newer | Required to run the `raft` CLI tool. |
+| **Toolchain** | `git`, `uv`, OpenSSH client (`ssh`), `scp` | `uv` manages the Python environment; OpenSSH provides the transport. |
+| **Network** | Network route to host SSH targets | Batch SSH commands must connect without interactive password prompts. |
+
+## Next step
+
+Proceed to [Installation and setup](./operations.mdx) to install the CLI, configure inventory, provision Incus, and acquire a workspace image.

package/docs/reviews/code-review-2026-10-06.md

@@ -0,0 +1,168 @@
+# Full-code review: 2026-10-06
+
+Reviewed snapshot: `198bb1dfad60630b47a8fe40f4cd69e7d5c60162`.
+Scope: the full CLI, deployment scripts, image build, verification tools, services,
+workflows, packaging and agent skill. Two independent read-only reviews used
+`docs/contract.md` as the specification and the applicable coding instructions as
+standards. Findings below refer to this pinned snapshot, before documentation-site changes.
+
+This is a code review, not a claim that every runtime path passed a new E2E run.
+No host configuration changed during the original review.
+The six distinct findings have since been fixed; see the follow-up verification below.
+
+## Standards
+
+### P1: stopped-state checks happen outside the lifecycle lock
+
+Locations: [raft.py](../../raft.py), snapshot line 661, restore line 669,
+fork line 675 in the reviewed snapshot.
+
+Each command checks the previously fetched box status before acquiring the host
+lifecycle lock. A concurrent resume can start the source before snapshot, restore
+or copy runs. This violates the documented stopped-source requirement and the
+correctness rule that validation and enforcement must agree.
+
+Check the current state inside the same locked transaction as the operation.
+The backup path already follows this approach. Evidence: code inspection of the
+status read, branch and lock boundary; the race was not reproduced on a live host.
+
+### P1: repeat deployment does not apply changed firewall rules
+
+Locations: [deploy/deploy.py](../../deploy/deploy.py), lines 145-146;
+[raft-network.service](../../deploy/raft-network.service), line 9.
+
+Deployment overwrites the firewall script, then calls `systemctl enable --now`.
+The oneshot service has `RemainAfterExit=yes`. Starting an already active service
+does not rerun its script, so updated rules remain unapplied while deployment
+reports that the private bridge is ready. Apply and verify the installed rules
+on redeployment. Evidence: code and unit inspection; no host service was restarted.
+
+### P1: firewall ordering does not gate guest autostart
+
+Location: [raft-network.service](../../deploy/raft-network.service), line 3.
+
+The firewall service runs after Incus. Incus can restore running guests before
+filtering is installed. No dependency gates guest startup on the firewall.
+The existing reboot checks wait for the firewall to become active before probing,
+so they cannot detect exposure during startup. Install persistent filtering before
+guest autostart or explicitly gate startup on it. This is a structural risk found
+by inspection, not a demonstrated boot-time exploit.
+
+### P2: native E2E workflow misses deployment and expiry changes
+
+Location: [images.yml](../../.github/workflows/images.yml), push path filter.
+
+Changes to `deploy/deploy.py`, `deploy/raft-expire.py` and the expiry service/timer
+do not trigger native fresh-host, reboot and TTL checks. Package checks do not
+exercise those host behaviors. Include these sources in the native workflow's
+trigger list. Evidence: comparison of source ownership with the workflow paths.
+
+No separate heuristic refactor was warranted by the review.
+
+## Spec
+
+### P1: stopped-source requirement can be bypassed by concurrent resume
+
+Locations: [raft.py](../../raft.py), snapshot, restore and fork branches.
+
+Contract: “Snapshots, restores and forks require a stopped source for consistent disk contents.”
+
+The stopped check is outside the lifecycle lock. A concurrent resume can invalidate
+it before disk operations begin. Validate stopped state inside the locked operation.
+Evidence: code inspection; no live race experiment.
+
+### P1: redeployment can leave the network contract unenforced
+
+Locations: [deploy/deploy.py](../../deploy/deploy.py) and
+[raft-network.service](../../deploy/raft-network.service).
+
+Contract: “firewall rules reject guest access to host services, cloud metadata, private address ranges.”
+
+`enable --now` does not reapply changed firewall rules when the persistent oneshot
+is already active. A redeployed host can retain obsolete filtering. Reapply and
+verify rules before reporting success. Evidence: code and service inspection.
+
+### P2: clean-image inspection misses non-root SSH credentials
+
+Location: [verify-image.py](../../deploy/verify-image.py), credential check near line 35.
+
+Contract: “The development image omits ... account credentials.”
+
+The inspector rejects `rootfs/root/.ssh/` but accepts a private-key path such as
+a private key beneath a non-root user’s `.ssh` directory. It also skips nonregular archive entries
+before inspecting credential paths. A real temporary tar fixture containing the
+non-root private-key path passed verification and printed `Clean image verified`.
