Unverified Commit d5e623c7 authored by Lemon-miaow's avatar Lemon-miaow
Browse files

docs(audit): batch-42 addendum — static review of the never-run release pipeline 

The release workflow has never executed (no tags/releases exist yet).
Its three load-bearing contracts were verified against their other
halves: the asset names vs bootstrap's download_release_binary (and its
'felis ${REF}' convergence check), the local-exporter path vs the
Dockerfile's final COPY, and the version assertion vs cmdVersion's first
line.  The one un-replicable check (file(1) machine type) was probed
with a cross-compiled linux/arm64 binary: 'ARM aarch64' matches.  No
pre-tag fixes needed.
parent aa823219

AUDIT-2026-09-22.md

+6 −1
Changes for AUDIT-2026-09-22.md: 6 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -742,7 +742,12 @@ IPv6-only 接入（`ssh -6 -i ~/.ssh/id_ed25519 root@fdb2:2c26:f4e4:0:21c:42ff:f 
- 红证据（本机复现）：以 sync.sh 原排除清单 rsync 一个 fresh 目标 → `go build` 立即失败：`bootstrap_asset.go:30:12: pattern plugins/limbo/build.gradle: no matching files found`（`bootstrap_asset.go` embed 了 plugins/{limbo,paper,velocity,shared} 源码；排除清单成文于 embed 引入之前）。存量目标靠 rsync 对排除路径的"保护"而看似正常，fresh 目标必炸。

- 修复：排除项从 `plugins/` 改为 `plugins/*/build|.gradle|bin/`（与 `.gitignore` 同义）；`watch.sh` 同步去掉 plugins 的忽略。验证：新清单 rsync fresh 目标 → `go build` 绿（83.7MB 二进制产出）；两脚本 `bash -n` 通过。因脚本被 `.git/info/exclude` 私有，修复留在工作机、无 commit。



**五、观察（不计缺陷）**

**五、release.yml 静态复核（该流水线从未执行过——仓库当前无任何 tag/release）**

- 三处输入/输出契约实核：① 发布资产名 `felis-linux-amd64/arm64` ↔ `deploy/bootstrap.sh` 的 `asset="felis-linux-${arch}"` 及收敛检查 `felis ${FELIS_REF}`（版本首行契约两侧一致）；② `out/linux_amd64/usr/local/bin/felis` ↔ Dockerfile 最终层 `COPY /out/felis /usr/local/bin/felis`；③ 版本断言 `felis ${GITHUB_REF_NAME}` ↔ `cmdVersion` 的 `felis %s` 首行。

- 唯一无法在本机完全复刻的 `file(1)` 机器类型断言：用交叉编译的 linux/arm64 二进制实测输出 `ELF 64-bit LSB executable, ARM aarch64, …`，断言串 `ARM aarch64` 匹配（BSD/Ubuntu file 同源 magic）。

- 结论：整条流水线未跑属"尚未切 tag"的发布流程事实（第四十批已注记）；切首个 tag 前无待修项。



**六、观察（不计缺陷）**

- `internal/api/handlers_account.go:169` 的 reclaim 选择仍为 Java/Velocity 侧 CODE-ONLY（deferred-seams 已记 accepting）——维持。



## 结论：离"生产可用"还差什么（按优先级）