feat: publish Tend v0.2 Preview 2 source

Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/state/state.go

@@ -17,13 +17,18 @@ import (
 const SchemaVersion = 1
 
 type Record struct {
-	SchemaVersion   int    `json:"schema_version"`
-	Strategy        string `json:"strategy"`
-	ActiveSlot      string `json:"active_slot"`
-	ActiveRelease   string `json:"active_release"`
-	PreviousSlot    string `json:"previous_slot,omitempty"`
-	PreviousRelease string `json:"previous_release,omitempty"`
-	UpdatedAt       string `json:"updated_at"`
+	SchemaVersion      int    `json:"schema_version"`
+	Strategy           string `json:"strategy"`
+	DesiredRelease     string `json:"desired_release,omitempty"`
+	CandidateRelease   string `json:"candidate_release,omitempty"`
+	ActiveSlot         string `json:"active_slot"`
+	ActiveRelease      string `json:"active_release"`
+	PreviousSlot       string `json:"previous_slot,omitempty"`
+	PreviousRelease    string `json:"previous_release,omitempty"`
+	LastAttemptRelease string `json:"last_attempt_release,omitempty"`
+	LastAttemptOutcome string `json:"last_attempt_outcome,omitempty"`
+	LastAttemptAt      string `json:"last_attempt_at,omitempty"`
+	UpdatedAt          string `json:"updated_at"`
 }
 
 func Load(path, root, strategy string) (Record, error) {
@@ -68,6 +73,26 @@ func (r Record) Validate(root, strategy string) error {
 			return fmt.Errorf("previous release: %w", err)
 		}
 	}
+	for label, release := range map[string]string{"desired release": r.DesiredRelease, "candidate release": r.CandidateRelease, "last attempt release": r.LastAttemptRelease} {
+		if release != "" {
+			if err := releaseBelow(root, release); err != nil {
+				return fmt.Errorf("%s: %w", label, err)
+			}
+		}
+	}
+	if r.LastAttemptOutcome != "" {
+		switch r.LastAttemptOutcome {
+		case "running", "succeeded", "failed", "rolled_back":
+		default:
+			return errors.New("last attempt outcome is invalid")
+		}
+		if _, err := time.Parse(time.RFC3339, r.LastAttemptAt); err != nil {
+			return errors.New("last attempt timestamp is invalid")
+		}
+	}
+	if r.LastAttemptOutcome == "running" && r.CandidateRelease == "" {
+		return errors.New("running attempt requires a candidate release")
+	}
 	if strategy == "blue_green" && r.PreviousRelease != "" && r.PreviousSlot == r.ActiveSlot {
 		return errors.New("previous slot must differ from active slot")
 	}

internal/state/state_test.go

@@ -16,7 +16,8 @@ func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
 		t.Fatal(err)
 	}
 	path := filepath.Join(root, "state.json")
-	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: release, UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
+	at := time.Unix(1, 0).UTC().Format(time.RFC3339)
+	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, LastAttemptRelease: release, LastAttemptOutcome: "succeeded", LastAttemptAt: at, UpdatedAt: at}
 	if err := Store(path, root, record); err != nil {
 		t.Fatal(err)
 	}
@@ -24,8 +25,8 @@ func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if loaded.ActiveRelease != release {
-		t.Fatalf("release=%q", loaded.ActiveRelease)
+	if loaded.ActiveRelease != release || loaded.DesiredRelease != release || loaded.LastAttemptOutcome != "succeeded" {
+		t.Fatalf("state=%+v", loaded)
 	}
 	if err := os.Remove(path); err != nil {
 		t.Fatal(err)
@@ -37,6 +38,15 @@ func TestStoreLoadRoundTripAndRejectSymlink(t *testing.T) {
 		t.Fatal("expected symlink refusal")
 	}
 }
+
+func TestRecordRequiresCandidateForRunningAttempt(t *testing.T) {
+	root := filepath.Join(t.TempDir(), "service")
+	release := filepath.Join(root, "releases", "sha256-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", DesiredRelease: release, ActiveSlot: "singleton", ActiveRelease: release, LastAttemptRelease: release, LastAttemptOutcome: "running", LastAttemptAt: time.Unix(1, 0).UTC().Format(time.RFC3339), UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
+	if err := record.Validate(root, "singleton_candidate"); err == nil {
+		t.Fatal("expected missing candidate rejection")
+	}
+}
 func TestRecordRejectsReleaseOutsideRoot(t *testing.T) {
 	record := Record{SchemaVersion: 1, Strategy: "singleton_candidate", ActiveSlot: "singleton", ActiveRelease: "/tmp/other/release", UpdatedAt: time.Unix(1, 0).UTC().Format(time.RFC3339)}
 	if err := record.Validate("/opt/example", "singleton_candidate"); err == nil {