fix: repair public 1.0 operator paths

CHANGELOG.md

@@ -6,6 +6,8 @@
   0.8.1 and 0.9 milestones.
 - Bind the candidate to deterministic qualification, packaged-artifact
   verification and the adaptive campaign evidence plan.
+- Make the public first-kill path default to `v1.0.0` and make the support
+  helper use the installed, root-owned zipapp shipped by the verified bundle.
 - Keep publication, signing, tagging and external deployment as separate
   decisions.
 

README.md

@@ -103,10 +103,11 @@ sudo /usr/bin/python3 -I -S scripts/first_kill.py \
 
 The preflight is read-only: it checks the operator, supported host features,
 empty installation targets, required tool availability, and that the local
-annotated published-release tag resolves to its qualified commit. It makes no network
-request and creates no workspace, GPG home, build, installation or service.
-It does not verify the release signature, downloaded assets, functional build,
-installation or containment; those checks happen only in the full run.
+published-release reference is an annotated tag resolving to a commit. It makes
+no network request and creates no workspace, GPG home, build, installation or
+service. It does not verify the tag signature, downloaded assets, functional
+build, installation or containment; the full run verifies the signature and
+requires the signed tag commit to match the release manifest.
 
 ### Probe the containment primitive
 
@@ -245,7 +246,7 @@ candidate; names alone never trigger a kill.
 
