updater: split apply() into prepare()+commit() for signed release-notes review#1075
Merged
Conversation
…es review Stage-then-activate so `hal0 update` can show cosign-verified release notes and confirm before touching the running system: - updater.py: Updater.apply() split into prepare() (§9 steps 1-6: fetch → download → sha256 → cosign verify → extract to the staged dir; caches the verified manifest + reads RELEASE_NOTES.md / release.json from the *signed* tree) and commit() (§9 steps 7-9+: migrations → symlink swap → venv re-pip → unit re-render). apply() = prepare()+commit() (back-compat). commit() requires a prior prepare or raises. Manifest is cached between phases so commit can't drift to a newer release than the one verified. - API: POST /api/updates/prepare (→ 'prepared' state carrying notes + resolved_version) and POST /api/updates/commit (requires version → 'applied'). /apply unchanged. - CLI: `hal0 update` stages → renders notes (breaking/migrations panel + highlights + markdown) → confirms ONLY on an interactive TTY without --yes (headless/cron proceeds unchanged) → commits. Adds --yes/-y and a patchable _interactive() gate. Release notes live INSIDE the cosign-verified tarball (not a plain-TLS notes_url), so what an operator reviews is exactly what was signed. Tests: prepare stages without swap; commit-without-prepare raises; prepare→commit reaches the same end state as apply; notes read from the tarball; /prepare and /commit routes; CLI prepare→commit flow, --yes, TTY-decline, notes render. 101 pass across tests/updater + tests/api/test_updater_routes + tests/cli. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Co-Authored-By: Claude Opus 4.8 <[email protected]>
thinmintdev
added a commit
that referenced
this pull request
Jul 5, 2026
* release: prep v0.9.1 — bump version + CHANGELOG - pyproject 0.9.0 → 0.9.1. - CHANGELOG: promote [Unreleased] → [0.9.1] documenting the merges since v0.9.0 (ROCmFPX runner quant-detect/#1068, seed profiles/#1069, quantize skill/#1071, bench tooling/#1072, updater prepare/commit + signed notes/#1075, seed cleanup + auto-fallback/#1076, release-notes producer/#1078, continuous batching). Uses ### Highlights / ### Migrations subsections so `hal0 update` renders the seed-cleanup auto-fallback as a callout (dogfooding #1078). Fresh empty [Unreleased] restored. Not the tag itself — reviewed separately, then tag v0.9.1 triggers release.yml. Co-Authored-By: Claude Opus 4.8 <[email protected]> * profiles: normalise seed intent labels to structural tags Drop served-model names and filler from seed 'intent' labels (e.g. 'VKFPX · ROCmFPX MoEQuality 35B-A3B · Vulkan0 + MTP' → 'VULKFPX · MOE · MTP'; 'ROCm · basic GPU LLM' → 'ROCm'). Structural runner/arch/feature tags only. Co-Authored-By: Claude Opus 4.8 <[email protected]> * profiles: add vkfpx-dense seed (VULKFPX · DENSE · MTP, Vulkan0) Completes the FPX lane×arch matrix — Vulkan0 lane for dense ROCmFP4, for prefill-bound workloads (Vulkan wins ~+24% PP); complements the decode-optimal ROCm0 rocmfpx-rocm. mtp=True (runner-capability gate; params stay on the model). Co-Authored-By: Claude Opus 4.8 <[email protected]> --------- Co-authored-by: Claude Opus 4.8 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stage-then-activate so
hal0 updatecan show cosign-verified release notes and confirm before touching the running system.apply()split intoprepare()(steps 1–6: download → verify → extract to staged dir; readsRELEASE_NOTES.md/release.jsonfrom the signed tree) andcommit()(steps 7–9+: migrations → symlink swap → venv re-pip → unit re-render).apply()= prepare+commit (back-compat). Manifest cached between phases so commit can't drift to a newer release than the one verified.POST /prepare(→preparedstate with notes + resolved_version),POST /commit(requires version →applied)./applyunchanged.--yes(headless/cron proceeds unchanged) → commit. Adds--yes/-y.Notes live inside the cosign-verified tarball (not a plain-TLS
notes_url), so what an operator reviews is exactly what was signed. 101 tests pass across updater + routes + CLI.🤖 Generated with Claude Code