feat: publish Tend v0.2 Preview 2 source

Export the reviewed allowlisted snapshot from private source commit 8aab3db43f35e6a49aa497f45d73701b13fc9f32 and tree 992132ea4703437dc13ffdbb04a077816c02caf9. This includes routed singleton continuity, deployment evidence, strict schema-2 configuration, restricted transport, and the independently compilable public-tree guard.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/check-public-tree.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: AGPL-3.0-only
+set -euo pipefail
+root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
+allow=$root/scripts/public-snapshot.allow
+LC_ALL=C sort -c "$allow"
+[[ $(LC_ALL=C sort "$allow" | uniq -d | wc -l) -eq 0 ]]
+mapfile -t files <"$allow"
+[[ ${#files[@]} -gt 0 ]]
+for file in "${files[@]}"; do
+	[[ -n $file && $file != /* && $file != *..* && $file != .gitea/* && $file != .github/* ]]
+	git -C "$root" cat-file -e "HEAD:$file"
+done
+work=$(mktemp -d)
+trap 'rm -rf -- "$work"' EXIT
+mkdir -m 0700 "$work/tree"
+git -C "$root" archive HEAD -- "${files[@]}" | tar -xf - -C "$work/tree"
+test ! -e "$work/tree/.git"
+test ! -e "$work/tree/.gitea"
+test ! -e "$work/tree/.github"
+private_pattern='/home/[[:alnum:]_.-]+/|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea[-_]api[[:alnum:]_.-]*token'
+if (cd "$work/tree" && rg -n --hidden --glob '!scripts/export-public.sh' --glob '!scripts/check-public-tree.sh' "$private_pattern" .); then
+	echo "private material found in public tree" >&2
+	exit 1
+fi
+(cd "$work/tree" && ./scripts/check-licenses.sh)
+(cd "$work/tree" && GOWORK=off go test -count=1 ./...)
+(cd "$work/tree" && GOWORK=off go vet ./...)
+(cd "$work/tree" && GOWORK=off CGO_ENABLED=0 go build -buildvcs=false -mod=readonly -trimpath -o "$work/tend" ./cmd/tend)
+echo "public tree compiles independently"

scripts/export-public.sh

@@ -44,7 +44,8 @@ done < <(find "$stage" -type f -print | LC_ALL=C sort)
 epoch=$(git -C "$root" show -s --format=%ct "$commit")
 printf '{"schema_version":1,"source_commit":"%s","source_tree":"%s","source_date_epoch":%s,"file_count":%d}\n' "$commit" "$tree" "$epoch" "${#files[@]}" >"$stage/PUBLIC-SNAPSHOT.json"
 (cd "$stage" && sha256sum PUBLIC-SNAPSHOT.json >PUBLIC-SNAPSHOT.sha256)
-if (cd "$stage" && rg -n --hidden --glob '!.git/**' --glob '!PUBLIC-SNAPSHOT.json' --glob '!scripts/export-public.sh' '/home/cole|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea-api\.token' .); then
+private_pattern='/home/[[:alnum:]_.-]+/|BEGIN (RSA|OPENSSH|EC) PRIVATE KEY|gitea[-_]api[[:alnum:]_.-]*token'
+if (cd "$stage" && rg -n --hidden --glob '!.git/**' --glob '!PUBLIC-SNAPSHOT.json' --glob '!scripts/export-public.sh' "$private_pattern" .); then
 	echo "private material found" >&2
 	exit 1
 fi

scripts/public-snapshot.allow

@@ -8,6 +8,7 @@ SECURITY.md
 cmd/tend/main.go
 docs/ARCHITECTURE.md
 docs/DOGFOOD_EVIDENCE.md
+docs/DOGFOOD_FRICTION.md
 docs/PUBLIC_SNAPSHOT.md
 docs/SCHEMA_V2_MIGRATION.md
 docs/THREAT_MODEL.md
@@ -19,6 +20,8 @@ examples/blue-green/example-site@.service
 examples/blue-green/tend.json
 examples/local/.env.example
 examples/server/authorized_keys.example
+examples/server/caddy/docs-site.template
+examples/server/caddy/example-site.template
 examples/server/environment/docs-site.env.example
 examples/server/environment/example-site.env.example
 examples/server/example-singleton.service
@@ -28,6 +31,7 @@ examples/server/services/example-site.json
 examples/server/slots/example-site-blue.env
 examples/server/slots/example-site-green.env
 examples/server/tend-receive.sudoers
+examples/singleton/caddy-handler.template
 examples/singleton/tend.json
 go.mod
 internal/config/config.go
@@ -42,7 +46,10 @@ internal/deploy/operator_test.go
 internal/deploy/ownership_linux.go
 internal/deploy/ownership_other.go
 internal/deploy/release.go
+internal/deploy/release_mode_linux_test.go
 internal/deploy/release_test.go
+internal/eventlog/eventlog.go
+internal/eventlog/eventlog_test.go
 internal/packager/packager.go
 internal/packager/packager_test.go
 internal/process/run.go
@@ -62,6 +69,7 @@ internal/version/version.go
 internal/version/version_test.go
 release/tend.json
 scripts/check-licenses.sh
+scripts/check-public-tree.sh
 scripts/export-public.sh
 scripts/public-snapshot.allow
 scripts/test-public-snapshot.sh

scripts/verify.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 cd "$root"
 ./scripts/check-licenses.sh
+./scripts/check-public-tree.sh
 go test -count=1 ./...
 go test -race -count=1 ./...
 go vet ./...