gowalk-cicd 1.0.210 → 1.0.212

package/README.md

@@ -1335,6 +1335,15 @@ and the old handoff's metadata and release notes are never replayed. Missing, ex
 mismatched evidence remains refused; do not relabel a receipt or impersonate the original
 `GITHUB_*` environment. Normal delivery still refuses cancelled producers.
 
+From 1.0.212, incomplete GitHub job-step metadata is reconciled by reading the exact producer job
+within one 60-second budget, also bounded by the verification deadline. Complete observations add
+no wait. Producer identity, successful ordered transfer/handoff steps and artifact checks remain
+required; contradictory identity, duplicate steps or explicit transfer failure refuse immediately.
+`apple_upload_verify_producer_job_metadata_unavailable` means the required observations remained
+unavailable, not that the upload failed. Preserve its handoff and build; after GitHub supplies the
+complete steps, rerun only the failed **Verify Apple processing** job or use the managed recovery
+workflow. Never upload another binary to resolve this observation failure.
+
 The managed workflow retains `apple-recovered-<recovery-run>-<recovery-attempt>` with the
 unchanged `apple-verification.json`, its `.verified.json` proof and derived `.upload-receipt.json`.
 The proof identifies the original producer and the current recovery caller separately.
@@ -1395,6 +1404,9 @@ Backend Deploy also offers `operation: network-diagnostics`, with an exact `diag
 It reports the owned bridge/IPAM, observed pool conflicts, UDP 500/4500 ownership, bound host identity and
 kernel/firewall facts in a closed v3 artifact for IPv4 and v4 for IPv6. The IPv6 result also distinguishes
 host and owned-gateway default-route and forwarding observations; actual external connectivity stays unverified.
+Its artifact also retains a separate `transport.json` with the SSH exit status and fixed failure signals,
+including an observed gate refusal, without private transport output. These observations do not establish the
+installed host reader or the reason its gate refused; the network result and refusal retain their existing meaning.
 The allocator stays retired; a completed read is never
 deployment, port reservation, globally unused address space or tunnel proof. Effective firewall ingress and
 unobserved capabilities remain unverified. The [trusted-host procedure](docs/BACKEND_SSH_GATE.md#owned-bridge-and-vpn-prerequisite-readback)

package/action/scripts/apple_upload_handoff.cjs

@@ -5,6 +5,7 @@ const {createHash} = require('node:crypto');
 const {join} = require('node:path');
 const github = require('./mobile_release_api.cjs');
 const {historicalProducer, uniqueArtifact} = require('./apple_upload_handoff_history.cjs');
+const {verifySteps} = require('./apple_upload_producer.cjs');
 const SCHEMA = 'gowalk-cicd/apple-upload-handoff.v1';
 const positive = value => Number.isSafeInteger(value) && value > 0;
 const id = value => typeof value === 'string' && /^[A-Za-z0-9-]{1,64}$/.test(value);
@@ -48,16 +49,7 @@ function read(path, digest, attempt, env = process.env) {
   return value;
 }
 
-function transferred(job) {
-  if (!Array.isArray(job.steps)) return false;
-  const selected = ['Build and transfer iOS binary', 'Retain Apple verification handoff'].map(name =>
-    job.steps.filter(step => step.name === name));
-  if (selected.some(steps => steps.length !== 1 || steps[0].status !== 'completed' ||
-      steps[0].conclusion !== 'success' || !positive(steps[0].number))) return false;
-  return selected[0][0].number < selected[1][0].number;
-}
-
-async function verifyProducer(value, artifactId, api = github, recoverCancelled = false) {
+async function verifyProducer(value, artifactId, api = github, recoverCancelled = false, options = {}) {
   if (!positive(artifactId)) fail('artifact_identity');
   const o = value.owner;
   const run = await api.request('GET', `/actions/runs/${o.run_id}/attempts/${o.run_attempt}`);
@@ -73,7 +65,8 @@ async function verifyProducer(value, artifactId, api = github, recoverCancelled
   // The producer's original failure remains red; only Apple delivery is reconciled here.
   const conclusions = recoverCancelled && run.conclusion === 'cancelled' ? ['cancelled'] : ['success', 'failure'];
   if (jobs.length !== 1 || jobs[0].status !== 'completed' || !conclusions.includes(jobs[0].conclusion) ||
-      jobs[0].head_sha !== o.source_sha || !transferred(jobs[0])) fail('producer_job');
+      jobs[0].head_sha !== o.source_sha) fail('producer_job');
+  await verifySteps(jobs[0], o, api, fail, options);
   const artifact = await api.request('GET', `/actions/artifacts/${artifactId}`);
   if (artifact.id !== artifactId || artifact.expired !== false || artifact.workflow_run?.id !== o.run_id ||
       artifact.workflow_run?.head_sha !== o.source_sha ||

