9a204e2266
logs.mjs --rotation reads the old fingerprints from the dated .old-* files once the .next files are gone; fresh-repo.sh scrubs the dated secret files too; ship-app.mjs mirrors payload-inputs.json.sig. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
566 lines
44 KiB
Markdown
566 lines
44 KiB
Markdown
# Rotation phase 2: the 0.3.6 handover, the deletion of the old folder and key, the fresh repository (5 October 2026)
|
|
|
|
Internal. Phase 1 (4 October, 19:25 UTC) generated the NEXT intake key and the NEXT downloads token into
|
|
`~/.config/igneum/log-intake-key.next` and `~/.config/igneum/dl-token.next`, taught `site/api/log.mjs` to accept
|
|
`LOG_INTAKE_KEY_NEXT` next to `LOG_INTAKE_KEY`, and staged a second downloads folder `dl/<new token>/` with the
|
|
installers of the day. Phase 2 is this file: the 0.3.6 build carries the new values, every installed 0.3.5 is carried
|
|
across while the old folder still serves, then the old folder and the old key die, and only then the history is
|
|
rewritten into a fresh repository (owner's decision, 5 October 2026; `docs/plans/history-rewrite.md`, option B).
|
|
|
|
REMINDER, 7 October 2026: once `node tools/logs.mjs --rotation` shows Sam's Mac 3a9bf309 on 0.3.8 (moved), run section 8f: the old intake key off the site, the relay and GitHub, the old folder off the downloads host; the old files wait in `~/igneum-dl-old-20261005` until 12 October.
|
|
|
|
No value is written here. Each is named by its fingerprint, the first 8 hex of sha256 over the trimmed value
|
|
(`tr -d '[:space:]' < ~/.config/igneum/<file> | shasum -a 256 | cut -c1-8`; the app logs the same 8 characters):
|
|
|
|
| Value | File | Fingerprint | Where it lives today |
|
|
|---|---|---|---|
|
|
| old intake key | `~/.config/igneum/log-intake-key` | `e2005de8` | every installed app's `igneum-app.json` (0.3.0 to 0.3.5); the site project's `LOG_INTAKE_KEY`; 6 tracked files until this branch, 8 commits of the history |
|
|
| new intake key | `~/.config/igneum/log-intake-key.next` | `477bb0ef` | nowhere yet (the site accepts it once `LOG_INTAKE_KEY_NEXT` is set) |
|
|
| old downloads token | `~/.config/igneum/dl-token` | `df66a82c` | every installed app's manifest URL; `dl/<old>/` holds every version 0.1.0 to 0.3.5, the jobs file, the CI inputs; the `DL_TOKEN` repository secret; 1 commit of the history (`docs/plans/morning-2026-10-04.md`, masked on this branch) |
|
|
| new downloads token | `~/.config/igneum/dl-token.next` | `ed9c4d2e` | `dl/<new>/` with the 0.3.3 installers and the WSL2 zip only, no manifest, no jobs file, no CI inputs |
|
|
|
|
## 1. What this branch changes (`rotation-2`)
|
|
|
|
| File | Change |
|
|
|---|---|
|
|
| `packaging/mac/packaged-config.sh` | no key literal any more. `IGNEUM_INTAKE_KEY_FILE` and `IGNEUM_DL_TOKEN_FILE` name the files; each defaults to the `.next` file when it exists, else the plain file. Prints file names, lengths and fingerprints, never values. `--test` runs its 23 checks on temporary files |
|
|
| `packaging/windows/make-payload.sh` | sources `packaged-config.sh` and calls `write_packaged_config` (it used to `sed` the key out of that file) |
|
|
| `.github/workflows/windows.yml` | a "packaged configuration" step writes the repository secrets `DL_TOKEN`, `DL_TOKEN_NEXT`, `LOG_INTAKE_KEY`, `LOG_INTAKE_KEY_NEXT` to the same files under `~/.config/igneum` on the runner, so `make-payload.sh` picks them exactly as on the Mac; `LOG_INTAKE_KEY` or `LOG_INTAKE_KEY_NEXT` is now required (the key no longer comes from the tree) |
|
|
| `app/igneum-app/src/config.rs` | `Packaged::with_env_overrides()` honours the same two variables on a running engine (a developer run, or a package built with the old values); `describe()` is the new header line `config: intake <url> key <fp> (<source>); manifest <url with the token masked> folder <fp> (<source>)`; `fingerprint8`, `manifest_url_for_token`, `token_of_manifest_url`, `read_secret_file`; 6 new unit tests |
|
|
| `app/igneum-app/src/main.rs`, `engine.rs` | the overrides applied at load; the `config:` line logged right after the `IGNEUM-APP` header at every engine start (so every upload carries it) |
|
|
| `tools/ship-app.mjs` | `--dl-both`: a `mirror` step copies the version's files and the folder-level files into `dl/<dl-token.next>/`, the `manifest` step publishes a second manifest there (`--dest`, `--base-url`, carrying the first manifest's `override`, `tuning` and `min_supported_version`, compared field by field), one deploy, `verify` checks both folders; self-test covers the three helpers |
|
|
| `tools/logs.mjs` | `--rotation`: every app machine's version and header fingerprints against the `.next` files, exit 1 while any machine is behind; `--self-test` |
|
|
| `infra/gpu-bench/upload.sh`, `proving/windows-wsl2/prove-block.sh`, `prove-shard.sh`, `proto-cuda/windows-app/upload-log.bat`, `proto-cuda/windows-miner/upload-log.bat` | the key literal removed: environment (`IGNEUM_LOG_KEY` or `IGNEUM_INTAKE_KEY`, which the app's job runner already sets), `IGNEUM_INTAKE_KEY_FILE`, or `igneum-log-key.txt` next to the .bat; the tree carries neither value now (`git grep` of both reads 0 files) |
|
|
| `tools/repo/fresh-repo.sh` | the history rewrite of `docs/plans/history-rewrite.md` section 2 as one script with the verification greps and the printed push commands (section 6 below) |
|
|
| `docs/plans/history-rewrite.md` | brought over from `testnet-prep` unchanged, so this branch carries the plan it executes |
|
|
|
|
## 2. The handover, as designed
|
|
|
|
An installed app reads `igneum-app.json` next to its engine (macOS `Contents/Resources`, Windows the install folder):
|
|
the manifest URL and the intake key. The OTA path replaces the whole bundle or runs the whole installer, and both
|
|
carry a new `igneum-app.json`, so the values travel with the version. Nothing is cached in the app data folder.
|
|
|
|
| Step | 0.3.5 on a machine (old folder, old key) | 0.3.6 (new folder, new key) |
|
|
|---|---|---|
|
|
| hourly check | fetches `dl/<old>/igneum-app-latest.json`: 0.3.6 is there (published in BOTH folders), signed by the same key | fetches `dl/<new>/igneum-app-latest.json`: itself |
|
|
| download | the URL inside the old folder's manifest, `dl/<old>/Igneum-Miner-0.3.6.dmg` or `-Setup-0.3.6.exe` (byte-identical to the new folder's copy) | nothing |
|
|
| apply | the new bundle or installer brings `igneum-app.json` with the NEW manifest URL and the NEW key | |
|
|
| after restart | reports to the intake with the new key (`LOG_INTAKE_KEY_NEXT` accepts it); its header reads `key 477bb0ef` and `folder ed9c4d2e`; next check hits the NEW folder | the same |
|
|
| jobs | `igneum-jobs.json` is read next to the manifest, so the mirror step copies the jobs file and its signature into the new folder; any job published while both folders live goes to both (section 3d) | |
|
|
|
|
The window: every 0.3.5 machine must apply 0.3.6 before the old folder goes. Machines apply in their own minute of the
|
|
hour and only when the node is synced, so the window is hours, not minutes. The old folder and the old key stay until
|
|
`node tools/logs.mjs --rotation` reads 0 behind (section 4). Nothing is deleted on a schedule.
|
|
|
|
## 3. The publish, exactly
|
|
|
|
Everything below runs from the main checkout after this branch is merged to master. `DLSITE` is the downloads folder
|
|
(`~/.config/igneum/dlsite-dir`), `OLD` and `NEW` the two tokens read from their files; neither is ever typed.
|
|
|
|
### 3a. Before the cut (by hand, once)
|
|
|
|
```
|
|
# the site must accept both keys (names only are listed; the value is piped from the file)
|
|
cd site && npx --yes vercel@latest --global-config ~/.config/igneum/vercel link --scope igneum --project igneum --yes
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env ls --scope igneum # LOG_INTAKE_KEY must be there; is LOG_INTAKE_KEY_NEXT?
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key.next | npx --yes vercel@latest --global-config ~/.config/igneum/vercel env add LOG_INTAKE_KEY_NEXT production --scope igneum
|
|
cd .. && git push origin master # or any production deploy: the function reads the variable at the next deploy
|
|
# confirm: a POST with the NEXT key is accepted (200 with an id), the old one still is too
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key.next)" -H 'Content-Type: application/json' -d '{"label":"rotation-check","machine":"mac","run_id":"rotation-check","lines":"next key accepted"}' https://igneum-six.vercel.app/api/log
|
|
|
|
# the Windows build on GitHub needs the same files (the runner writes the secrets to ~/.config/igneum; windows.yml)
|
|
gh auth switch --user igneum-labs
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | gh secret set LOG_INTAKE_KEY --repo igneum-network/igneum
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key.next | gh secret set LOG_INTAKE_KEY_NEXT --repo igneum-network/igneum
|
|
tr -d '[:space:]' < ~/.config/igneum/dl-token.next | gh secret set DL_TOKEN_NEXT --repo igneum-network/igneum
|
|
gh secret list --repo igneum-network/igneum # DL_TOKEN, DL_TOKEN_NEXT, LOG_INTAKE_KEY, LOG_INTAKE_KEY_NEXT
|
|
|
|
# the new folder exists and is empty of a manifest (the mirror step fills it)
|
|
DLSITE="$(tr -d '[:space:]' < ~/.config/igneum/dlsite-dir)"; NEW="$(tr -d '[:space:]' < ~/.config/igneum/dl-token.next)"
|
|
ls "$DLSITE/dl/$NEW"
|
|
packaging/mac/packaged-config.sh --test # 23 checks
|
|
```
|
|
|
|
### 3b. The cut: one command, both folders
|
|
|
|
```
|
|
node tools/ship-app.mjs 0.3.6 --node <fork worktree> --notes "<one line>" --dl-both --dry-run # the plan, nothing written
|
|
node tools/ship-app.mjs 0.3.6 --node <fork worktree> --notes "<one line>" --dl-both
|
|
```
|
|
|
|
With `--dl-both` the steps are: preflight (also: `dl-token.next` present and different, the folder exists) > bump >
|
|
inputs > commit and push (the Windows build starts; its payload step runs `packaged-config.sh --test` and packages
|
|
the `.next` values because the `_NEXT` secrets are set) > ci > fetch (installer and zip into the OLD folder) > dmg
|
|
(`build-dmg.sh` packages `igneum-app.json` from the `.next` files by default) > copy (DMG into the OLD folder) >
|
|
mirror (DMG, installer, zip, `igneum-windows-ci.json`, `igneum-jobs.json` and `.sig`, `payload-inputs.{zip,json,sha256}`,
|
|
`igneum-prove-wsl2.zip` into the NEW folder, sha256-checked) > manifest (section 3c, both) > deploy (one) > verify
|
|
(both folders: HEAD and GET of every file, both manifests byte-identical to the local ones and verifying, every
|
|
platform URL inside its own folder) > console.
|
|
|
|
The build itself prints which files it packaged, for example `intake key: ~/.config/igneum/log-intake-key.next (31 chars,
|
|
fingerprint 477bb0ef)` and `manifest: ~/.config/igneum/dl-token.next (10 chars, fingerprint ed9c4d2e) -> https://dl.igneum.network/dl/<token>/igneum-app-latest.json`.
|
|
A build that says `e2005de8` or `df66a82c` packaged the old values: stop, the `.next` files were not found.
|
|
|
|
### 3c. The same by hand with `packaging/ota/publish-manifest.sh` (what the manifest step runs)
|
|
|
|
`publish-manifest.sh` writes the OLD folder by default (it reads `~/.config/igneum/dl-token`); `--dest <folder>` and
|
|
`--base-url <url>` aim it at the NEW folder. With `--dest` it carries `consensus.override`, `tuning` and
|
|
`min_supported_version` over from the manifest already in THAT folder, which is none, so the second call must pass
|
|
what the first manifest carries. `--deploy` is refused with `--dest`; one deploy of the whole folder follows.
|
|
Run by hand, `publish-manifest.sh` prints the manifest it wrote, URLs included, so the terminal shows the token
|
|
path (it always has); `ship-app.mjs` scrubs both tokens from every line, which is the reason to prefer 3b.
|
|
|
|
```
|
|
DLSITE="$(tr -d '[:space:]' < ~/.config/igneum/dlsite-dir)"
|
|
OLD="$(tr -d '[:space:]' < ~/.config/igneum/dl-token)"; NEW="$(tr -d '[:space:]' < ~/.config/igneum/dl-token.next)"
|
|
V=0.3.6; NOTES="<one line>"
|
|
|
|
# 1. the OLD folder (default dest and base): the files are there from fetch and copy
|
|
packaging/ota/publish-manifest.sh --version $V --notes "$NOTES" --no-deploy \
|
|
--mac "$DLSITE/dl/$OLD/Igneum-Miner-$V.dmg" --win "$DLSITE/dl/$OLD/Igneum-Miner-Setup-$V.exe"
|
|
|
|
# 2. the NEW folder: the same bytes copied in, the same override, tuning and min_supported read from the first manifest
|
|
cp "$DLSITE/dl/$OLD/Igneum-Miner-$V.dmg" "$DLSITE/dl/$OLD/Igneum-Miner-Setup-$V.exe" "$DLSITE/dl/$OLD/igneum-windows-app.zip" \
|
|
"$DLSITE/dl/$OLD/igneum-windows-ci.json" "$DLSITE/dl/$OLD/igneum-jobs.json" "$DLSITE/dl/$OLD/igneum-jobs.json.sig" \
|
|
"$DLSITE/dl/$OLD/payload-inputs.zip" "$DLSITE/dl/$OLD/payload-inputs.json" "$DLSITE/dl/$OLD/payload-inputs.sha256" \
|
|
"$DLSITE/dl/$OLD/igneum-prove-wsl2.zip" "$DLSITE/dl/$NEW/"
|
|
M="$DLSITE/dl/$OLD/igneum-app-latest.json"
|
|
OVERRIDE="$(python3 -c 'import json,sys; o=json.load(open(sys.argv[1])).get("consensus",{}).get("override"); print(json.dumps(o,sort_keys=True,separators=(",",":")) if o else "")' "$M")"
|
|
MINSUP="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("min_supported_version",""))' "$M")"
|
|
python3 -c 'import json,sys; t=json.load(open(sys.argv[1])).get("tuning"); open(sys.argv[2],"w").write(json.dumps(t)) if t else None' "$M" /tmp/tuning-$V.json
|
|
packaging/ota/publish-manifest.sh --version $V --notes "$NOTES" --no-deploy \
|
|
--dest "$DLSITE/dl/$NEW" --base-url "https://dl.igneum.network/dl/$NEW" \
|
|
--mac "$DLSITE/dl/$NEW/Igneum-Miner-$V.dmg" --win "$DLSITE/dl/$NEW/Igneum-Miner-Setup-$V.exe" \
|
|
${OVERRIDE:+--override "$OVERRIDE"} ${MINSUP:+--min-supported "$MINSUP"} $([ -s /tmp/tuning-$V.json ] && echo --tuning /tmp/tuning-$V.json || echo --no-tuning)
|
|
rm -f /tmp/tuning-$V.json
|
|
# the two manifests must differ only in published_at and the folder inside the URLs
|
|
diff <(python3 -c 'import json,sys; m=json.load(open(sys.argv[1])); m.pop("published_at"); print(json.dumps(m,sort_keys=True,indent=1).replace(sys.argv[2],"T"))' "$M" "$OLD") \
|
|
<(python3 -c 'import json,sys; m=json.load(open(sys.argv[1])); m.pop("published_at"); print(json.dumps(m,sort_keys=True,indent=1).replace(sys.argv[2],"T"))' "$DLSITE/dl/$NEW/igneum-app-latest.json" "$NEW") && echo "same fields"
|
|
|
|
# 3. one deploy, then both live checks (each: reachable, byte-identical to the local file, signature verifies)
|
|
(cd "$DLSITE" && npx --yes vercel@latest --global-config ~/.config/igneum/vercel deploy --prod --yes)
|
|
packaging/ota/publish-manifest.sh --verify-only
|
|
packaging/ota/publish-manifest.sh --verify-only --dest "$DLSITE/dl/$NEW" --base-url "https://dl.igneum.network/dl/$NEW"
|
|
```
|
|
|
|
### 3d. Jobs while both folders live
|
|
|
|
`packaging/ota/publish-jobs.sh` writes `dl/<old>/igneum-jobs.json` by default and takes the same `--dest` and
|
|
`--base-url`. Until the old folder is deleted, every `add` or `expire` is published twice, the second time with
|
|
`--dest "$DLSITE/dl/$NEW" --base-url "https://dl.igneum.network/dl/$NEW"`, then one deploy. A job whose
|
|
`zip_url` names the old folder keeps working until that folder goes; publish new jobs with URLs in the new folder.
|
|
|
|
## 4. Verification: every machine's header shows the new intake path
|
|
|
|
The engine logs two header lines at every start, and the restart after an OTA apply logs them again, so the latest
|
|
upload of every machine carries them:
|
|
|
|
```
|
|
IGNEUM-APP version=0.3.6 machine=<id8> platform=<os> node=<igneumd version>
|
|
config: intake https://igneum-six.vercel.app/api/log key 477bb0ef (packaged); manifest https://dl.igneum.network/dl/<token>/igneum-app-latest.json folder ed9c4d2e (packaged)
|
|
```
|
|
|
|
```
|
|
node tools/logs.mjs --rotation # one row per app machine: version, key fp, folder fp, sources, state; exit 1 while any is behind
|
|
node tools/logs.mjs <run_id> | grep -E 'IGNEUM-APP|config: intake' # one machine in full
|
|
```
|
|
|
|
Done means: every row `moved` (key `477bb0ef`, folder `ed9c4d2e`, version 0.3.6), none `OLD`, and the `unknown` rows
|
|
(a machine whose last upload predates this header, or a machine that has stopped for good) accounted for by name.
|
|
Today the table shows 6 app machines (three `win-`, three `mac-`), all 0.3.5 or older, all `unknown` because 0.3.5
|
|
has no `config:` line. The console's Machines tab (`relay/`) shows the versions the same way.
|
|
|
|
Also check, once, that the intake stores an upload under the new key from a real machine (the row's `last_received`
|
|
moves after the restart), and that `node tools/logs.mjs` lists no new `rotation-check` rows beyond the one from 3a.
