feat: restore verified automatic updates - #116
Merged
Merged
Conversation
![mobilyze-open-swe-studio2[bot]](https://avatars.githubusercontent.com/in/4340220?s=60&v=4){kind=small}
…ed-auto-update # Conflicts: # CLAUDE.md
Owner
Author
|
@Mergifyio queue |
Contributor
Merge Queue Status
This pull request spent 44 seconds in the queue, including 7 seconds running CI. Required conditions to merge
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ThreadBear can again keep itself current without a LaunchAgent or a second scheduler. The consented hourly Luna helper reconciles archive work first, then delegates one deterministic, quiet update-last check to the CLI; Luna never chooses, downloads, or approves a release.
The updater accepts only the exact official Darwin asset for the published version, then verifies its repository URL, size bounds, SHA-256, embedded version, candidate self-test, confirmed install, and installed status. Equal-version drift can repair managed files, healthy installs remain quiet, newer local versions never downgrade, and every failure identifies its stage. A shared private operation lock serializes archive work, updates, and confirmed uninstall while preserving the durable pending-archive boundary.
The installed skill, setup recommendation, public site source, and maintainer policy now describe both archive and update behavior in friendly language. Shipped executable logic is 1,824 lines against the ratified 1,500 target and 2,000 absolute ceiling.
Fixes BEAR-111.
Policy authority
Policy-only PR #117 established BEAR-111's ratified 1,500-line target and 2,000-line absolute ceiling on
mainbefore this feature is merged. It measured the prior target baseline at 1,492 shipped lines, updated every enforcement surface together, passed Open SWE with no issues, and merged through Mergify ata72586a. This PR's current merge diff no longer changes its own size contract.Validation
65500b237cc0d83c71da3762840c6ca2e6588393: gofmt, normal tests, race tests, vet, both Darwin cross-builds, shell/parity checks, experiment validation, diff cleanliness, and the 1,824/2,000 shipped-logic gate pass.672b5a45e6af7096a338067955506c3bd9a3f9c5eb6232b73dba63489f8cbc84, exactly matching GitHub's checksum.repaired:true; the reviewed 2.1.8 candidate saw public v2.1.7, returnedcurrent:true, and preserved its exact binary hash.stage:archive_pending, and guarded cancel restoredarchive_pending:false.mainreturnedNo findings.Fable inspected exact head65500b2and returnedShipusing the runtime-tree byte identity and live evidence below.Deployment boundary
threadbear.shis deployed from the separate Cloudflare Pagesthreadbear-webrepository. Its guide and installer lock files pin one immutable released product commit, so this source guide cannot reach fresh installers until the web lock cohort deliberately moves to a matching published release.Residual risk: a future release-format or asset-naming change is not covered by the current live v2.1.7 service canary.