package/action/scripts/apple_upload_producer.cjs

@@ -0,0 +1,47 @@
+/* Reconcile incomplete GitHub step observations without relaxing producer identity or transfer proof. */
+'use strict';
+const {setTimeout: delay} = require('node:timers/promises');
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const names = ['Build and transfer iOS binary', 'Retain Apple verification handoff'];
+
+function stepsReady(job, fail) {
+  if (!Array.isArray(job.steps)) fail('producer_job');
+  const selected = names.map(name => job.steps.filter(step => step.name === name));
+  for (const steps of selected) {
+    if (steps.length > 1) fail('producer_job');
+    if (!steps.length) continue;
+    const step = steps[0];
+    if (!positive(step.number) || step.conclusion && step.conclusion !== 'success') fail('producer_job');
+  }
+  if (selected.some(steps => !steps.length || steps[0].status !== 'completed' ||
+      steps[0].conclusion !== 'success')) return false;
+  if (selected[0][0].number >= selected[1][0].number) fail('producer_job');
+  return true;
+}
+
+function identity(job, original, owner, fail) {
+  if (!positive(job.id) || job.id !== original.id || job.name !== original.name ||
+      job.run_id !== owner.run_id || job.run_attempt !== owner.run_attempt ||
+      job.head_sha !== owner.source_sha || job.status !== original.status ||
+      job.conclusion !== original.conclusion) fail('producer_job');
+}
+
+async function verifySteps(original, owner, api, fail, options = {}) {
+  const now = options.now || Date.now, sleep = options.sleep || delay;
+  const deadline = Math.min(options.deadline ?? Infinity, now() + 60000);
+  identity(original, original, owner, fail);
+  if (now() >= deadline) fail('producer_job_metadata_unavailable');
+  if (stepsReady(original, fail)) return;
+  while (now() < deadline) {
+    const job = await api.request('GET', `/actions/jobs/${original.id}`, undefined,
+      Math.max(1, Math.min(10000, deadline - now())));
+    identity(job, original, owner, fail);
+    if (now() >= deadline) fail('producer_job_metadata_unavailable');
+    if (stepsReady(job, fail)) return;
+    if (now() < deadline) await sleep(Math.min(5000, deadline - now()));
+  }
+  // Missing metadata is not failed transfer proof and must never authorize another upload.
+  fail('producer_job_metadata_unavailable');
+}
+
+module.exports = {verifySteps};

package/action/scripts/apple_upload_verify.cjs

@@ -25,7 +25,8 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   const sleep = dependencies.sleep || delay, started = now(), deadline = started + timeout * 1000;
   const key = dependencies.get ? null : credential();
   const get = dependencies.get || (path => apple.appleGet(path, key, Math.max(1, Math.min(30000, deadline - now()))));
-  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true);
+  const observation = {now, sleep, deadline: Math.min(deadline, now() + 60000)};
+  await handoff.verifyProducer(value, artifactId, api, dependencies.recoverCancelled === true, observation);
   await handoff.phase(value, api);
   let proof;
   do {
@@ -36,7 +37,7 @@ async function verify(value, artifactId, timeout, dependencies = {}) {
   } while (now() < deadline);
   if (!proof) handoff.fail('processing_pending');
   // Explicit historical recovery rechecks its terminal producer before the only write.
-  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true);
+  if (dependencies.recoverCancelled === true) await handoff.verifyProducer(value, artifactId, api, true, observation);
   const prior = await handoff.phase(value, api);
   if (prior === 'uploading') await api.status(value.owner.deployment_id, 'uploaded', 'success');
   if (await handoff.phase(value, api) !== 'uploaded') handoff.fail('write_unconfirmed');

package/action/scripts/mobile_release_api.cjs

@@ -10,6 +10,7 @@ function request(method, path, body, timeoutMs = 30000) {
     throw Error('mobile_release_repository_invalid');
   }
   const data = body === undefined ? null : JSON.stringify(body);
+  let timer;
   return new Promise((resolve, reject) => {
     const req = https.request({hostname: 'api.github.com', path: `/repos/${repo}${path}`, method,
       headers: {'User-Agent': 'gowalk-cicd', Accept: 'application/vnd.github+json',
@@ -25,10 +26,10 @@ function request(method, path, body, timeoutMs = 30000) {
         try { resolve(JSON.parse(text)); } catch { reject(Error('mobile_release_receipt_invalid')); }
       });
     });
-    req.setTimeout(timeoutMs, () => req.destroy(Error('timeout')));
+    timer = setTimeout(() => req.destroy(Error('timeout')), timeoutMs);
     req.on('error', () => reject(Error('mobile_release_receipt_transport_unconfirmed')));
     req.end(data);
-  });
+  }).finally(() => clearTimeout(timer));
 }
 
 function uncertain(error) {

package/backend-action/action.yml

@@ -341,11 +341,12 @@ runs:
       run: |
         RESULT_DIR="$(mktemp -d "$RUNNER_TEMP/backend-network-diagnostics.XXXXXX")"
         echo "result=$RESULT_DIR/result.json" >> "$GITHUB_OUTPUT"
+        echo "transport=$RESULT_DIR/transport.json" >> "$GITHUB_OUTPUT"
         python3 "${{ github.action_path }}/network_diagnostics.py" \
           --app "$DIAGNOSTIC_APP" --service "$DIAGNOSTIC_SERVICE" --expected-build-sha "$DIAGNOSTIC_BUILD" \
           --network "$DIAGNOSTIC_NETWORK" --pool "$DIAGNOSTIC_POOL" --vpn-service "$DIAGNOSTIC_VPN_SERVICE" \
           --host "$DIAGNOSTIC_HOST" --user "$DIAGNOSTIC_USER" --provider "$DIAGNOSTIC_PROVIDER" \
-          --output "$RESULT_DIR/result.json"
+          --output "$RESULT_DIR/result.json" --transport-output "$RESULT_DIR/transport.json"
 
     - name: Retain scoped backend network result
       if: always() && inputs.operation == 'network-diagnostics'
@@ -354,7 +355,9 @@ runs:
         NODE_OPTIONS: --require "${{ github.action_path }}/scripts/artifact_env.cjs"
       with:
         name: backend-network-diagnostics-${{ github.job }}-${{ github.run_attempt }}
-        path: ${{ steps.network_diagnostics.outputs.result }}
+        path: |
+          ${{ steps.network_diagnostics.outputs.result }}
+          ${{ steps.network_diagnostics.outputs.transport }}
         if-no-files-found: error
 
     - name: Cleanup key

package/backend-action/network_diagnostics.py

@@ -3,13 +3,15 @@ import argparse
 import json
 import re
 import shlex
+import sys
 from pathlib import Path
 
 from identity_diagnostics import ReaderFailure, bounded, retain_result
 from network_projection import NetworkFailure, envelope, scope, validate
+from runtime_diagnostics import transport_signals
 