|
|
|
|
## 5. The deletion, after section 4 reads 0 behind
|
|
|
|
In this order, each step checked before the next:
|
|
|
|
```
|
|
DLSITE="$(tr -d '[:space:]' < ~/.config/igneum/dlsite-dir)"
|
|
OLD="$(tr -d '[:space:]' < ~/.config/igneum/dl-token)"; NEW="$(tr -d '[:space:]' < ~/.config/igneum/dl-token.next)"
|
|
node tools/logs.mjs --rotation || { echo "machines still behind"; false; }
|
|
|
|
# 1. the old folder: gone from the downloads host (one deploy); the new one still serves
|
|
mv "$DLSITE/dl/$OLD" "$HOME/igneum-dl-old-$(date -u +%Y%m%d)" # kept outside the site for a week, then rm -rf
|
|
(cd "$DLSITE" && npx --yes vercel@latest --global-config ~/.config/igneum/vercel deploy --prod --yes)
|
|
curl -s -o /dev/null -w '%{http_code}\n' "https://dl.igneum.network/dl/$OLD/igneum-app-latest.json" # 404
|
|
packaging/ota/publish-manifest.sh --verify-only --dest "$DLSITE/dl/$NEW" --base-url "https://dl.igneum.network/dl/$NEW" # still live
|
|
|
|
# 2. the local files: the NEXT values become the plain ones (every script's default), the old ones kept dated
|
|
mv ~/.config/igneum/log-intake-key ~/.config/igneum/log-intake-key.old-$(date -u +%Y%m%d)
|
|
mv ~/.config/igneum/log-intake-key.next ~/.config/igneum/log-intake-key
|
|
mv ~/.config/igneum/dl-token ~/.config/igneum/dl-token.old-$(date -u +%Y%m%d)
|
|
mv ~/.config/igneum/dl-token.next ~/.config/igneum/dl-token
|
|
packaging/ota/publish-manifest.sh --verify-only # now reads the new token by default: live, verified
|
|
|
|
# 3. the intake: the old key dropped (LOG_INTAKE_KEY becomes the new value, LOG_INTAKE_KEY_NEXT removed), redeployed
|
|
cd site
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY production --scope igneum --yes
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | npx --yes vercel@latest --global-config ~/.config/igneum/vercel env add LOG_INTAKE_KEY production --scope igneum
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY_NEXT production --scope igneum --yes
|
|
cd .. && git push origin master # or a production deploy
|
|
# the old key is dead (401), the new one lives (200)
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key.old-$(date -u +%Y%m%d))" -H 'Content-Type: application/json' -d '{"label":"rotation-check","machine":"mac","run_id":"rotation-check","lines":"old key must be refused"}' https://igneum-six.vercel.app/api/log
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key)" -H 'Content-Type: application/json' -d '{"label":"rotation-check","machine":"mac","run_id":"rotation-check","lines":"new key accepted"}' https://igneum-six.vercel.app/api/log
|
|
|
|
# 4. the GitHub secrets: the plain names carry the new values, the _NEXT names go
|
|
tr -d '[:space:]' < ~/.config/igneum/dl-token | gh secret set DL_TOKEN --repo igneum-network/igneum
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | gh secret set LOG_INTAKE_KEY --repo igneum-network/igneum
|
|
gh secret delete DL_TOKEN_NEXT --repo igneum-network/igneum; gh secret delete LOG_INTAKE_KEY_NEXT --repo igneum-network/igneum
|
|
|
|
# 5. the app machines keep reporting (a last look, an hour later)
|
|
node tools/logs.mjs --rotation
|
|
```
|
|
|
|
The relay is not involved: since round 4 (X23) it has its own key (`~/.config/igneum/relay-key`, `RELAY_KEY`), and
|
|
the intake key only reports. The old launcher packages under `proto-cuda/windows-app` and `windows-miner` (0.2.0)
|
|
carried the old key in `upload-log.bat`; those machines are the `unknown` rows of section 4 and upload nothing after
|
|
step 3, which is the intent.
|
|
|
|
## 6. The fresh repository, after section 5
|
|
|
|
The old values are dead values once section 5 is done; only then is the rewrite worth running. The owner's two
|
|
settings come first: rename the GitHub login `igneum-labs` to a neutral handle (the numeric noreply id 337424239
|
|
stays, so the rewritten author line is `<new> <337424239+<new>@users.noreply.github.com>`), and remove the second
|
|
login from the organisation's owners. Then, from the main checkout with every agent frozen:
|
|
|
|
```
|
|
gh pr list --repo igneum-network/igneum # must be empty
|
|
git worktree list > ~/igneum-worktrees-$(date -u +%Y%m%d).txt
|
|
IGNEUM_FILTER_REPO=<dir>/git_filter_repo.py tools/repo/fresh-repo.sh --new-login <new handle> --new-repo igneum-network/<name> \
|
|
[--public-claude-md <scrubbed CLAUDE.md>] --work ~/igneum-rewrite
|
|
```
|
|
|
|
The script clones `origin` afresh (mirror, no hardlinks), reads the personal identities and the second login from
|
|
the history and the four secret values from `~/.config/igneum`, writes the rule files 0600 and removes them after
|
|
the pass, runs the one `git-filter-repo` invocation of `docs/plans/history-rewrite.md` section 2 (drop the four
|
|
internal files, replace the secrets and the names, mailmap both personal identities to the login, every offset to
|
|
`+0000`, optionally the public `CLAUDE.md` in every commit), then demands zero for: secret lines in any blob,
|
|
identity lines in any blob, identity lines in commit metadata, stamps not `+0000`, commits touching the dropped
|
|
files, identities other than the login, the old login in any blob (with `--new-login`). It prints the push commands
|
|
and runs none of them: `gh repo create igneum-network/<name> --private`, `git remote add origin` in the clone,
|
|
`git push --mirror origin`, then the GitHub secrets (section 3a), the Vercel Git connection moved to the new
|
|
repository, the old repository archived, the main checkout re-cloned and every worktree re-created from its
|
|
rewritten branch.
|
|
|
|
### Dry run of 5 October 2026 (throwaway mirror clone of the main checkout under the session scratchpad, nothing pushed)
|
|
|
|
| Count | Before | After |
|
|
|---|---|---|
|
|
| commits (all refs) | 410 | 353 (57 commits that only touched the four dropped files are gone) |
|
|
| refs | 49 | 29 (filter-repo drops the remote-tracking refs of the mirror) |
|
|
| author and committer identities | 3 | 1 (`igneum-labs <337424239+[removed]>`) |
|
|
| stamps not +0000 | 660 of 820 | 0 of 706 |
|
|
| commits touching the four dropped files | 53 | 0 |
|
|
| secret lines in any blob (old key, new key, old token, new token) | 21 | 0 |
|
|
| identity lines in any blob (first name outside the login, surname, personal addresses, second login, the other businesses) | 1839 | 0 |
|
|
| identity lines in commit metadata | 171 | 0 |
|
|
| standing login lines in any blob | 94 | 61 (0 with `--new-login` after the rename) |
|
|
| pass run time | | 67 s; 4 min with the clone and the greps |
|
|
|
|
The report sits next to the clone (`<work>/report.txt`, with `commit-map`, 411 lines). The throwaway clone was
|
|
removed after the run; nothing left the Mac.
|
|
|
|
## 7. The order for the afternoon
|
|
|
|
1. Merge `rotation-2` into master (the Windows build on that push packages with the `_NEXT` secrets only when they
|
|
exist: set them first, section 3a, or expect the payload step to fail on the missing `LOG_INTAKE_KEY`).
|
|
2. Section 3a: the site's `LOG_INTAKE_KEY_NEXT`, the four repository secrets, the curl check.
|
|
3. Section 3b: `--dry-run`, then the cut with `--dl-both`.
|
|
4. Section 4 through the afternoon: `node tools/logs.mjs --rotation` until 0 behind (the slot rule means an hour or
|
|
two for a synced fleet; a machine that is off waits for its owner).
|
|
5. Section 5: the deletion, in order.
|
|
6. The owner's two GitHub settings (login rename, one owner); then section 6, the fresh repository, from a frozen tree.
|
|
|
|
## 8. Execution, 5 October 2026 (owner: "3 execute"; from 15:25 UTC, branch `rotation-3`)
|
|
|
|
The order the owner set differs from section 5 in one place: the old intake key stays until Sam's Mac is on 0.3.8,
|
|
because that machine uploads with the old key until it updates. So steps 1, 2, 4 and 5 of section 5 ran today in the
|
|
owner's order (folder, local files, relay, GitHub), and the intake swap (section 5 step 3, plus the same swap on the
|
|
relay) is written out in 8f for 7 October.
|
|
|
|
### 8a. State at the start (`node tools/logs.mjs --rotation`, 15:25 UTC)
|
|
|
|
| Machine | Version | Key | Folder | Last upload (UTC) | State |
|
|
|---|---|---|---|---|---|
|
|
| mac-d937c69d (this Mac) | 0.3.8 | 477bb0ef | ed9c4d2e | 15:24:45 | moved |
|
|
| win-1ccfe586 (PC 2) | 0.3.8 | 477bb0ef | ed9c4d2e | 15:24:29 | moved |
|
|
| win-ae432dc7 (PC 1) | 0.3.8 | 477bb0ef | ed9c4d2e | 15:25:10 | moved |
|
|
| win-37ba0461 | 0.3.7 | 477bb0ef | ed9c4d2e | 13:52:20 | moved |
|
|
| mac-3a9bf309 (Sam's Mac, asleep) | 0.3.5 | - | - | 09:43:45 | unknown: reads the OLD folder and uploads with the OLD key |
|
|
| mac-MacBook-Pro | ? | - | - | 4 Oct 01:46:13 | unknown: a pre-header upload, stopped for good; accounted for |
|
|
|
|
Only Sam's Mac is behind. Its 0.3.5 checks the OLD manifest once an hour when its node is synced, downloads the file
|
|
named inside that manifest, and the new bundle carries the NEW manifest URL and the NEW key (section 2). Its job
|
|
runner polls `dl/<old>/igneum-jobs.json` every 10 minutes; a missing file is a quiet error in 0.3.5
|
|
(`jobrun.rs:338`, "no jobs file"), so the strip below costs it nothing.
|
|
|
|
### 8b. The OLD folder, stripped to what 0.3.5 needs (section 5 step 1, narrowed)
|
|
|
|
Kept, 4 files: `igneum-app-latest.json` (861 bytes, version 0.3.8, published 13:33:20Z, both platform URLs inside it
|
|
name the OLD folder), `igneum-app-latest.json.sig`, `Igneum-Miner-0.3.8.dmg` (41,247,419) and
|
|
`Igneum-Miner-Setup-0.3.8.exe` (19,794,320).
|
|
|
|
Before the strip, one copy into the NEW folder: `payload-inputs.json.sig` (129 bytes, byte-identical). The NEW folder
|
|
had never received it: `tools/ship-app.mjs` FOLDER_FILES carried the zip, the json and the sha256 but not the
|
|
signature, and `.github/workflows/windows.yml` fetches all four from the `DL_TOKEN` folder, which is the NEW folder
|
|
from 8e on. Without the copy the next Windows build would have failed at the inputs step. The list is fixed on this
|
|
branch (8h).
|
|
|
|
Removed: 56 files, 947,635,881 bytes, moved (not deleted) to `~/igneum-dl-old-20261005` (mode 0700), to be removed
|
|
on 12 October (8f step 6):
|
|
|
|
| File | Bytes | Modified (BST) | sha256 (first 12) |
|
|
|---|---|---|---|
|
|
| `Igneum-Miner-0.1.0.dmg` | 16994336 | 2026-10-03T23:28 | 69904f6191e0 |
|
|
| `Igneum-Miner-0.2.0.dmg` | 19924804 | 2026-10-04T08:57 | 2cb1c1d657bc |
|
|
| `Igneum-Miner-0.3.0.dmg` | 20320453 | 2026-10-04T12:46 | 670d26b49904 |
|
|
| `Igneum-Miner-0.3.1.dmg` | 20320855 | 2026-10-04T14:27 | 4b29d91cdd05 |
|
|
| `Igneum-Miner-0.3.2.dmg` | 20519491 | 2026-10-04T15:17 | 26fdc1e854ea |
|
|
| `Igneum-Miner-0.3.3.dmg` | 39775332 | 2026-10-04T17:56 | 3177bced3698 |
|
|
| `Igneum-Miner-0.3.4.dmg` | 39798913 | 2026-10-04T21:20 | 1b346811b807 |
|
|
| `Igneum-Miner-0.3.5.dmg` | 40027384 | 2026-10-05T07:39 | 2dad2b2615a6 |
|
|
| `Igneum-Miner-0.3.6.dmg` | 40156607 | 2026-10-05T10:34 | fddf3580353d |
|
|
| `Igneum-Miner-0.3.7.dmg` | 40156739 | 2026-10-05T11:16 | 8ee96b3b054f |
|
|
| `Igneum-Miner-Setup-0.3.0.exe` | 44005195 | 2026-10-04T12:46 | 42b3f167ba25 |
|
|
| `Igneum-Miner-Setup-0.3.1.exe` | 44013598 | 2026-10-04T14:32 | abc5b6226582 |
|
|
| `Igneum-Miner-Setup-0.3.2.exe` | 44138229 | 2026-10-04T15:17 | f5e0763ff126 |
|
|
| `Igneum-Miner-Setup-0.3.3.exe` | 44275245 | 2026-10-04T16:10 | 739f7e8af968 |
|
|
| `Igneum-Miner-Setup-0.3.4.exe` | 44304304 | 2026-10-04T21:14 | 756ee2c0af7f |
|
|
| `Igneum-Miner-Setup-0.3.5.exe` | 44447899 | 2026-10-05T07:38 | 0184abecaf99 |
|
|
| `Igneum-Miner-Setup-0.3.6.exe` | 19536899 | 2026-10-05T10:34 | ca0fb9197bee |
|
|
| `Igneum-Miner-Setup-0.3.7.exe` | 19784297 | 2026-10-05T11:16 | 2bacba64628b |
|
|
| `Igneum-Wallet-0.1.1.dmg` | 19565360 | 2026-10-05T09:24 | 02446a480dae |
|
|
| `Igneum-Wallet-0.1.2.dmg` | 19582462 | 2026-10-05T10:13 | 4ddfd7a07ac1 |
|
|
| `Igneum-Wallet-0.1.3.dmg` | 19598469 | 2026-10-05T14:21 | d5b7945e4fe8 |
|
|
| `build-inputs-t035.json` | 705 | 2026-10-05T10:17 | da48d4fbb7c4 |
|
|
| `build-inputs-t035.sha256` | 65 | 2026-10-05T10:17 | caa267821f17 |
|
|
| `build-inputs-t035.zip` | 7223133 | 2026-10-05T10:17 | d1dd841d9872 |
|
|
| `build-inputs-t036.json` | 701 | 2026-10-05T10:17 | a0cdfe1a83c8 |
|
|
| `build-inputs-t036.sha256` | 65 | 2026-10-05T10:17 | 37794f58f636 |
|
|
| `build-inputs-t036.zip` | 7244256 | 2026-10-05T10:17 | c01a7525a903 |
|
|
| `build-inputs-tests.json` | 1149 | 2026-10-05T10:04 | 0aa92c6a10f8 |
|
|
| `build-inputs-tests.sha256` | 65 | 2026-10-05T10:04 | 216760a99a61 |
|
|
| `build-inputs-tests.zip` | 8206608 | 2026-10-05T10:04 | f60713b133ec |
|
|
| `build-inputs.json` | 1046 | 2026-10-05T10:12 | ed3e06ef5fdf |
|
|
| `build-inputs.sha256` | 65 | 2026-10-05T10:12 | 0c0c2a0c186c |
|
|
| `build-inputs.zip` | 8206958 | 2026-10-05T10:12 | 7c63df808331 |
|
|
| `igneum-devnet-mac.dmg` | 17750579 | 2026-10-03T22:55 | c5b49d3c0097 |
|
|
| `igneum-jobs.json` | 64416 | 2026-10-05T15:04 | 6812e147601f |
|
|
| `igneum-jobs.json.sig` | 129 | 2026-10-05T15:04 | 3c3fbbeb258b |
|
|
| `igneum-mine-test-v2.zip` | 4442068 | 2026-10-03T22:52 | 16abd0ff2a42 |
|
|
| `igneum-mine-test-v3.zip` | 4442367 | 2026-10-03T22:52 | 646d6d4b659c |
|
|
| `igneum-mine-test.zip` | 4431923 | 2026-10-03T22:52 | ab1951f1450d |
|
|
| `igneum-node-windows-v4.zip` | 32973919 | 2026-10-04T08:57 | 8fbdc646596e |
|
|
| `igneum-node-windows.zip` | 29454819 | 2026-10-03T22:52 | beadad43d1f0 |
|
|
| `igneum-prove-wsl2-038.zip` | 1425452 | 2026-10-05T14:28 | 98c246146e89 |
|
|
| `igneum-prove-wsl2.zip` | 295176 | 2026-10-05T11:48 | 75e3a96fed84 |
|
|
| `igneum-wallet-latest.json` | 473 | 2026-10-05T14:21 | dc9bf8ac2bf5 |
|
|
| `igneum-wallet-latest.json.sig` | 129 | 2026-10-05T14:21 | 1568dbdc33d0 |
|
|
| `igneum-windows-app.zip` | 27591281 | 2026-10-05T14:33 | 8f08a3040ac7 |
|
|
| `igneum-windows-ci.json` | 199 | 2026-10-05T14:33 | f8e099c8c2c3 |
|
|
| `igneum-windows-v4.zip` | 64286803 | 2026-10-04T12:05 | a936c0f80715 |
|
|
| `igneum-windows.zip` | 22885438 | 2026-10-03T22:52 | 862d61098c4b |
|
|
| `igneum-worker-cuda.exe` | 1121792 | 2026-10-04T11:12 | 3f3f8337d53b |
|
|
| `mingw-runtime-gcc13.zip` | 8338215 | 2026-10-05T10:52 | 7f030f253571 |
|
|
| `mingw-runtime-x64.zip` | 9327832 | 2026-10-05T10:45 | b6671e811559 |
|
|
| `payload-inputs.json` | 995 | 2026-10-05T14:25 | 403d0108b1b8 |
|
|
| `payload-inputs.json.sig` | 129 | 2026-10-05T14:25 | a667d898e29e |
|
|
| `payload-inputs.sha256` | 65 | 2026-10-05T14:25 | e627981e8b09 |
|
|
| `payload-inputs.zip` | 26669995 | 2026-10-05T14:25 | b587ed19fac4 |
|
|
|
|
The deploy: one `vercel deploy --prod` of the downloads folder (`igneum-dl`), 15:29 UTC. Verified straight after:
|
|
|
|
| Check | Result |
|
|
|---|---|
|
|
| `packaging/ota/publish-manifest.sh --verify-only` (OLD folder, the default token at that moment) | version 0.3.8, byte-identical, signature OK, try 1 of 12 |
|
|
| the same with `--dest "$DLSITE/dl/$NEW" --base-url https://dl.igneum.network/dl/$NEW` | version 0.3.8, byte-identical, signature OK, try 1 of 12 |
|
|
| OLD folder, removed: `igneum-jobs.json`, `Igneum-Miner-0.3.7.dmg`, `build-inputs.zip`, `igneum-wallet-latest.json`, `payload-inputs.zip` | 404, 404, 404, 404, 404 |
|
|
| OLD folder, kept: the manifest, its signature, the 0.3.8 DMG, the 0.3.8 installer | 200, 200, 200, 200 |
|
|
| NEW folder: `payload-inputs.json.sig`, `igneum-jobs.json`, `igneum-jobs.json.sig`, `payload-inputs.zip` | 200, 200, 200, 200 |
|
|
|
|
Jobs whose `zip_url` names the OLD folder (the build jobs of the morning, `fetch-prove-038`, `rollback-035-pcs`) have
|
|
all run on their machines; a machine never re-runs a job it has finished, so nothing waits on those URLs. The wallet
|
|
manifest and DMGs left the OLD folder with everything else; the NEW folder carries `igneum-wallet-latest.json` and
|
|
`Igneum-Wallet-0.1.3.dmg` (mirrored 14:22 UTC). The wallet publisher is not on master (the wallet branch): if it reads
|
|
`dl-token` as every other publisher does, it writes the NEW folder from now on; confirm at the next wallet publish.
