gowalk-cicd 1.0.210 → 1.0.211

package/README.md

@@ -1395,6 +1395,9 @@ Backend Deploy also offers `operation: network-diagnostics`, with an exact `diag
 It reports the owned bridge/IPAM, observed pool conflicts, UDP 500/4500 ownership, bound host identity and
 kernel/firewall facts in a closed v3 artifact for IPv4 and v4 for IPv6. The IPv6 result also distinguishes
 host and owned-gateway default-route and forwarding observations; actual external connectivity stays unverified.
+Its artifact also retains a separate `transport.json` with the SSH exit status and fixed failure signals,
+including an observed gate refusal, without private transport output. These observations do not establish the
+installed host reader or the reason its gate refused; the network result and refusal retain their existing meaning.
 The allocator stays retired; a completed read is never
 deployment, port reservation, globally unused address space or tunnel proof. Effective firewall ingress and
 unobserved capabilities remain unverified. The [trusted-host procedure](docs/BACKEND_SSH_GATE.md#owned-bridge-and-vpn-prerequisite-readback)

package/backend-action/action.yml

@@ -341,11 +341,12 @@ runs:
       run: |
         RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-network-diagnostics.XXXXXX")"
         echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
+        echo "transport=$RESULT_DIR/transport.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/network_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --expected-build-sha "$DIAGNOSTIC_BUILD" \
           --network "$DIAGNOSTIC_NETWORK" --pool "$DIAGNOSTIC_POOL" --vpn-service "$DIAGNOSTIC_VPN_SERVICE" \
           --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --provider "$DIAGNOSTIC_PROVIDER" \
-          --output "$RESULT_DIR/result.json"
+          --output "$RESULT_DIR/result.json" --transport-output "$RESULT_DIR/transport.json"
 
     - name: Retain scoped backend network result
       if: always() && inputs.operation == 'network-diagnostics'
@@ -354,7 +355,9 @@ runs:
         NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: backend-network-diagnostics-${{ github.job }}-${{ github.run_attempt }}
-        path: ${{ steps.network_diagnostics.outputs.result }}
+        path: |
+          ${{ steps.network_diagnostics.outputs.result }}
+          ${{ steps.network_diagnostics.outputs.transport }}
         if-no-files-found: error
 
     - name: Cleanup key

package/backend-action/network_diagnostics.py

@@ -3,13 +3,15 @@ import argparse
 import json
 import re
 import shlex
+import sys
 from pathlib import Path
 
 from identity_diagnostics import ReaderFailure, bounded, retain_result
 from network_projection import NetworkFailure, envelope, scope, validate
+from runtime_diagnostics import transport_signals
 
 
-def local(args):
+def local(args, transport=None):
     fields = (args.app, args.service, args.expected_build_sha, args.network, args.pool,
               args.vpn_service, args.host, args.provider)
     scope(*fields)
@@ -17,14 +19,17 @@ def local(args):
         raise NetworkFailure('invalid_scope')
     command = shlex.join(['gowalk-backend', 'network-diagnostics', *fields])
     try:
-        status, raw = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
+        status, raw, errors = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
             '-o', 'IdentitiesOnly=yes', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes',
             '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=2',
-            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command], seconds=120, with_status=True)
+            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command],
+            seconds=120, with_status=True, with_stderr=True)
     except ReaderFailure as error:
         raise NetworkFailure(error.code) from None
     except OSError:
         raise NetworkFailure('transport_failure') from None
+    if transport is not None:
+        transport.update(exit_status=status, signals=transport_signals(status, errors))
     if status not in (0, 1):
         raise NetworkFailure('transport_failure')
     if status == 1 and not raw.strip():
@@ -45,16 +50,24 @@ def main():
     for name, default in [('service', 'api'), ('network', 'default'), ('vpn-service', 'vpn'),
                           ('provider', 'none'), ('user', 'root')]:
         parser.add_argument('--' + name, default=default)
+    parser.add_argument('--transport-output', help='Separate closed SSH observation receipt')
     args = parser.parse_args()
     fields = (args.app, args.service, args.expected_build_sha, args.network, args.pool,
               args.vpn_service, args.host, args.provider)
+    transport = {'schema': 'gowalk-cicd/backend-network-transport.v1', 'exit_status': None, 'signals': []}
     try:
-        result = local(args)
+        result = local(args, transport)
     except Exception as error:
         result = envelope(*fields, failure=error.code if isinstance(error, NetworkFailure) else 'unclassified',
                           reader_version=None)
     try:
         retain_result(args.output, result)
+        if args.transport_output:
+            retain_result(args.transport_output, transport)
+            status = 'unknown' if transport['exit_status'] is None else str(transport['exit_status'])
+            print('::notice title=backend_network_transport::schema=' + transport['schema']
+                  + ' exit_status=' + status + ' signals=' + (','.join(transport['signals']) or 'none'),
+                  file=sys.stderr)
     except ReaderFailure:
         result = envelope(*fields, failure='artifact_write_failed', reader_version=None)
     print(json.dumps(result, separators=(',', ':')))

package/docs/BACKEND_SSH_GATE.md

@@ -123,6 +123,14 @@ released `network_readback.py`. It accepts no uploaded Python or app-mirror help
 alone cannot install this host operation: install the integrity-verified published runtime first. A missing
 host reader returns `network_reader_unavailable` with no host reader version; it is not a network verdict.
 
+The same artifact retains `transport.json`, schema `gowalk-cicd/backend-network-transport.v1`, and emits the
+brace-free `backend_network_transport` notice. It uses the runtime diagnostic's fixed `exit_status` and
+`signals` vocabulary described above; no private stderr is retained. In particular, SSH exit 1 with empty
+stdout still yields `network_reader_unavailable`, while the separate `gate_refused` signal records an observed
+gate refusal without guessing its policy, ownership or installed-reader cause. An incomplete SSH exit remains
+null, and unknown text supplies no signal. Neither this sidecar nor a workflow update proves host adoption or
+authorizes a retry, permission change or transport bypass; the existing result schema and refusal remain unchanged.
+
 The closed `gowalk-cicd/backend-network-diagnostics.v3` IPv4 result, or `v4` for IPv6, is retained as
 `backend-network-diagnostics-<job>-<attempt>/result.json`. `ok: true` means the bounded read completed;
 it never means a VPN is provisioned, traffic is reachable, a pool is globally unused or a tunnel works.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.210",
+  "version": "1.0.211",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {