monky-deployd/CHANGELOG.md

<!-- xlate:verbatim-fences -->
# Changelog

## 0.1.7 — registry credential + a pull error you can read (2026-09-08)

- **No hand `docker login` on a new box** (monky-design-docs !225, doc 24 §4a). A manifest entry marked
  `use: registry-auth` is the Harbor pull credential, not an env var: it is written to
  `<state_dir>/docker/config.json` (0600, in a directory the agent owns) and the docker CLI is pointed at it
  with an explicit **`DOCKER_CONFIG`**. That last part is the trap — the unit runs as `monky-deployd`, so a
  `docker login` by a human or by root is invisible to the agent and looks exactly like no credential at all
  (env-dev-01, 2026-09-08). Both seeded shapes are accepted: a JSON object, or `username:password` with the
  registry from the new `registry_host` config.
- **`compose pull` failures carry the registry's own message** instead of `rc=1`. "no basic auth
  credentials", "manifest unknown" and DNS failures now reach the journal and the report to tenancy.

## 0.1.6 — 2026-09-07

- **A valid lease token is reused across applies.** Every apply requested a new lease, so a failing deploy
  retried by the 60 s timer burned tenancy's 5-leases-per-hour budget and then failed on
  `LEASE_RATE_LIMITED` forever (env-qa-02 pilot). Now: reuse a lease-derived token while `lookup-self`
  says it is valid; swap the bootstrap token for a lease once; and if tenancy rate-limits the lease while a
  working token exists, apply with it and defer the swap instead of failing the deploy.

## 0.1.5 — 2026-09-07

- **`tenancy.port` defaults to 443 everywhere** — the ansible role default and the `TenancyCfg` default now
  match `install.sh`/`config.example.yaml` (0.1.5 only changed those two); PROTOCOL.md states the intercept
  port separately from the in-pod 8081, that the broker does not add `#monky-deploy-agent` yet, that the jwt
  mount keeps no `jti` state, and that `release:gitea` has not run (doc-drift DD-0523/0525/0527/0528).
- **`${VAR}` inside comment lines is not a reference.** The renderer's `.env.template` header literally says
  "substitutes every ${VAR}", which the refusal check counted as an unresolved variable
  (`ENV_INCOMPLETE: unresolved: VAR`) — the first bundle on env-qa-02 was refused for it.

- **config: `tenancy.port` is the service's intercept port (443), not the in-pod 8081.** With 8081 the SDK
  found no intercept and the dial failed (`service not available`, then a bare `TypeError` from the SDK's
  fallback). `install.sh` now writes 443; `config.example.yaml` updated.
- **transport sdk: clear error instead of a TypeError** when an address has no intercept or the identity
  has no dial policy for the service (`TransportError` names the host:port and what to check).

## 0.1.4 — 2026-09-07

- **install.sh: `ziti-edge-tunnel.service` failed to start after enrolment** (`203/EXEC`: the package's
  `ExecStartPre` script is not executable by user `ziti` on ziti-edge-tunnel 1.18.x) and, because the
  unit was enabled with `--now` under `set -e`, the script aborted BEFORE writing config/ACLs/grant/timer —
  a second kit was needed. The run-host drop-in now clears `ExecStartPre=`; a tunneler start failure is a
  WARNING until everything else is in place, then a hard error at the end.

## 0.1.3 — 2026-09-06

- **install.sh: `--version` was clobbered by `/etc/os-release`** (it defines `VERSION`), so the kit tried to download
  `monky-deployd_26.04 LTS (Resolute Raccoon)_amd64.deb` (env-qa-02 pilot, first real kit run). Script variables are now
  `DEPLOYD_VERSION`; os-release is read in a subshell.
- **install.sh installs Docker Engine when absent** (Docker's apt suite for the codename → fallback `docker.io`), with
  `--docker-data-root <dir>` to place the data-root before first start. One script for the end user, per the operator's rule.

## v0.1.2 — 2026-09-05

- **The GitLab project is private** (its parent groups are private, so it cannot be made public;
  found when the v0.1.1 one-liner returned 401 anonymously). `install.sh` gains `--token <deploy-token>`
  / `MONKY_DEPLOYD_TOKEN`: every download from the generic package registry — the script itself
  included — sends `DEPLOY-TOKEN: <token>`, a read-only GitLab **deploy token** (scope
  `read_package_registry` only, revocable), seeded in OpenBao at `monky/monky-tenancy/deployd-download`
  (key `token`) and handed to the box by the monky-tenancy install kit. The token never reaches the
  command line, the log or an xtrace (curl `-K` config file, 0600, deleted after the download;
  `set +x` forced). The one-liner now fetches `install.sh` from the registry
  (`…/monky-deployd/<ver>/install.sh`) instead of `-/raw/main`, and takes the bootstrap grant via
  `--bootstrap-file` — with `curl … | bash -s --` stdin IS the script, so it is no longer read for
  the grant in that mode. `--source gitea` (no token) stays the off-estate alternative.
- Ansible role: `monky_deployd_download_token` (vaulted) → `DEPLOY-TOKEN` header on both fetches,
  `no_log: true`.
- README / OPERATIONS: why (private project; split-horizon Gitea, cbs/iac#102), token scope, revocation.
  No agent behaviour change.

## v0.1.1 — 2026-09-05

- `install.sh` / ansible role / README: the **primary download is the public GitLab project's generic
  package registry on scm.tikali.ai** (`/api/v4/projects/69/packages/generic/monky-deployd/<ver>/…`);
  the one-liner fetches the script from `scm.tikali.ai/…/-/raw/main/packaging/install.sh`. Inside the
  estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (no HTTP ingress), so backend
  boxes could not fetch the artefacts (cbs/iac#102). The Gitea release stays the off-estate
  alternative (`--source gitea` / `MONKY_DEPLOYD_SOURCE=gitea`). No agent behaviour change.

## v0.1.0 — 2026-09-05

First release (MONKY-ADR-0028 §D, Reconciliation v2, Gate 1 v2).

- Stdlib-only Python 3.12 agent: `run --once|loop`, `status`, `bootstrap`, `--prune`.
- Protocol: `POST /v1/agent/checkin` (`action apply|none|down`), `GET /v1/agent/bundle/{env}/{sha}`
  (sha256 verified), `POST /v1/agent/lease` → **deploy grant** (`login_jwt`), `POST /v1/agent/report`
  (`result applied|failed|down`, redacted `log_tail`). An AppRole-shaped lease is refused (`LEASE_SHAPE`).
- OpenBao: `POST /v1/auth/jwt-tenancy/login {"role":"see-env","jwt":…}`; KV-v2 reads pinned to the
  manifest's versions, paths pinned to `monky/data/<env>/see/`; renew-self / re-lease before max TTL.
- Refusals: `ENV_INCOMPLETE` (names only), `PRIVILEGED_REFUSED`, `ROLLBACK_REFUSED`, `DISK_INSUFFICIENT`
  (`need × 1.5 + 2 GiB` vs docker data-root), `BUNDLE_SHA_MISMATCH`, `BUNDLE_ENV_MISMATCH`.
- Transports `sdk` (openziti SDK), `proxy` (`ziti tunnel proxy` 18443/18200), `system`.
- Exit codes 0 / 75 / 78 (`AGENT_ENV_MISMATCH`, no retry storm) / 1; laptop mode (offline exits 0).
- Packaging: hardened `monky-deployd.service` oneshot + 60 s timer, `monky-deployd-proxy.service`,
  `nfpm` `.deb` with `/opt/monky-deployd/venv`, `packaging/install.sh` (Ubuntu 26.04), ansible role skeleton.
- Known divergence: monky-tenancy `main` (MR !15) still ships the AppRole lease/kit; the JWT-grant
  follow-up is the tenancy side of this release (docs/PROTOCOL.md "Divergences").