|
|
|
|
### 8c. The local files (section 5 step 2, as written)
|
|
|
|
```
|
|
mv ~/.config/igneum/log-intake-key ~/.config/igneum/log-intake-key.old-2026-10-05
|
|
mv ~/.config/igneum/log-intake-key.next ~/.config/igneum/log-intake-key
|
|
mv ~/.config/igneum/dl-token ~/.config/igneum/dl-token.old-2026-10-05
|
|
mv ~/.config/igneum/dl-token.next ~/.config/igneum/dl-token
|
|
```
|
|
|
|
| File | Mode | Fingerprint |
|
|
|---|---|---|
|
|
| `log-intake-key` | 0600 | 477bb0ef |
|
|
| `log-intake-key.old-2026-10-05` | 0600 | e2005de8 |
|
|
| `dl-token` | 0600 | ed9c4d2e |
|
|
| `dl-token.old-2026-10-05` | 0600 | df66a82c |
|
|
|
|
No `.next` file is left. Every script reads the NEW folder and the NEW key by default from here: `packaging/mac/packaged-config.sh --test`
|
|
all checks passed; `packaging/ota/publish-manifest.sh --verify-only` (now the NEW folder) 0.3.8, byte-identical,
|
|
signature OK; `publish-jobs.sh` has no next folder to mirror to, and the job another agent published at 15:32 UTC
|
|
landed in the NEW folder only, as intended. Two tools read the renamed files wrongly and are fixed on this branch (8h):
|
|
`tools/logs.mjs --rotation` printed the old fingerprints as 477bb0ef/ed9c4d2e (it took "old" from the plain files),
|
|
and `tools/repo/fresh-repo.sh` built its secret rules from the four plain names only, so the rewrite would have left
|
|
the OLD key and the OLD token in the history. The dated files stay until the fresh repository is pushed (8g step 10).
|
|
|
|
### 8d. The intake and the relay (section 5 step 3, split)
|
|
|
|
The site project `igneum` is untouched today: `LOG_INTAKE_KEY` (old) and `LOG_INTAKE_KEY_NEXT` (new) both stay, and
|
|
a POST to `/api/log` answered 200 with the new key and 200 with the old key (baseline for 8f; label
|
|
`rotation-check`). Sam's Mac keeps uploading with the old key until it has applied 0.3.8.
|
|
|
|
The relay project `igneum-relay` (`relay/lib/relay.mjs` `authed()` accepts `LOG_INTAKE_KEY` and `LOG_INTAKE_KEY_NEXT`
|
|
since this morning): `LOG_INTAKE_KEY_NEXT` added (production, piped from `~/.config/igneum/log-intake-key`), and
|
|
`DL_TOKEN` moved to the NEW token (`relay/api/console.mjs` reads the jobs file, the manifest and the CI record from
|
|
that folder, and the OLD folder no longer carries them). Deployed from the main checkout's `relay/` on master 23d11d5
|
|
with the command of `relay/README.md` (`vercel deploy --prod --yes --scope igneum`), 15:31 UTC.
|
|
|
|
| `POST https://relay.igneum.network/api/relay?fn=upload` with header `x-igneum-key` | Answer |
|
|
|---|---|
|
|
| the NEW key | `ok: true`, `api_version: 11`, 200 |
|
|
| the OLD key | `ok: true`, `api_version: 11`, 200 |
|
|
| a wrong key | 401 |
|
|
|
|
Relay env after: DL_TOKEN, LOG_INTAKE_KEY, LOG_INTAKE_KEY_NEXT, RELAY_KEY, RELAY_TOKEN, DATABASE_URL,
|
|
BLOB_READ_WRITE_TOKEN. `node tools/console.mjs jobs` lists the jobs through the NEW folder.
|
|
|
|
### 8e. The GitHub secrets (section 5 step 4, the token half)
|
|
|
|
`gh auth status`: igneum-labs active. `DL_TOKEN` set 15:32:05Z from `~/.config/igneum/dl-token` (the NEW token);
|
|
`DL_TOKEN_NEXT` deleted. `gh secret list`: DL_TOKEN (15:32:05Z), LOG_INTAKE_KEY (08:36:35Z, old), LOG_INTAKE_KEY_NEXT
|
|
(08:36:36Z, new). On the runner (`windows.yml`): the payload inputs and the manifest folder come from `DL_TOKEN`, the
|
|
NEW folder (which now carries `payload-inputs.json.sig`, 8b); `packaged-config.sh` packages the `.next` key, the new
|
|
one, while `LOG_INTAKE_KEY_NEXT` exists, and the plain `LOG_INTAKE_KEY` once 8f has run.
|
|
|
|
### 8f. Deferred to 7 October: the old key and the old folder, exact commands
|
|
|
|
Condition, checked first and never skipped: Sam's Mac reports 0.3.8 with the new fingerprints. If it is still asleep
|
|
on 7 October, wait; nothing below runs on a schedule.
|
|
|
|
```
|
|
cd /Users/joshm/Projects/igneum && git checkout master && git pull
|
|
node tools/logs.mjs --rotation | grep 3a9bf309 # must read: 0.3.8 477bb0ef ed9c4d2e ... moved
|
|
gh auth status # igneum-labs active
|
|
|
|
# 1. the site: LOG_INTAKE_KEY becomes the new value, LOG_INTAKE_KEY_NEXT goes, then a production deploy
|
|
cd site
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY production --scope igneum --yes
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | npx --yes vercel@latest --global-config ~/.config/igneum/vercel env add LOG_INTAKE_KEY production --scope igneum
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY_NEXT production --scope igneum --yes
|
|
cd ..
|
|
git push origin master # the GitHub integration deploys; if master has nothing new: the hand deploy of packaging/README-ship.md
|
|
# the old key is dead (401), the new one lives (200)
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key.old-2026-10-05)" -H 'Content-Type: application/json' -d '{"label":"rotation-check","machine":"mac","run_id":"rotation-check","lines":"old key must be refused"}' https://igneum-six.vercel.app/api/log
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key)" -H 'Content-Type: application/json' -d '{"label":"rotation-check","machine":"mac","run_id":"rotation-check","lines":"new key accepted"}' https://igneum-six.vercel.app/api/log
|
|
|
|
# 2. the relay: the same swap, then its own deploy (relay/README.md)
|
|
cd relay
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY production --scope igneum --yes
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | npx --yes vercel@latest --global-config ~/.config/igneum/vercel env add LOG_INTAKE_KEY production --scope igneum
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel env rm LOG_INTAKE_KEY_NEXT production --scope igneum --yes
|
|
npx --yes vercel@latest --global-config ~/.config/igneum/vercel deploy --prod --yes --scope igneum
|
|
cd ..