 
-def local(args):
+def local(args, transport=None):
     fields = (args.app, args.service, args.expected_build_sha, args.network, args.pool,
               args.vpn_service, args.host, args.provider)
     scope(*fields)
@@ -17,14 +19,17 @@ def local(args):
         raise NetworkFailure('invalid_scope')
     command = shlex.join(['gowalk-backend', 'network-diagnostics', *fields])
     try:
-        status, raw = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
+        status, raw, errors = bounded(['ssh', '-T', '-i', str(Path.home() / '.ssh/backend_deploy'),
             '-o', 'IdentitiesOnly=yes', '-o', 'BatchMode=yes', '-o', 'StrictHostKeyChecking=yes',
             '-o', 'ConnectTimeout=10', '-o', 'ServerAliveInterval=5', '-o', 'ServerAliveCountMax=2',
-            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command], seconds=120, with_status=True)
+            '-o', 'ClearAllForwardings=yes', args.user + '@' + args.host, command],
+            seconds=120, with_status=True, with_stderr=True)
     except ReaderFailure as error:
         raise NetworkFailure(error.code) from None
     except OSError:
         raise NetworkFailure('transport_failure') from None
+    if transport is not None:
+        transport.update(exit_status=status, signals=transport_signals(status, errors))
     if status not in (0, 1):
         raise NetworkFailure('transport_failure')
     if status == 1 and not raw.strip():
@@ -45,16 +50,24 @@ def main():
     for name, default in [('service', 'api'), ('network', 'default'), ('vpn-service', 'vpn'),
                           ('provider', 'none'), ('user', 'root')]:
         parser.add_argument('--' + name, default=default)
+    parser.add_argument('--transport-output', help='Separate closed SSH observation receipt')
     args = parser.parse_args()
     fields = (args.app, args.service, args.expected_build_sha, args.network, args.pool,
               args.vpn_service, args.host, args.provider)
+    transport = {'schema': 'gowalk-cicd/backend-network-transport.v1', 'exit_status': None, 'signals': []}
     try:
-        result = local(args)
+        result = local(args, transport)
     except Exception as error:
         result = envelope(*fields, failure=error.code if isinstance(error, NetworkFailure) else 'unclassified',
                           reader_version=None)
     try:
         retain_result(args.output, result)
+        if args.transport_output:
+            retain_result(args.transport_output, transport)
+            status = 'unknown' if transport['exit_status'] is None else str(transport['exit_status'])
+            print('::notice title=backend_network_transport::schema=' + transport['schema']
+                  + ' exit_status=' + status + ' signals=' + (','.join(transport['signals']) or 'none'),
+                  file=sys.stderr)
     except ReaderFailure:
         result = envelope(*fields, failure='artifact_write_failed', reader_version=None)
     print(json.dumps(result, separators=(',', ':')))

package/docs/BACKEND_SSH_GATE.md

@@ -123,6 +123,14 @@ released `network_readback.py`. It accepts no uploaded Python or app-mirror help
 alone cannot install this host operation: install the integrity-verified published runtime first. A missing
 host reader returns `network_reader_unavailable` with no host reader version; it is not a network verdict.
 
+The same artifact retains `transport.json`, schema `gowalk-cicd/backend-network-transport.v1`, and emits the
+brace-free `backend_network_transport` notice. It uses the runtime diagnostic's fixed `exit_status` and
+`signals` vocabulary described above; no private stderr is retained. In particular, SSH exit 1 with empty
+stdout still yields `network_reader_unavailable`, while the separate `gate_refused` signal records an observed
+gate refusal without guessing its policy, ownership or installed-reader cause. An incomplete SSH exit remains
+null, and unknown text supplies no signal. Neither this sidecar nor a workflow update proves host adoption or
+authorizes a retry, permission change or transport bypass; the existing result schema and refusal remain unchanged.
+
 The closed `gowalk-cicd/backend-network-diagnostics.v3` IPv4 result, or `v4` for IPv6, is retained as
 `backend-network-diagnostics-<job>-<attempt>/result.json`. `ok: true` means the bounded read completed;
 it never means a VPN is provisioned, traffic is reachable, a pool is globally unused or a tunnel works.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.210",
+  "version": "1.0.212",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {