gowalk-cicd 1.0.197 → 1.0.199

package/README.md

@@ -23,6 +23,10 @@ From the root of your app repo:
 npx --yes gowalk-cicd
 ```
 
+To update only backend delivery while preserving mobile tooling and workflows, use
+`npx --yes gowalk-cicd --backend-only`. The lock records the backend release separately;
+see [scoped installation](docs/CONFIGURATION.md).
+
 Writes three core things into your repo:
 
 - `.github/actions/swift-app/` — the vendored composite action (action.yml + scripts)

package/backend-action/action.yml

@@ -306,9 +306,11 @@ runs:
       run: |
         RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-runtime-diagnostics.XXXXXX")"
         echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
+        echo "transport=$RESULT_DIR/transport.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/runtime_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --expected-build-sha "$DIAGNOSTIC_BUILD" \
-          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --output "$RESULT_DIR/result.json"
+          --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --output "$RESULT_DIR/result.json" \
+          --transport-output "$RESULT_DIR/transport.json"
 
     - name: Retain scoped backend runtime result
       if: always() && inputs.operation == 'runtime-diagnostics'
@@ -317,7 +319,9 @@ runs:
         NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: backend-runtime-diagnostics-${{ github.job }}-${{ github.run_attempt }}
-        path: ${{ steps.runtime_diagnostics.outputs.result }}
+        path: |
+          ${{ steps.runtime_diagnostics.outputs.result }}
+          ${{ steps.runtime_diagnostics.outputs.transport }}
         if-no-files-found: error
 
     - name: Read scoped backend network prerequisites

package/backend-action/identity_diagnostics.py

@@ -40,7 +40,7 @@ class ReaderFailure(Exception):
         super().__init__(self.code)
 
 
-def transfer(selector, process, payload, offset, data):
+def transfer(selector, process, payload, offset, data, errors):
     for key, _ in selector.select(0.1):
         if key.fileobj is process.stdin:
             offset += os.write(process.stdin.fileno(), payload[offset:offset + 4096])
@@ -48,23 +48,27 @@ def transfer(selector, process, payload, offset, data):
                 selector.unregister(process.stdin)
                 process.stdin.close()
         else:
-            chunk = os.read(process.stdout.fileno(), 65536)
+            chunk = os.read(key.fileobj.fileno(), 65536)
             if not chunk:
-                selector.unregister(process.stdout)
-            data.extend(chunk)
-            if len(data) > LIMIT:
+                selector.unregister(key.fileobj)
+            (errors if key.fileobj is process.stderr else data).extend(chunk)
+            if len(data) + len(errors) > LIMIT:
                 raise ReaderFailure('output_limit')
     return offset
 
 
-def bounded(argv, *, payload=None, seconds=30, with_status=False):
+def bounded(argv, *, payload=None, seconds=30, with_status=False, with_stderr=False):
     """Bound output, runtime and owned process cleanup without printing stderr."""
     process = subprocess.Popen(argv, stdin=subprocess.PIPE if payload else subprocess.DEVNULL,
-                               stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, start_new_session=True)
-    deadline, data = time.monotonic() + seconds, bytearray()
+                               stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE if with_stderr else subprocess.DEVNULL,
+                               start_new_session=True)
+    deadline, data, errors = time.monotonic() + seconds, bytearray(), bytearray()
     try:
         with selectors.DefaultSelector() as selector:
             selector.register(process.stdout, selectors.EVENT_READ)
+            if with_stderr:
+                selector.register(process.stderr, selectors.EVENT_READ)
             if payload:
                 os.set_blocking(process.stdin.fileno(), False)
                 selector.register(process.stdin, selectors.EVENT_WRITE)
@@ -72,12 +76,14 @@ def bounded(argv, *, payload=None, seconds=30, with_status=False):
             while selector.get_map():
                 if time.monotonic() >= deadline:
                     raise ReaderFailure('command_timeout')
-                offset = transfer(selector, process, payload, offset, data)
+                offset = transfer(selector, process, payload, offset, data, errors)
         try:
             status = process.wait(timeout=max(0.01, deadline - time.monotonic()))
         except subprocess.TimeoutExpired:
             raise ReaderFailure('command_timeout') from None
         if with_status:
+            if with_stderr:
+                return status, bytes(data), bytes(errors)
             return status, bytes(data)
         if status:
             raise ReaderFailure('command_failed')
@@ -90,6 +96,8 @@ def bounded(argv, *, payload=None, seconds=30, with_status=False):
             pass
         process.wait(timeout=5)
         process.stdout.close()
+        if process.stderr:
+            process.stderr.close()
         if process.stdin and not process.stdin.closed:
             process.stdin.close()
 

package/backend-action/runtime_diagnostics.py

@@ -3,27 +3,50 @@ import argparse
 import json
 import re
 import shlex
+import sys
 from pathlib import Path
 
 from identity_diagnostics import ReaderFailure, bounded, retain_result
 from runtime_projection import RuntimeFailure, envelope, scope, validate
 
 
-def local(args):
+def transport_signals(status, raw):
+    """Observe fixed SSH failure labels; private stderr never enters a receipt."""
+    lines = raw.decode('utf-8', errors='replace').splitlines()
+    patterns = {
+        1: [('gate_refused', r'backend_ssh_refused')],
+        127: [('remote_command_unavailable',
+               r'(?:/bin/)?(?:bash|sh): (?:(?:line )?\d+: )?gowalk-backend: (?:command )?not found')],
+        255: [
+            ('authentication_refused', r'[^\r\n]+: Permission denied \([a-z,-]+\)\.'),
+            ('host_key_refused', r'Host key verification failed\.'),
+            ('connection_refused', r'ssh: connect to host [^\r\n ]+ port \d+: Connection refused'),
+            ('connection_timeout', r'ssh: connect to host [^\r\n ]+ port \d+: (?:Connection|Operation) timed out'),
+            ('name_resolution_failed', r'ssh: Could not resolve hostname [^\r\n ]+: [^\r\n]+'),
+        ],
+    }
+    return [name for name, pattern in patterns.get(status, [])
+            if any(re.fullmatch(pattern, line) for line in lines)]
+
+
+def local(args, transport=None):
     scope(args.app, args.service, args.expected_build_sha)
     if (not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9.-]{0,252}', args.host or '')
             or not re.fullmatch(r'[a-z_][a-z0-9_-]{0,31}', args.user)):
         raise RuntimeFailure('invalid_scope')
     command = shlex.join(['gowalk-backend', 'runtime-diagnostics', args.app, args.service, args.expected_build_sha])
     try:
-        status, raw = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
+        status, raw, errors = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
             '-o', 'IdentitiesOnly=yes', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes',
             '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=2',
-            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command], seconds=75, with_status=True)
+            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command],
+            seconds=75, with_status=True, with_stderr=True)
     except ReaderFailure as error:
         raise RuntimeFailure(error.code) from None
     except OSError:
         raise RuntimeFailure('transport_failure') from None
+    if transport is not None:
+        transport.update(exit_status=status, signals=transport_signals(status, errors))
     if status not in (0, 1):
         raise RuntimeFailure('transport_failure')
     if status == 1 and not raw.strip():
@@ -45,14 +68,22 @@ def main():
     parser.add_argument('--host', required=True)
     parser.add_argument('--user', default='root')
     parser.add_argument('--output', required=True)
+    parser.add_argument('--transport-output', help='Separate closed SSH observation receipt')
     args = parser.parse_args()
+    transport = {'schema': 'gowalk-cicd/backend-runtime-transport.v1', 'exit_status': None, 'signals': []}
     try:
-        result = local(args)
+        result = local(args, transport)
     except Exception as error:
         result = envelope(args.app, args.service, args.expected_build_sha,
                           error.code if isinstance(error, RuntimeFailure) else 'unclassified', reader_version=None)
     try:
         retain_result(args.output, result)
+        if args.transport_output:
+            retain_result(args.transport_output, transport)
+            status = 'unknown' if transport['exit_status'] is None else str(transport['exit_status'])
+            print('::notice title=backend_runtime_transport::schema=' + transport['schema']
+                  + ' exit_status=' + status + ' signals=' + (','.join(transport['signals']) or 'none'),
+                  file=sys.stderr)
     except ReaderFailure:
         result = envelope(args.app, args.service, args.expected_build_sha, 'artifact_write_failed', reader_version=None)
     print(json.dumps(result, separators=(',', ':')))

package/bin/cli.mjs

@@ -31,6 +31,7 @@ if (args[0] === 'release') {
   }
 }
 let dryRun = false;
+let backendOnly = false;
 
 for (const arg of args) {
   switch (arg) {
@@ -59,6 +60,7 @@ Options:
   release [ios|android|both]  Prepare a mobile release intent on the task branch
   validate run|check|publish|verify  Run local focused checks or verify their authenticated source receipt
   --dry-run        Print what would happen without writing files
+  --backend-only   Update backend tooling without changing mobile tooling or workflows
   -v, --version    Show version number
   -h, --help       Show this help message
 
@@ -75,6 +77,9 @@ After install:
     case '--dry-run':
       dryRun = true;
       break;
+    case '--backend-only':
+      backendOnly = true;
+      break;
     default:
       console.error(`Unknown option: ${arg}`);
       console.error(`Run with --help for usage.`);
@@ -84,7 +89,7 @@ After install:
 
 const { runInstall } = await import('../src/install.mjs');
 try {
-  await runInstall({ dryRun });
+  await runInstall({ dryRun, backendOnly });
 } catch (error) {
   console.error(JSON.stringify(error.result || {
     schema: 'gowalk-cicd/migration-repair.v1', code: 'installer_unavailable',

package/docs/BACKEND_SSH_GATE.md

@@ -68,7 +68,7 @@ consumer code or an uploaded script. An older/refusing gate has no reader receip
 `runtime_reader_unavailable`; locally synthesized failures carry `reader_version: null`, never host-adoption proof.
 A collector refusal carries its actual `reader_version` and fixed failure code.
 
-The `backend-runtime-diagnostics-<job>-<attempt>` artifact contains only `result.json`, schema
+The `backend-runtime-diagnostics-<job>-<attempt>` artifact contains `result.json`, schema
 `gowalk-cicd/backend-runtime-diagnostics.v1`. Success binds the expected/observed build to the running API's
 `BUILD_SHA`, enumerates at most 32 exact-project containers (including stopped ones), and rechecks their exact
 project/service/working-directory labels. It returns container and image IDs, effective memory/reservation/CPU/PID
@@ -77,6 +77,18 @@ Docker's display precision. CPU samples are Docker's bounded observations, not a
 collector never launches workload, reads logs, executes in containers or inspects a shared database's cgroup.
 Both container identity/configuration and the private profile are rechecked before returning success.
 
+The same artifact also retains `transport.json`, schema `gowalk-cicd/backend-runtime-transport.v1`.
+Its fixed fields also appear in the brace-free `backend_runtime_transport` notice. It reports the SSH child's
+`exit_status` (null when no complete exit was observed) and fixed `signals`: `gate_refused`,
+`remote_command_unavailable`, `authentication_refused`, `host_key_refused`, `connection_refused`,
+`connection_timeout` or `name_resolution_failed`. Unknown text yields no signal; stderr and remote
+command output never enter this receipt. The original `result.json` schema and failure codes remain
+unchanged. These observations explain a refused read, never attest host reader installation or authorize
+a retry or transport bypass. Exit 127 without the exact command-not-found observation does not prove a
+missing reader; a gate refusal does not identify its policy or ownership cause. Normal backend deployment
+does not install the trusted reader, and an updated workflow client alone cannot repair an unavailable
+host command. Install the published host runtime through the procedure below.
+
 `database.mode: host_profile` with `binding_matches_profile: true` proves this app's root-owned profile supplied
 the API's current private `DATABASE_URL`. `removed_services` describes that profile's applied removals; a remaining
 removed service refuses. `app_service` means the runtime connection names another reported service.

package/docs/CONFIGURATION.md

@@ -5,6 +5,23 @@ extracts supported settings from existing workflows into `.gowalk-cicd.yml` and
 renders the managed workflows in the same change. Later upgrades read that file.
 The installer does this locally; app CI gains no configuration job or preflight.
 
+For backend-only work in a repository whose mobile tooling must stay unchanged, run
+`npx --yes gowalk-cicd@<version> --backend-only` (also accepts `--dry-run`). It updates only
+`.github/actions/backend-app/`, `deploy-backend.yml` and their configuration/lock state.
+Mobile actions, workflows, validation workflows and release intents retain their exact bytes.
+Existing backend settings and workflow overrides are preserved by the normal migration rules.
+The separate backend deploy still follows its existing protected merge and push trigger.
+
+For this scoped installation, `.gowalk-cicd.lock.json` records `backend_package`; `package`
+continues to name the last full installation. Verify `backend_package` (or `package` after a
+full install), the backend action's `.daemux-version`, the published package integrity and the
+installed backend bytes. A scoped backend upgrade makes no claim that mobile tooling is current.
+The next full installation updates all tooling and removes the scoped version override.
+Repositories with existing managed mobile workflows require their existing `.gowalk-cicd.yml`
+configuration before scoped installation; it never partially migrates an unconfigured mobile
+installation. An interrupted full installation also refuses a backend-only retry, preserving
+its journal instead of applying mobile writes outside the requested scope.
+
 ```yaml
 schema: 1
 mobile:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.197",
+  "version": "1.0.199",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/config/transaction.mjs