 To make a report reproducible, create a local JSON bundle containing host
 compatibility, supervisor health, workload counts and redacted detection
-summaries:
+summaries after Eggcracker is installed:
 
 ```sh
 sudo /usr/bin/python3 -I -S scripts/support_bundle.py \

RELEASE_NOTES.md

@@ -7,6 +7,10 @@ AI profiles, direct cgroup-v2 containment, offline selected-workload and
 execution boundaries, watchdog recovery, and root-controlled exact relaunch
 lockdown.
 
+The public first-kill helper defaults to `v1.0.0`. The packaged support helper
+delegates to the installed root-owned zipapp, so the documented command works
+from the verified Linux release bundle without importing a mutable checkout.
+
 The candidate is not tagged, signed or published. Its release decision is
 bound to the exact commit, artifact hashes, disposable Ubuntu qualification
 evidence and the internal black-box/source-informed campaign. Unsupported

scripts/first_kill.py

@@ -33,8 +33,7 @@ except ImportError:  # pragma: no cover - first-kill is a native Linux command
 
 
 REPOSITORY = "noqt/Lumi-Eggcracker"
-DEFAULT_TAG = "v0.5.0"
-DEFAULT_TAG_COMMIT = "eb342808f56cdc213c0861726d5309a146965bef"
+DEFAULT_TAG = "v1.0.0"
 RELEASE_KEY_FINGERPRINT = "53786DEB001459956A2E1B86A3F29F7A27636DC7"
 WORKLOAD_USER = "lumi-eggcracker-workload"
 INSTALL_TARGETS = (
@@ -236,9 +235,12 @@ def local_release_identity(root: Path, tag: str) -> str:
         raise FirstKillError("could not inspect the qualified local release tag") from error
     if kind.returncode or kind.stdout.strip() != "tag":
         raise FirstKillError(f"the local {tag} reference is missing or is not an annotated tag")
-    if resolved.returncode or resolved.stdout.strip() != DEFAULT_TAG_COMMIT:
-        raise FirstKillError(f"the local {tag} tag does not resolve to the qualified commit")
-    return DEFAULT_TAG_COMMIT
+    commit = resolved.stdout.strip()
+    if resolved.returncode or len(commit) != 40 or any(
+        character not in "0123456789abcdef" for character in commit.lower()
+    ):
+        raise FirstKillError(f"the local {tag} tag does not resolve to a commit")
+    return commit
 
 
 def run_preflight(operator_value: str | None, tag: str) -> int:
@@ -258,9 +260,9 @@ def run_preflight(operator_value: str | None, tag: str) -> int:
                     "local_annotated_tag_identity",
                 ],
                 "mode": "preflight-only",
-                "qualified_commit": commit,
                 "result": "PREFLIGHT_PASSED",
                 "tag": tag,
+                "tag_commit": commit,
             },
             indent=2,
             sort_keys=True,
@@ -297,7 +299,7 @@ def verify_tag(root: Path, tag: str, key: Path) -> str:
 def release_files(tag: str, workspace: Path) -> tuple[Path, Path]:
     version = tag.removeprefix("v")
     if not version.replace(".", "").isdigit() or version.count(".") != 2:
-        raise FirstKillError("tag must look like v0.5.0")
+        raise FirstKillError("tag must look like v1.0.0")
     base = f"https://github.com/{REPOSITORY}/releases/download/{tag}"
     sums = workspace / "SHA256SUMS"
     bundle = workspace / f"lumi-eggcracker-{version}-linux.zip"

scripts/support_bundle.py

@@ -1,17 +1,53 @@
-"""Write a local redacted support bundle from a source checkout."""
+"""Write a local redacted support bundle through the installed zipapp."""
 
 from __future__ import annotations
 
 import argparse
-import sys
+import os
+import stat
 from pathlib import Path
 
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "src"))
+INSTALLED_APP = Path("/usr/local/lib/lumi-eggcracker/lumi-eggcracker.pyz")
 
-from lumi_eggcracker.support_bundle import main
 
-parser = argparse.ArgumentParser(description="write a local redacted Eggcracker support bundle")
-parser.add_argument("--output", required=True, type=Path)
-args = parser.parse_args()
-raise SystemExit(main(args.output))
+def validated_installed_app(path: Path = INSTALLED_APP) -> Path:
+    try:
+        metadata = path.lstat()
+    except FileNotFoundError as error:
+        raise RuntimeError("Eggcracker is not installed") from error
+    if not stat.S_ISREG(metadata.st_mode) or path.is_symlink():
+        raise RuntimeError("installed Eggcracker zipapp is not a regular file")
+    if metadata.st_uid != 0 or metadata.st_mode & 0o022:
+        raise RuntimeError("installed Eggcracker zipapp has unsafe ownership or mode")
+    return path
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="write a local redacted Eggcracker support bundle"
+    )
+    parser.add_argument("--output", required=True, type=Path)
+    args = parser.parse_args(argv)
+    if os.geteuid() != 0:
+        parser.error("support bundle must run as root")
+    try:
+        app = validated_installed_app()
+    except RuntimeError as error:
+        parser.error(str(error))
+    os.execv(
+        "/usr/bin/python3",
+        [
+            "/usr/bin/python3",
+            "-I",
+            "-S",
+            str(app),
+            "support-bundle",
+            "--output",
+            str(args.output),
+        ],
+    )
+    raise RuntimeError("exec returned unexpectedly")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tests/test_first_kill.py

@@ -12,6 +12,7 @@ from pathlib import Path
 from unittest import mock
 
 ROOT = Path(__file__).resolve().parents[1]
+TAG_COMMIT = "a" * 40