+This proves a gap in the inspector, not that a published image contains credentials.
+Inspect SSH credential paths across user homes and relevant archive entry types.
+
+### P2: an oversized existing owned pool passes deployment validation
+
+Location: [deploy/deploy.py](../../deploy/deploy.py), pool validation near line 108.
+
+Contract: “Btrfs storage is bounded to a 60 GiB pool per host.”
+
+Validation checks the Btrfs driver but not the configured pool size. An existing
+owned pool configured above 60 GiB passes the shown checks. Reject contract drift
+with explicit recovery instructions rather than silently altering storage.
+Evidence: code inspection, not a destructive live pool-resize test.
+
+## Counts
+
+Standards: four findings, with P1 lifecycle consistency and firewall enforcement
+as the highest severity. Spec: four findings, with P1 lifecycle consistency and
+firewall enforcement as the highest severity. The two axes intentionally retain
+overlapping findings rather than combining their counts.
+
+## Documentation-site follow-up
+
+The new site received separate standards and spec follow-up reviews. Three site
+issues were corrected before delivery: bare Markdown links opening raw text,
+a repository workflow link resolving to an absent local route, and missing
+`Vary: Accept` on HTML responses. Canonical document links now begin with `./`,
+source-file links use GitHub, and both negotiated representations set the header.
+
+Verification: production build, strict TypeScript and Oxlint passed. A real
+production-server test checked nine pages, 16 local link targets, search results,
+Markdown exports, JSON downloads, the root redirect and unknown-page 404s.
+Browser checks covered desktop and 390-pixel mobile layouts, sidebar navigation,
+Ctrl+K search and result navigation. Computed body colors were black and white;
+each page had one H1 and browser error inspection was empty. Wide parity tables
+scroll within their container rather than widening the mobile page.
+
+The simplification pass ran in the parent context across reuse, quality and
+efficiency. No behavior-preserving refactor was warranted. No runtime review
+finding above was fixed at that stage, and site checks did not modify
+workspace hosts.
+
+## Runtime-fix follow-up
+
+All six distinct findings are addressed by the follow-up patch. Both review axes
+reported no additional actionable findings after inspecting the fixes and tests.
+
+| Finding | Fix | Verification |
+| --- | --- | --- |
+| Stopped-source race | Ownership and state are checked inside the same locked transaction as snapshot, restore, fork and backup | Real queued snapshot/restore/fork operations reject a source started first under the host lock on two ARM64 hosts |
+| Stale rules on redeploy | Reloadable firewall oneshot explicitly reapplies owned chains transactionally, preserving unrelated chains and the running Incus daemon | Isolated first/repeat application passed; fresh-host CI checks injected stale-rule removal, unrelated-chain retention and unchanged daemon start timestamp |
+| Guest autostart before filtering | Incus requires the firewall and starts after successful installation, including socket activation | Installed dependency verified on two hosts; fresh-host CI tests failed filtering and post-reboot start timestamps |
+| Missing native CI triggers | All `deploy/**` changes trigger the native workflow | Workflow path inspection; the fix push triggers both native architectures and the fresh-host job |
+| Non-root image credentials | Check credential paths and link targets before skipping nonregular entries | 15 real tar cases passed, including generated non-root private keys, symlinks, hardlinks, FIFO entries and clean controls |
+| Oversized owned storage | Reject an existing pool whose configured size differs from `60GiB`, with recovery guidance and no resize | Existing 60 GiB pools pass; fresh-host CI grows a disposable pool to 61 GiB and verifies rejection without resizing |
+
+The extended lifecycle suite passed on two configured ARM64 hosts. Each completed
+all 31 developer-tool checks, six sizing combinations, the deterministic race
+cases, Docker, files, jobs, snapshots, forks, restore, private tunnels, desktop,
+network restrictions and scheduled TTL stop/resume. Each removed its fixtures.
+A cross-host control run also passed portable backup/recovery, snapshot rollback,
+permissions, cancellation and usage checks with a 385,265,470-byte archive.
+Both hosts had zero remaining test boxes afterward. Lint, formatting, compilation
+and release archive/privacy checks passed.
+
+The [fix verification run](https://github.com/Microck/raft/actions/runs/37496577945)
+passed native ARM64 and AMD64 builds, extended lifecycle with daemon restart,
+capacity transitions, full development-image backup/recovery, startup measurements
+and clean image inspection for commit `27b08c143dc1837d9cfb95f3c3a784318879b284`.
+The disposable AMD64 KVM host passed stale-rule removal without an Incus restart,
+failed-firewall rejection for normal and socket startup, real host reboot with
+filtering before Incus, and rejection of a 61 GiB pool without resizing it.
+ARM64 host reboot remains unverified. Package and documentation-site workflows
+also passed. No published release assets or configured image fingerprints changed.