@@ -44,7 +44,7 @@ function apply(root, writes, dryRun) {
   if (!dryRun) unlinkSync(join(root, JOURNAL));
 }
 
-export function recoverWorkflows(root, dryRun) {
+export function recoverWorkflows(root, dryRun, { backendOnly = false } = {}) {
   if (!existsSync(join(root, JOURNAL))) return false;
   let journal;
   try { journal = JSON.parse(readFileSync(join(root, JOURNAL), 'utf8')); }
@@ -52,14 +52,18 @@ export function recoverWorkflows(root, dryRun) {
   if (journal.schema !== 1 || !Array.isArray(journal.writes)) {
     throw new MigrationRepair('invalid_pending_migration', JOURNAL);
   }
+  if (backendOnly && journal.scope !== 'backend') {
+    throw new MigrationRepair('pending_migration_scope_mismatch', JOURNAL);
+  }
   apply(root, journal.writes, dryRun);
   return true;
 }
 
-export function writeWorkflows(root, writes, dryRun) {
+export function writeWorkflows(root, writes, dryRun, { backendOnly = false } = {}) {
   if (!writes.length) return;
   const planned = writes.map(write => ({ ...write, before: current(join(root, write.file)) }));
   for (const write of planned) validate(root, write);
-  if (!dryRun) atomicWrite(join(root, JOURNAL), JSON.stringify({ schema: 1, writes: planned }));
+  if (!dryRun) atomicWrite(join(root, JOURNAL), JSON.stringify({ schema: 1,
+    ...(backendOnly ? { scope: 'backend' } : {}), writes: planned }));
   apply(root, planned, dryRun);
 }

package/src/config/workflows.mjs

@@ -80,9 +80,14 @@ function upgradeWorkflow(root, file, templateDir, state) {
   return { file: `.github/workflows/${file}`, content: output };
 }
 
-export function planWorkflows(root, templateDir, files, version) {
+export function planWorkflows(root, templateDir, files, version, { backendOnly = false } = {}) {
   const state = configState(root);
-  const selected = [...new Set([...files, ...Object.keys(state.config.workflows)])];
+  if (backendOnly && state.migrating && MANAGED.some(file => file !== 'deploy-backend.yml'
+      && load(root, `.github/workflows/${file}`) !== null)) {
+    throw new MigrationRepair('backend_scope_requires_existing_config', CONFIG);
+  }
+  const selected = backendOnly ? ['deploy-backend.yml']
+    : [...new Set([...files, ...Object.keys(state.config.workflows)])];
   for (const file of selected) {
     if (!MANAGED.includes(file)) throw new MigrationRepair('unknown_managed_workflow', CONFIG);
   }
@@ -113,8 +118,12 @@ export function planWorkflows(root, templateDir, files, version) {
   for (const [file, entry] of Object.entries(workflows)) {
     for (const change of entry.overrides) assertReferences(change.value, file, change.path);
   }
-  writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
-  state.lock.package = version;
+  if (backendOnly) state.lock.backend_package = version;
+  else {
+    writes.push(...planValidation(root, [...selected, WARM, RECOVERY]));
+    state.lock.package = version;
+    delete state.lock.backend_package;
+  }
   const config = state.text && equal(readYaml(state.text, CONFIG).value, state.config)
     ? state.text
     : '# App-owned settings. Edit this file, then run gowalk-cicd to render workflows.\n' + encode(state.config);

