gamertan
b68fa2487d
Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist. AI-assisted: OpenAI Codex helped implement, test, and audit this preview. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
2.0 KiB
Architecture
Tend has three deliberately separate boundaries.
Package boundary
tend package accepts only a clean checkout whose HEAD exactly matches the
configured pushed branch. It rejects Go module replacements and unversioned
dependencies, builds the configured main package twice with GOWORK=off, and
requires byte-identical output. The resulting archive contains only:
- the service binary;
RELEASE.json;BUILDINFO.json;SBOM.spdx.json; andSHA256SUMS.
The external archive digest is the release identity used by deployment.
Target-host boundary
tend deploy runs on the Linux target. Transfer and SSH authentication stay
outside Tend v0.1; application-local transfer commands move the artifact and
the identical Tend binary to a root-controlled staging directory. Tend then
requires the expected digest to be repeated as a separately approved digest.
Dry-run validation extracts into a temporary directory and does not touch the release tree. Activation acquires the shared lock, installs a content-addressed release, verifies all embedded checksums and manifest fields, and starts the candidate without evaluating configuration as shell code.
Activation boundary
Blue/green mode points the inactive slot at the new release, restarts and probes it, atomically replaces one imported Caddy handler, validates the full Caddy configuration, reloads Caddy, and records the prior active slot.
Singleton mode starts the new release in a hardened transient systemd unit on a separate loopback address, probes it, stops the candidate, changes the current release pointer, and restarts the installed singleton unit.
Any failure before state persistence restores the previously observed Caddy bytes and/or release pointers. Rollback is a separate explicit command over the recorded state. It rechecks health and readiness, but deliberately does not apply the current release's content markers to an older release whose routes may differ. Pruning preserves both active and previous releases.