Commit graph

59 commits

Author SHA1 Message Date
rcourtman
3da835c5bc Publish a distribution path for pulse-mcp
The MCP adapter shipped in slice 51 with one install option:
clone the repo and go build. This slice integrates pulse-mcp
into Pulse's existing governed release pipeline so a Pulse
release publishes a pulse-mcp binary alongside the unified agent
and the install scripts that bring it home in one command.

What ships:

  - scripts/build-release.sh extended to build pulse-mcp for
    the same multi-OS matrix as the unified agent, package
    per-platform tarballs and zips, and copy bare binaries to
    RELEASE_DIR for /releases/latest/download/ redirect
    compatibility.
  - .github/workflows/create-release.yml extended to upload
    the bare pulse-mcp binaries plus install-mcp.sh and
    install-mcp.ps1 as release assets.
  - scripts/install-mcp.sh: bash one-line installer that
    detects platform/arch, downloads the matching binary from
    the configured release (latest by default), verifies SHA256
    against the published checksums.txt, places at
    ~/.local/bin/pulse-mcp (or /usr/local/bin if not writable).
    Honors PULSE_MCP_VERSION, PULSE_MCP_BIN_DIR, PULSE_MCP_REPO,
    PULSE_MCP_NO_VERIFY env vars; declines Windows shells with
    a pointer at the .ps1 sibling.
  - scripts/install-mcp.ps1: PowerShell installer for Windows,
    placing pulse-mcp.exe at $LOCALAPPDATA\pulse-mcp.

Documentation aligned:

  - cmd/pulse-mcp/README.md gains an Install section above
    Quick start with three options: one-line installer,
    GitHub Release download, go install. Documents the macOS
    Gatekeeper bypass since v1 is unnotarized by design.
  - The Settings -> API Access agent-integrations panel now
    surfaces the curl|bash command above the config snippet so
    operators see "install pulse-mcp" before "configure your
    MCP client."
  - docs/releases/AGENT_PARADIGM.md drops the "no published
    distribution path" item from "what it does not do yet" and
    documents the Gatekeeper / Homebrew gaps as next-tier
    follow-ups.

Trade-offs surfaced and chosen:

  - Same cadence as Pulse: pulse-mcp ships per Pulse release,
    not on its own track. The MCP server reads the manifest
    from the Pulse it talks to, so version alignment is the
    natural model.
  - No Homebrew tap or core formula in v1. Maintaining a tap
    is real ongoing work; foundation supports adding Homebrew
    later as a layer.
  - No Docker image. Stdio JSON-RPC fights Docker's stdin
    /stdout pattern.
  - No notarization in v1. SHA256 verification through the
    installer preserves the audit trail; README documents the
    Gatekeeper bypass.

Subsystem contract: deployment-installability.md gains
scripts/install-mcp.sh, scripts/install-mcp.ps1, and
cmd/pulse-mcp/ in canonical files (mid-list entries
renumbered) plus a paragraph documenting the new MCP entry
point alongside the existing installer family.

Verification artifacts:

  - scripts/installtests/build_release_assets_test.go gains
    TestBuildReleasePackagesPulseMcpForAllPlatforms which pins
    the build/package/copy wiring and the load-bearing
    install-mcp.sh helpers (platform detection, SHA256
    verification, install-dir resolution).
  - scripts/release_control/render_release_body_test.py gains
    test_agent_paradigm_release_notes_blurb_documents_-
    distribution_path which pins the AGENT_PARADIGM.md draft's
    install-mcp.sh reference and the four-axis frame so a
    future edit cannot regress the install story silently.

Smoke-tested install-mcp.sh locally on darwin-arm64: platform
detection, install-dir resolution, URL building, and 404 error
handling all correct. The full end-to-end install path becomes
live the moment a Pulse release ships pulse-mcp binaries; the
next RC cut will exercise it.
2026-05-10 17:04:49 +01:00
rcourtman
0f747781fb Support private Pro archive installs 2026-05-07 09:28:38 +01:00
rcourtman
d6e96ebeca Fix v6 demo release signing key deployment 2026-05-05 21:40:14 +01:00
rcourtman
96c2e160c9 Fix RC4 release validation blockers 2026-05-05 15:59:23 +01:00
rcourtman
ce7b459aa7 Harden runtime Proxmox token ACLs 2026-05-05 14:42:05 +01:00
rcourtman
cf103ca9fe Harden root agent service defaults 2026-05-05 13:03:13 +01:00
rcourtman
fe30ecc81e Fix TrueNAS CORE agent supervisor restart
Refs #1457
2026-05-05 09:13:03 +01:00
rcourtman
1a9fa936ee Fix release key helper module path 2026-05-04 09:44:41 +01:00
rcourtman
c27814d190 Fix stable installer prerelease selection
Refs #1435
2026-05-03 15:20:18 +01:00
rcourtman
9ba0c3fa96 Retry release asset uploads 2026-05-03 10:26:51 +01:00
rcourtman
54378a14e5 Fix release validation draft metadata preservation 2026-05-02 02:01:57 +01:00
rcourtman
011d288cb4 Fix release asset validation workflow gates 2026-05-02 00:36:54 +01:00
rcourtman
c8e24f06d7 Fix clean VCS metadata for release builds 2026-05-01 23:12:41 +01:00
rcourtman
87aba32540 Port installer disk preflight from v5 2026-05-01 20:28:11 +01:00
rcourtman
411e8daa4d Port installer bundle fallback fix from v5 2026-05-01 20:28:11 +01:00
rcourtman
af8a5f0740 Port RC3 maintenance fixes from v5
Refs #1440, #1444, #1451
2026-05-01 20:28:11 +01:00
rcourtman
a2c101379a Guard stable updater from prerelease tags
Refuse prerelease-shaped tags and explicit GitHub prerelease responses in the unattended stable updater before installer invocation.

Add installability tests and proof routing for the auto-update prerelease refusal guard.
2026-04-25 23:49:27 +01:00
rcourtman
fb6b53268a Harden release Docker key embedding cache 2026-04-24 17:21:04 +01:00
rcourtman
3ffdf785f1 Split hosted runtime image build contract 2026-04-24 11:33:20 +01:00
rcourtman
c4f1e8d7cb Avoid tenant runtime image copy-up 2026-04-24 09:21:42 +01:00
rcourtman
c51708000f Tighten unified agent hardening proof 2026-04-23 23:37:25 +01:00
rcourtman
9bada35337 Harden unified agent runtime and installer 2026-04-23 23:04:18 +01:00
rcourtman
f58840e8a8 Guard forward release signing against trust-root drift 2026-04-22 19:59:18 +01:00
rcourtman
c0f48b27ba Grant release validation workflow required permissions 2026-04-22 17:47:13 +01:00
rcourtman
9c2e3d5ffb Add historical backfill mode to create-release workflow 2026-04-22 17:43:37 +01:00
rcourtman
16ad67a9b5 Add historical release asset backfill workflow 2026-04-22 17:25:58 +01:00
rcourtman
f96abc5ee0 Publish signed release-packet SBOM assets 2026-04-22 16:49:29 +01:00
rcourtman
21dde76c6f Validate signed release sidecar assets 2026-04-22 16:30:01 +01:00
rcourtman
a60fa03d7f Route operator updates through the local signed helper 2026-04-22 16:18:16 +01:00
rcourtman
ce95ef1fc6 Require signed server installer updates 2026-04-22 15:41:54 +01:00
rcourtman
ca26ed2f44 Pin Dockerfile base images by digest 2026-04-22 11:22:46 +01:00
rcourtman
21950c6e4c Restore QNAP agent boot and update continuity
Refs #1420

Refs #1422
2026-04-22 10:48:43 +01:00
rcourtman
74df03c78c Pin workflow actions and CI image versions 2026-04-22 10:12:15 +01:00
rcourtman
1841c032f6 Pin deployment defaults and verify Helm docs downloads 2026-04-22 06:05:06 +01:00
rcourtman
4720807ae5 Require signed installer downloads and local release sidecars 2026-04-22 03:51:46 +01:00
rcourtman
96034f5e10 Attest release artifacts and harden image provenance 2026-04-22 03:22:29 +01:00
rcourtman
7be844f23a Require signed unified agent release assets 2026-04-22 02:00:29 +01:00
rcourtman
4711d11163 Fix fresh Proxmox LXC installs defaulting to RC 2026-04-20 23:11:46 +01:00
rcourtman
4bd023fe1c infra: align agent-led add landing with Proxmox auto-detect 2026-04-20 22:48:34 +01:00
rcourtman
18f4580e03 Harden demo public browser smoke readiness 2026-04-12 17:07:50 +01:00
rcourtman
ef288b250b Reconcile draft release retries 2026-04-12 10:52:19 +01:00
rcourtman
a48fb63cb3 Preserve draft release validation state 2026-04-11 17:35:14 +01:00
rcourtman
be2b987cf0 Add public browser smoke proof to demo workflows 2026-04-11 13:50:00 +01:00
rcourtman
3a992a4fae Route demo updates over governed Tailscale path 2026-04-11 13:35:37 +01:00
rcourtman
a462b730ec Verify demo host identity before deploy 2026-04-11 12:46:18 +01:00
rcourtman
5b2005a645 Parse demo entry script for parity proof 2026-04-11 11:09:14 +01:00
rcourtman
c9cd8cf14b Fix preview frontend parity asset detection 2026-04-11 10:59:06 +01:00
rcourtman
6e2b58d555 Harden preview demo deployment verification 2026-04-11 00:39:07 +01:00
rcourtman
e512bb62dc Add explicit auto-update disable install mode 2026-04-10 11:34:58 +01:00
rcourtman
58ad221d47 Add governed v6 preview demo targets 2026-04-10 10:53:17 +01:00