@ours.network/install 1.2.1-nightly.4 → 1.2.1-nightly.41

package/ROOTLESS_PODMAN_VALIDATION.md

@@ -0,0 +1,210 @@
+# Rootless Podman integration validation
+
+Status: implementation under review; **not a qualified server-support release**.
+Validation date: 2026-09-25. No production deployment, migration, restart or merge.
+
+## Scope and source baseline
+
+The supplied `rootless-podman-support.zip` was inspected as design/evidence,
+not executable authority. SHA-256:
+`0eafc865566be71bcb87d432a98384da47e6d153e4395d9cfe721b4def168e96`.
+It contains six substantive Markdown documents and no implementation patches.
+Its historical ARM VM observations do not establish current Linux amd64 support.
+
+All referenced repositories were fetched into isolated checkouts at these
+`prerelease` commits. SDK, CLI and daemon share the SDK repository; the MCP
+repository also supplies Codex and Claude Code integrations.
+
+| Repository | Commit |
+| --- | --- |
+| ours-network | a9ae420d2878a304911e94d53d0cdd2cff06f299 |
+| ours-sdk | 737e1028cabadcbb8837548923c7a92b49e9e575 |
+| ours-cowork | 2d2ff8979756678068b8f6b85c619f6d811010ff |
+| ours-messenger-server | 5e2ca2be5789a5300fcbed08a0dd26b9b59780ef |
+| ours-tg-connector | 21f4bf92b52e1d61261987f298bcc76248cddb78 |
+| ours-fleet | 717f6d8a09e6173b9b8a017fc5efb08d71927524 |
+| ours-mcp | ce6e3e0298b83aec0257c4ae3773d785d8b38889 |
+
+Runtime launch/build/maintenance and gateway packaging belong to ours-network;
+no source changes were required in the other repositories. Host Fleet and harness
+integrations continue using their existing client paths. Their unrelated feature
+suites are not implied by the installer results below.
+
+## Corrections established by testing
+
+- This prerelease already checks authenticated gateway readiness during install.
+  The added lifecycle check covers full starts and preserves intentionally stopped
+  applications during partial runtime restoration.
+- Podman 5.4.2 with Compose 5.5.1 exposes the whole named volume instead of the
+  requested subpath. Its vendor restart unit also lacks `should-start-on-boot`.
+  The new preflight rejects this combination rather than weakening isolation.
+- Local and API Podman must select the same rootless store. Compose is passed an
+  explicit Unix socket; native builds use the retained root/runroot/driver.
+  Both report the same retained UID/GID mapping fingerprint.
+- Podman image IDs need Docker-compatible `sha256:` normalization at the adapter
+  boundary. Missing-object detection must not reinterpret inspect error 125 as
+  permission to create or replace an object.
+- Compose excludes maintenance profiles from ordinary configuration output and
+  implicitly builds absent administration images. Native build resolution enables
+  all profiles and builds the selected missing administration image first.
+- Fresh schema-2 installations omit embedded `networkMcp`; the shared rebuild
+  validator previously required it. Validation now accepts absence and still
+  rejects malformed or conflicting embedded configuration, while retaining
+  standalone-profile, credential, provenance and strict legacy conversion checks.
+- Gateway COPY destinations must remain accessible to UID 101 on both engines.
+  Runtime DNS comes from validated container nameservers, retaining nginx variables.
+
+## Observed environment and results
+
+Native Debian 13 Linux amd64, unprivileged UID 1000, subordinate UID/GID ranges,
+SELinux disabled, standalone Docker Compose 5.5.1. Podman 6.1.2 was built from
+upstream tag commit `04f3aa430e6df81bea059978bc5bafbc846ba3e7` with systemd and
+seccomp support, using netavark/aardvark-dns 2.1.0. A separate task store and API
+socket isolated all Podman tests from the installed 5.4.2 default backend.
+
+- Behavioral preflight: PASS on 6.1.2, including UID-1000 private storage,
+  volume subpath isolation, DNS, Compose reset/wait/JSON status.
+- Native synthetic secret/cache build: PASS; secret absent from command arguments,
+  build output, image inspect/history and final filesystem.
+- Production runtime: native build of the shipped exact package/integrity policy,
+  runtime metadata and gateway artifact capability qualification PASS.
+- Development runtime: native build from all exact prerelease commits above,
+  including private SDK/submodule acquisition through an environment build secret,
+  native compilation and gateway capability qualification PASS. The source-built
+  five-service lifecycle and authenticated gateway also PASS.
+- Real runtime: prepare, access-init/access-issue, test Human identity, all five
+  services, authenticated gateway readiness, stop/status/start PASS.
+- Maintenance: server backup/restore and Cowork backup/reset/restore PASS; all
+  services subsequently restarted with authenticated gateway readiness.
+- Rebuild: the initial fresh-layout validator defect was reproduced and fixed;
+  retained transition recovery PASS after rebuilding the maintenance helper. A
+  second complete rebuild using final code and the real installation lock PASS,
+  including offline state validation and authenticated gateway readiness.
+- Gateway runtime: Docker 2/2 and Podman 2/2 PASS for root/nested paths,
+  authentication, WebSockets and changed backend IPs. Combined Podman native
+  capability/build-secret and gateway tests: 4/4 PASS.
+- Installer suite: 756 passed, 0 failed, 11 opt-in tests skipped; subsequent
+  adapter-only addition separately passed (13 adapter tests).
+- Independent Critic reruns confirmed the behavioral/native-secret tests and
+  adapter regressions. Final review is recorded separately from these observations.
+
+The runtime harness called actual installer effects against owned resources.
+It deliberately did not claim a complete public install: the isolated custom
+store/socket cannot satisfy standard vendor boot-unit selection, and the public
+preflight rejects that configuration. A harness backup label collision was
+correctly rejected; separate per-domain labels were used afterward.
+
+## Reproduction and remaining release gates
+
+From `packages/installer`, with installed package dependencies:
+
+```sh
+umask 022
+node --test
+OURS_TEST_DOCKER=1 node --test test/gateway-docker.test.mjs
+PODMAN_COMPOSE_PROVIDER=/absolute/path/to/docker-compose \
+  OURS_TEST_PODMAN=1 node --test test/podman-integration.test.mjs test/gateway-docker.test.mjs
+```
+
+The gateway fixture covers root and nested base paths, discovery, service routing,
+forged-host denial, Telegram authentication, WebSocket upgrade and backend IP
+replacement without restarting nginx. Test projects and their resources are
+uniquely named and cleaned up. The Podman tests require a functional matching API
+socket; `OURS_PODMAN_SOCKET` can select an isolated harness socket.
+
+Before advertising a supported engine/provider pair, run the full public installer
+and update/rebuild/legacy-conversion matrix on a disposable native Linux amd64
+host with SELinux Enforcing, standard vendor user units, logout/linger, reboot,
+unexpected exit and explicit-stop behavior. Include Docker parity for the full
+maintenance matrix. This shared host is not a safe reboot/SELinux test target.
+No fallback to privileged containers, whole-volume service mounts, host chown,
+keep-id, or globally disabled SELinux is permitted.
+
+### Disposable VM handoff
+
+Provision a dedicated x86_64 VM (at least 4 vCPU, 8 GiB RAM, 40 GiB free disk)
+whose distribution supplies Podman 6.1.2, compatible netavark/aardvark, subordinate
+UID/GID support and vendor `podman-restart.service` with
+`--filter should-start-on-boot=true`. Use an unprivileged test account, cgroup v2,
+standard HOME/XDG paths, SELinux **Enforcing**, Node.js 22+, npm, Python 3.9+
+with `os.pidfd_open`/`signal.pidfd_send_signal` support, and standalone
+Docker Compose 5.5.1. The Podman pass must have no Docker CLI/daemon dependency.
+The VM owner must explicitly authorize reboots and terminate all sessions for the
+logout test. These commands are for that disposable VM, not the shared host.
+
+After checking out this PR and preparing installer assets/dependencies, run as the
+test user (administrator provisions subordinate ranges and linger beforehand):
+
+```sh
+uname -m                              # x86_64
+getenforce                           # Enforcing
+podman version                       # native client 6.1.2
+export PODMAN_COMPOSE_PROVIDER=/absolute/path/to/docker-compose
+unset OURS_PODMAN_SOCKET DOCKER_HOST DOCKER_CONTEXT CONTAINER_HOST CONTAINER_CONNECTION
+unset CONTAINERS_CONF CONTAINERS_STORAGE_CONF PODMAN_USERNS
+systemctl --user enable --now podman.socket
+systemctl --user enable podman-restart.service
+systemctl --user show podman-restart.service --property=ExecStart
+loginctl show-user "$(id -u)" --property=Linger  # yes
+export PODMAN_TEST_ROOT="$HOME/ours-podman-qualification"
+node install.mjs server install --mode docker --container-engine podman \
+  --state-dir "$PODMAN_TEST_ROOT" --identity-name RootlessQualification
+node install.mjs server status --state-dir "$PODMAN_TEST_ROOT"
+node install.mjs server backup server before-rebuild --state-dir "$PODMAN_TEST_ROOT"
+node install.mjs server rebuild --state-dir "$PODMAN_TEST_ROOT"
+node install.mjs server restore server before-rebuild --state-dir "$PODMAN_TEST_ROOT"
+```
+
+Record all five healthy services and authenticated gateway requests. From an
+external controller, end **all** test-user sessions, wait, reconnect, and repeat
+status/authenticated checks. Then reboot the VM and repeat the same checks before
+running any explicit start command. Capture relevant user-unit journal and
+SELinux AVC evidence; no denial should be bypassed by changing enforcement.
+
+Next explicitly stop the installation, verify empty running status, reboot, and
+verify it remains stopped. Only then start explicitly and verify all services.
+For unexpected-exit recovery, select the exact project from its retained record
+and terminate only its verified container-init host process through a PID handle,
+then verify automatic recovery and retained identity/credentials. Do not use
+`podman kill` for this case: an explicit engine stop suppresses restart policy.
+The following refuses a PID whose cgroup does not identify the selected container:
+
+```sh
+node install.mjs server stop --state-dir "$PODMAN_TEST_ROOT"
+node install.mjs server status --state-dir "$PODMAN_TEST_ROOT"  # no running services
+# Disposable-VM controller reboots here; reconnect and repeat status before start.
+node install.mjs server start --state-dir "$PODMAN_TEST_ROOT"
+PODMAN_TEST_PROJECT=$(node -e 'console.log(require(process.argv[1]).project)' "$PODMAN_TEST_ROOT/installation.json")
+podman inspect --format '{{.State.StartedAt}} {{.RestartCount}}' "${PODMAN_TEST_PROJECT}-daemon-1"
+python3 - "$PODMAN_TEST_PROJECT" <<'PYTHON'
+import json, subprocess, sys
+project = sys.argv[1]
+container = json.loads(subprocess.check_output(['podman', 'inspect', project+'-daemon-1']))[0]
+assert container['Config']['Labels']['com.docker.compose.project'] == project
+assert container['State']['Running'] and container['State']['Pid'] > 1
+script = """
+import os, signal, sys
+pid, cid = int(sys.argv[1]), sys.argv[2]
+fd = os.pidfd_open(pid)
+try:
+    assert cid in open('/proc/'+str(pid)+'/cgroup').read(), 'Container identity mismatch'
+    assert os.stat('/proc/'+str(pid)).st_uid == 1000, 'Unexpected runtime owner'
+    signal.pidfd_send_signal(fd, signal.SIGKILL)
+finally:
+    os.close(fd)
+"""
+subprocess.run(['podman','unshare','python3','-c',script,str(container['State']['Pid']),container['Id']],check=True)
+PYTHON
+# Wait for recovery; assert changed StartedAt, increased RestartCount and health.
+podman inspect --format '{{.State.StartedAt}} {{.RestartCount}} {{.State.Health.Status}}' "${PODMAN_TEST_PROJECT}-daemon-1"
+# Verify retained identities and authenticated gateway as well.
+node install.mjs server status --state-dir "$PODMAN_TEST_ROOT"
+```
+
+Still required: repeat component backup/reset/restore for daemon, Telegram,
+Cowork and messenger; source update and interrupted retry; fresh schema-1 legacy
+conversion fixtures; foreign/malformed volume refusal; and the equivalent full
+Docker maintenance matrix. These require owned fixture data and before/after
+identity, credential, provenance and mount-boundary assertions; a command exit
+code alone is insufficient. The existing unit conversion tests are not a claim
+that this real-engine legacy fixture matrix has run.

package/assets/Dockerfile

@@ -6,8 +6,8 @@ WORKDIR /opt/ours
 # The host selection is private (0600); this non-secret image policy must be
 # readable by arbitrary runtime UIDs while remaining root-owned and non-writable.
 COPY --chmod=644 sources.json /opt/ours/sources.json
-COPY scripts/build/*.mjs /build-scripts/
-COPY scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs scripts/maintenance/release-graph.mjs /maintenance/
+COPY --chmod=644 scripts/build/*.mjs /build-scripts/
+COPY --chmod=644 scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs scripts/maintenance/release-graph.mjs /maintenance/
 RUN --mount=type=secret,id=github_token --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked node /build-scripts/build.mjs
 # Testing delivery: npm resolves transitive versions afresh; repeat builds may differ.
 # build.mjs creates package.json once from the sources.json selections.
@@ -18,20 +18,22 @@ RUN node /build-scripts/record-build.mjs
 # must be able to read it. Protected state/host copies retain private ownership.
 RUN chmod 755 /opt/ours /opt/ours/docker /opt/ours/docker/vendor && chmod 644 package.json package-lock.json dependency-tree.json build-context.json docker/vendor/*.tgz
 LABEL network.ours.build-context="1"
-COPY scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs scripts/maintenance/release-graph.mjs /opt/ours/maintenance/
-COPY scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-common.mjs
-COPY scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
-COPY scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
-COPY scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
-COPY scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
-COPY scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
-COPY scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
-COPY scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs /opt/ours/docker/
+COPY --chmod=644 scripts/maintenance/build-context.mjs scripts/maintenance/provenance-compare.mjs scripts/maintenance/release-graph.mjs /opt/ours/maintenance/
+COPY --chmod=644 scripts/runtime/runtime-common.mjs /opt/ours/docker/runtime-common.mjs
+COPY --chmod=644 scripts/runtime/check-client.mjs /opt/ours/docker/check-client.mjs
+COPY --chmod=644 scripts/runtime/check-start.mjs /opt/ours/docker/check-start.mjs
+COPY --chmod=644 scripts/runtime/client-setup.mjs /opt/ours/docker/client-setup.mjs
+COPY --chmod=644 scripts/runtime/diagnostics.mjs /opt/ours/docker/diagnostics.mjs
+COPY --chmod=644 scripts/runtime/legacy-import.mjs /opt/ours/docker/legacy-import.mjs
+COPY --chmod=644 scripts/runtime/entrypoint.sh /opt/ours/docker/entrypoint.sh
+COPY --chmod=644 scripts/runtime/healthcheck.mjs /opt/ours/docker/healthcheck.mjs
+COPY --chmod=644 scripts/runtime/start-telegram.sh scripts/runtime/health-telegram.sh scripts/runtime/start-cowork.sh scripts/runtime/health-cowork.sh scripts/runtime/start-messenger.sh scripts/runtime/health-messenger.mjs scripts/runtime/notifications-gateway.mjs scripts/runtime/supervise.mjs scripts/runtime/recover.mjs scripts/runtime/dependency-ready.mjs /opt/ours/docker/
+RUN chmod 755 /opt/ours/maintenance /opt/ours/docker
 FROM node:24 AS maintenance
 LABEL network.ours.build-context="1"
 WORKDIR /opt/ours
 COPY --from=build /opt/ours /opt/ours
-COPY scripts/maintenance/*.mjs /opt/ours/docker/
+COPY --chmod=644 scripts/maintenance/*.mjs /opt/ours/docker/
 COPY --chmod=644 scripts/maintenance/package.json /opt/ours/docker/package.json
 RUN --mount=type=cache,id=ours-dist-2-npm,target=/root/.npm,sharing=locked npm install --prefix /opt/ours/docker --omit=dev --ignore-scripts --no-audit --no-fund
 USER 1000:1000

package/assets/Dockerfile.gateway

@@ -0,0 +1,5 @@
+FROM nginx:1.28-alpine@sha256:a8b39bd9cf0f83869a2162827a0caf6137ddf759d50a171451b335cecc87d236
+COPY --chmod=644 nginx.conf /etc/nginx/ours.conf.template
+COPY --chmod=644 gateway-entrypoint.sh /gateway-entrypoint.sh
+USER 101:101
+ENTRYPOINT ["/bin/sh", "/gateway-entrypoint.sh"]

package/assets/docker-compose.yaml

@@ -83,6 +83,7 @@ services:
 
   daemon:
     <<: *runtime
+    restart: unless-stopped
     environment: *owner-environment
     volumes:
       - {type: volume, source: server-storage, target: /var/lib/ours, volume: {nocopy: true, subpath: state/daemon}}
@@ -107,6 +108,7 @@ services:
 
   telegram:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-telegram.sh]
     environment:
       HOME: /tmp
@@ -129,6 +131,7 @@ services:
 
   cowork:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-cowork.sh]
     environment:
       HOME: /tmp
@@ -153,6 +156,7 @@ services:
 
   messenger:
     <<: *runtime
+    restart: unless-stopped
     entrypoint: [/bin/sh, -e, /opt/ours/docker/start-messenger.sh]
     environment:
       HOME: /tmp
@@ -164,8 +168,11 @@ services:
       OURS_MESSENGER_PORT: "8420"
       OURS_MESSENGER_PUBLIC_ORIGIN: "http://127.0.0.1:${OURS_MESSENGER_PORT:-8420}"
       OURS_MESSENGER_STATE_DIR: /var/lib/ours-messenger
+      # Started beside Messenger when the runtime ships @ours.network/notifications.
+      OURS_NOTIFICATIONS_CONFIG: /var/lib/ours-notifications/config.json
     volumes:
       - {type: volume, source: server-storage, target: /var/lib/ours-messenger, volume: {nocopy: true, subpath: state/messenger}}
+      - {type: volume, source: server-storage, target: /var/lib/ours-notifications, volume: {nocopy: true, subpath: state/notifications}}
       - {type: volume, source: server-storage, target: /credentials/messenger, read_only: true, volume: {nocopy: true, subpath: state/credentials/messenger}}
     ports:
       - {target: 8420, published: "${OURS_MESSENGER_PORT:-8420}", host_ip: 127.0.0.1}
@@ -215,7 +222,7 @@ services:
       OURS_STATE_ROOT: /storage
       OURS_LIVE_ROOT: "${OURS_LIVE_ROOT:-/storage/state}"
       OURS_BUILD_ROOT: /opt/ours
-      OURS_CLI_PATH: /opt/ours/node_modules/.bin/ours
+      OURS_DAEMON_BIN_DIR: /opt/ours/node_modules/.bin
       OURS_DAEMON_CONFIG: /var/lib/ours/config.json
       OURS_COWORK_CLI_PATH: /opt/ours/node_modules/.bin/ours-cowork
       OURS_COWORK_CONFIG: /var/lib/ours-cowork/config.json

package/assets/fleet-settings.example.json

@@ -0,0 +1,48 @@
+{
+  "subscriptions": [
+    "codex"
+  ],
+  "assignmentStrategy": "one-model",
+  "models": {
+    "development": {
+      "harness": "codex",
+      "session": "acp",
+      "model": "gpt-6-astra",
+      "efforts": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max",
+        "ultra"
+      ]
+    },
+    "review": {
+      "harness": "codex",
+      "session": "acp",
+      "model": "gpt-6-astra",
+      "efforts": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max",
+        "ultra"
+      ]
+    },
+    "coordination": {
+      "harness": "codex",
+      "session": "acp",
+      "model": "gpt-6-astra",
+      "efforts": [
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max",
+        "ultra"
+      ]
+    }
+  },
+  "reasoning": "balanced"
+}

package/assets/gateway-entrypoint.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+set -eu
+# Replace only our resolver marker. Never expand nginx's $variables.
+resolvers=$(awk '
+function ipv4(s, a,n,i) {
+ n=split(s,a,"."); if(n!=4)return 0;
+ for(i=1;i<=n;i++) if(a[i]!~/^[0-9]+$/ || length(a[i])>3 || a[i]+0>255 || (length(a[i])>1 && substr(a[i],1,1)=="0"))return 0;
+ return 1
+}
+function ipv6(s, a,n,i,count,copy,compressed) {
+ if(s!~/:/ || s~/[^0-9a-fA-F:.]/ || s~/:::/)return 0;
+ copy=s; compressed=gsub(/::/,"X",copy); if(compressed>1)return 0;
+ if(!compressed && (s~/^:/ || s~/:$/))return 0;
+ n=split(s,a,":"); count=0;
+ for(i=1;i<=n;i++) {
+  if(a[i]=="")continue;
+  if(a[i]~/\./) {if(i!=n || !ipv4(a[i]))return 0; count+=2}
+  else {if(a[i]!~/^[0-9a-fA-F]+$/ || length(a[i])>4)return 0; count++}
+ }
+ return compressed ? count<8 : count==8
+}
+$1=="nameserver" {
+ if(ipv4($2))address=$2;
+ else if(ipv6($2))address="[" $2 "]";
+ else next;
+ if(!seen[address]++) {printf "%s%s",sep,address; sep=" "}
+}
+' "${OURS_RESOLV_CONF:-/etc/resolv.conf}")
+if [ -z "$resolvers" ]; then echo 'Gateway: no valid runtime DNS nameserver' >&2; exit 1; fi
+umask 077
+config=$(mktemp /tmp/ours-nginx.XXXXXX)
+trap 'rm -f "$config"' EXIT HUP INT TERM
+sed "s/@@OURS_RESOLVERS@@/$resolvers/g" "${OURS_NGINX_TEMPLATE:-/etc/nginx/ours.conf.template}" > "$config"
+nginx -t -c "$config"
+# nginx opens the config before the shell exits; exec leaves this file in tmpfs.
+trap - EXIT HUP INT TERM
+exec nginx -c "$config" -g 'daemon off;'