 SPEC = importlib.util.spec_from_file_location("first_kill", ROOT / "scripts" / "first_kill.py")
 if SPEC is None or SPEC.loader is None:
     raise RuntimeError("cannot load first-kill script")
@@ -20,6 +21,9 @@ SPEC.loader.exec_module(first_kill)
 
 
 class FirstKillTests(unittest.TestCase):
+    def test_default_release_identity_is_the_1_0_candidate(self) -> None:
+        self.assertEqual("v1.0.0", first_kill.DEFAULT_TAG)
+
     def test_preflight_exits_before_every_mutating_or_network_step(self) -> None:
         output = io.StringIO()
         with (
@@ -29,7 +33,7 @@ class FirstKillTests(unittest.TestCase):
             mock.patch.object(
                 first_kill,
                 "local_release_identity",
-                return_value=first_kill.DEFAULT_TAG_COMMIT,
+                return_value=TAG_COMMIT,
             ),
             mock.patch.object(first_kill, "prepare_workspace") as prepare_workspace,
             mock.patch.object(first_kill, "release_files") as release_files,
@@ -55,6 +59,8 @@ class FirstKillTests(unittest.TestCase):
             forbidden.assert_not_called()
         summary = json.loads(output.getvalue())
         self.assertEqual("PREFLIGHT_PASSED", summary["result"])
+        self.assertEqual(TAG_COMMIT, summary["tag_commit"])
+        self.assertNotIn("qualified_commit", summary)
         self.assertFalse(summary["changes_made"])
         self.assertNotIn("/checkout", output.getvalue())
 
@@ -89,16 +95,25 @@ class FirstKillTests(unittest.TestCase):
         self.assertNotIn(canary, errors.getvalue())
         self.assertIn("operator account does not exist", errors.getvalue())
 
-    def test_local_release_identity_requires_annotated_pinned_tag(self) -> None:
+    def test_local_release_identity_requires_annotated_tag(self) -> None:
         annotated = mock.Mock(returncode=0, stdout="tag\n")
-        resolved = mock.Mock(returncode=0, stdout=f"{first_kill.DEFAULT_TAG_COMMIT}\n")
+        resolved = mock.Mock(returncode=0, stdout=f"{TAG_COMMIT}\n")
         with mock.patch.object(first_kill, "run", side_effect=[annotated, resolved]):
             result = first_kill.local_release_identity(Path("/checkout"), first_kill.DEFAULT_TAG)
-        self.assertEqual(first_kill.DEFAULT_TAG_COMMIT, result)
+        self.assertEqual(TAG_COMMIT, result)
+
+    def test_local_release_identity_rejects_non_commit_output(self) -> None:
+        annotated = mock.Mock(returncode=0, stdout="tag\n")
+        malformed = mock.Mock(returncode=0, stdout="not-a-commit\n")
+        with (
+            mock.patch.object(first_kill, "run", side_effect=[annotated, malformed]),
+            self.assertRaisesRegex(first_kill.FirstKillError, "does not resolve"),
+        ):
+            first_kill.local_release_identity(Path("/checkout"), first_kill.DEFAULT_TAG)
 
     def test_local_release_identity_rejects_lightweight_tag(self) -> None:
         lightweight = mock.Mock(returncode=0, stdout="commit\n")
-        resolved = mock.Mock(returncode=0, stdout=f"{first_kill.DEFAULT_TAG_COMMIT}\n")
+        resolved = mock.Mock(returncode=0, stdout=f"{TAG_COMMIT}\n")
         with (
             mock.patch.object(first_kill, "run", side_effect=[lightweight, resolved]),
             self.assertRaisesRegex(first_kill.FirstKillError, "not an annotated tag"),

tests/test_support_bundle.py

@@ -1,15 +1,57 @@
 from __future__ import annotations
 
+import importlib.util
 import os
 import tempfile
 import unittest
 from pathlib import Path
+from unittest import mock
 
 from lumi_eggcracker import support_bundle
 from lumi_eggcracker.jsonio import JsonInputError
 
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT_SPEC = importlib.util.spec_from_file_location(
+    "support_bundle_script", ROOT / "scripts" / "support_bundle.py"
+)
+if SCRIPT_SPEC is None or SCRIPT_SPEC.loader is None:
+    raise RuntimeError("cannot load support-bundle script")
+support_bundle_script = importlib.util.module_from_spec(SCRIPT_SPEC)
+SCRIPT_SPEC.loader.exec_module(support_bundle_script)
+
 
 class SupportBundleTests(unittest.TestCase):
+    @unittest.skipUnless(os.name == "posix", "installed helper is native-Linux behavior")
+    def test_release_helper_delegates_to_installed_zipapp(self) -> None:
+        installed = Path("/usr/local/lib/lumi-eggcracker/lumi-eggcracker.pyz")
+        with (
+            mock.patch.object(support_bundle_script.os, "geteuid", return_value=0),
+            mock.patch.object(
+                support_bundle_script,
+                "validated_installed_app",
+                return_value=installed,
+            ),
+            mock.patch.object(
+                support_bundle_script.os,
+                "execv",
+                side_effect=OSError("sentinel"),
+            ) as execute,
+            self.assertRaisesRegex(OSError, "sentinel"),
+        ):
+            support_bundle_script.main(["--output", "/tmp/support.json"])
+        execute.assert_called_once_with(
+            "/usr/bin/python3",
+            [
+                "/usr/bin/python3",
+                "-I",
+                "-S",
+                str(installed),
+                "support-bundle",
+                "--output",
+                "/tmp/support.json",
+            ],
+        )
+
     @staticmethod
     def query(action: str, **_args: object) -> dict[str, object]:
         if action == "doctor":