package/src/install.mjs

@@ -23,6 +23,7 @@ import { dirname } from 'node:path';
 import { planWorkflows, writeWorkflows } from './config/workflows.mjs';
 import { recoverWorkflows } from './config/transaction.mjs';
 import { backendLayout } from './backend-layout.mjs';
+import { MigrationRepair } from './config/yaml.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -201,32 +202,38 @@ function printSummary() {
   console.log('  npx --yes gowalk-cicd');
 }
 
-export async function runInstall({ dryRun = false } = {}) {
+export async function runInstall({ dryRun = false, backendOnly = false } = {}) {
   const repoRoot = findRepoRoot(process.cwd());
   console.log(`Installing gowalk-cicd into ${repoRoot}${dryRun ? ' (dry-run)' : ''}`);
   console.log('');
-  if (recoverWorkflows(repoRoot, dryRun) && dryRun) return;
+  if (recoverWorkflows(repoRoot, dryRun, { backendOnly }) && dryRun) return;
 
   const layout = backendLayout(repoRoot);
+  if (backendOnly && !layout && !existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL))
+      && !existsSync(join(repoRoot, '.github/workflows/deploy-backend.yml'))) {
+    throw new MigrationRepair('backend_layout_missing', '.github/workflows/deploy-backend.yml');
+  }
   // deploy-web.yml is no longer added; an existing one is upgraded, or removed
   // when it is still the unmodified generated file (planWorkflows).
-  const files = ['deploy.yml', 'mobile-candidate.yml'];
-  if (layout || existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL))) files.push('deploy-backend.yml');
+  const files = backendOnly ? ['deploy-backend.yml'] : ['deploy.yml', 'mobile-candidate.yml'];
+  if (!backendOnly && (layout || existsSync(join(repoRoot, BACKEND_ACTION_DEST_REL)))) files.push('deploy-backend.yml');
   for (const file of ['deploy-web.yml', 'deploy-backend.yml']) {
-    if (existsSync(join(repoRoot, '.github/workflows', file)) && !files.includes(file)) files.push(file);
+    if (!backendOnly && existsSync(join(repoRoot, '.github/workflows', file)) && !files.includes(file)) files.push(file);
   }
   const version = String(JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version);
-  const writes = planWorkflows(repoRoot, join(PACKAGE_DIR, 'templates'), files, version);
+  const writes = planWorkflows(repoRoot, join(PACKAGE_DIR, 'templates'), files, version, { backendOnly });
   const workflows = workflowText(repoRoot, writes);
 
-  copyAction(ACTION_SRC, ACTION_DEST_REL, repoRoot, dryRun, workflows);
-  copyAction(ANDROID_ACTION_SRC, ANDROID_ACTION_DEST_REL, repoRoot, dryRun, workflows);
-  writeVersionMarkers(repoRoot, dryRun);
+  if (!backendOnly) {
+    copyAction(ACTION_SRC, ACTION_DEST_REL, repoRoot, dryRun, workflows);
+    copyAction(ANDROID_ACTION_SRC, ANDROID_ACTION_DEST_REL, repoRoot, dryRun, workflows);
+    writeVersionMarkers(repoRoot, dryRun);
+  }
   if (files.includes('deploy-backend.yml')) {
     copyAction(BACKEND_ACTION_SRC, BACKEND_ACTION_DEST_REL, repoRoot, dryRun, workflows);
     if (!dryRun) writeFileSync(join(repoRoot, BACKEND_VERSION_MARKER_REL), version);
   }
-  writeWorkflows(repoRoot, writes, dryRun);
+  writeWorkflows(repoRoot, writes, dryRun, { backendOnly });
 
   const gi = checkGitignore(repoRoot);
   printGitignoreWarning(gi);
@@ -237,5 +244,7 @@ export async function runInstall({ dryRun = false } = {}) {
     return;
   }
 
-  printSummary();
+  if (backendOnly) {
+    console.log('\nDone. Backend tooling updated; mobile files and release intents are unchanged.');
+  } else printSummary();
 }