|
|
# old key 401, new key 200 (the answer carries a Blob client token: print the status only)
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key.old-2026-10-05)" -H 'Content-Type: application/json' -d '{"name":"rotation-check.txt","size":10}' 'https://relay.igneum.network/api/relay?fn=upload'
|
|
curl -s -o /dev/null -w '%{http_code}\n' -X POST -H "x-igneum-key: $(tr -d '[:space:]' < ~/.config/igneum/log-intake-key)" -H 'Content-Type: application/json' -d '{"name":"rotation-check.txt","size":10}' 'https://relay.igneum.network/api/relay?fn=upload'
|
|
|
|
# 3. GitHub: LOG_INTAKE_KEY carries the new value, LOG_INTAKE_KEY_NEXT goes
|
|
tr -d '[:space:]' < ~/.config/igneum/log-intake-key | gh secret set LOG_INTAKE_KEY --repo igneum-network/igneum
|
|
gh secret delete LOG_INTAKE_KEY_NEXT --repo igneum-network/igneum
|
|
gh secret list --repo igneum-network/igneum # DL_TOKEN, LOG_INTAKE_KEY
|
|
|
|
# 4. the OLD folder: its last 4 files join the holding folder, one deploy, 404
|
|
DLSITE="$(tr -d '[:space:]' < ~/.config/igneum/dlsite-dir)"; OLD="$(tr -d '[:space:]' < ~/.config/igneum/dl-token.old-2026-10-05)"
|
|
mkdir -p ~/igneum-dl-old-20261005/last-manifest && mv "$DLSITE/dl/$OLD"/* ~/igneum-dl-old-20261005/last-manifest/ && rmdir "$DLSITE/dl/$OLD"
|
|
ls "$DLSITE/dl" | wc -l # 1
|
|
(cd "$DLSITE" && npx --yes vercel@latest --global-config ~/.config/igneum/vercel deploy --prod --yes)
|
|
curl -s -o /dev/null -w '%{http_code}\n' "https://dl.igneum.network/dl/$OLD/igneum-app-latest.json" # 404
|
|
packaging/ota/publish-manifest.sh --verify-only # the NEW folder: live, byte-identical, signature OK
|
|
|
|
# 5. an hour later: every row moved (mac-MacBook-Pro stays unknown: stopped 4 October)
|
|
node tools/logs.mjs --rotation
|
|
|
|
# 6. on 12 October, and only after 8g step 10 has pushed the fresh repository (the rewrite reads the dated files)
|
|
rm -rf ~/igneum-dl-old-20261005
|
|
rm -P ~/.config/igneum/log-intake-key.old-2026-10-05 ~/.config/igneum/dl-token.old-2026-10-05
|
|
```
|
|
|
|
After step 3 the 0.2.0 launcher machines (`proto-cuda/windows-app`, `windows-miner`, the old key in `upload-log.bat`)
|
|
upload nothing, which is the intent of section 5.
|
|
|
|
### 8g. The owner's checklist: the login rename and the fresh repository (about twenty minutes)
|
|
|
|
Before: 8f done (the old values are dead values), `gh auth status` igneum-labs active, and
|
|
`~/.config/igneum/pytools/git_filter_repo.py` present (copied today from the dry run's download, version a40bce5;
|
|
if missing: `python3 -m pip install --target ~/.config/igneum/pytools git-filter-repo`). Browser work in the
|
|
"[user] (igneum.network)" Chrome profile. `<new>` is the handle: letters, digits, hyphens, no name.
|
|
|
|
1. (1 min) Pick `<new>` and the repository name. `igneum-core` is the script's default; the commands below use it.
|
|
2. (3 min) GitHub, signed in as igneum-labs: Settings > Account > Change username: `igneum-labs` to `<new>`. The
|
|
noreply id 337424239 stays, so the commit address becomes `337424239+<new>@users.noreply.github.com`. Then the
|
|
organisation igneum-network > People: [second-owner-login] leaves the owners (remove from the organisation). Check
|
|
the profile and the organisation: no name, no location, no personal avatar, 2FA on, the public members list empty.
|
|
Nothing on this Mac breaks: the token survives a rename and `gh auth token --user igneum-labs` reads it by the
|
|
stored name; the tidy-up is step 10.
|
|
3. (2 min) Freeze: every agent commits and pushes its branch and stops; no ship, no merge, no job publish that
|
|
commits. Then, from the main checkout:
|
|
`gh pr list --repo igneum-network/igneum` (must be empty) and
|
|
`git -C ~/Projects/igneum worktree list > ~/igneum-worktrees-$(date -u +%Y%m%d).txt` (42 worktrees today).
|
|
The freeze holds until step 10 is done.
|
|
4. (4 min) The pass, from the main checkout on master, nothing pushed by the script:
|
|
```
|
|
cd ~/Projects/igneum && git checkout master && git pull
|
|
IGNEUM_FILTER_REPO=~/.config/igneum/pytools/git_filter_repo.py tools/repo/fresh-repo.sh --new-login <new> --new-repo igneum-network/igneum-core --work ~/igneum-rewrite
|
|
```
|
|
Add `--public-claude-md <file>` when the scrubbed `CLAUDE.md` of `docs/fud-fixes.md` section 5 step 2 exists;
|
|
without it the private `CLAUDE.md` stays in every commit and the repository must stay private. Expected, against
|
|
the dry run of section 6: about 353 commits, 1 identity (`<new>`), 0 stamps off `+0000`, 0 commits touching the
|
|
four dropped files, 0 secret lines (the rules now carry 4 values: 2 current, 2 dated), 0 identity lines,
|
|
0 lines of the old login, then `clean.` and the printed push commands. On `NOT CLEAN`: stop, keep
|
|
`~/igneum-rewrite/report.txt`, ask.
|
|
5. (2 min) The push, the script's printed lines:
|
|
```
|
|
gh repo create igneum-network/igneum-core --private --description 'Igneum: the GPU-mined zkEVM L1' --disable-wiki
|
|
cd ~/igneum-rewrite/clone && git remote add origin https://github.com/igneum-network/igneum-core.git && git push --mirror origin
|
|
```
|
|
On GitHub: default branch master, the commit count of step 4, author `<new>` on the newest and the oldest commit.
|
|
6. (1 min) The two secrets on the new repository (two after 8f):
|
|
`tr -d '[:space:]' < ~/.config/igneum/dl-token | gh secret set DL_TOKEN --repo igneum-network/igneum-core`,
|
|
the same for `log-intake-key` into `LOG_INTAKE_KEY`, then `gh secret list --repo igneum-network/igneum-core`.
|
|
7. (3 min) Vercel, team igneum, project igneum > Settings > Git: disconnect `igneum-network/igneum`, connect
|
|
`igneum-network/igneum-core`, production branch master. Then one push to master from the new checkout (step 10)
|
|
triggers the first deploy; `curl -sI https://igneum.network | head -1` reads 200. The relay and the downloads
|
|
folder deploy by CLI and have no Git link: nothing to re-link.
|
|
8. (1 min) Archive `igneum-network/igneum` (Settings > Archive this repository). Private, never deleted the same day.
|
|
9. (3 min) Re-clone and re-identify:
|
|
```
|
|
cd ~/Projects && mv igneum igneum-old-history && git clone https://github.com/igneum-network/igneum-core.git igneum
|
|
cd igneum && git config user.name <new> && git config user.email 337424239+<new>@users.noreply.github.com
|
|
gh auth logout --user igneum-labs && gh auth login --web --hostname github.com # as <new>
|
|
git config credential.https://github.com.helper '' && git config --add credential.https://github.com.helper '!f() { echo username=<new>; echo "password=$(gh auth token --user <new> 2>/dev/null)"; }; f'
|
|
mv ../igneum-old-history/vendor ./vendor # gitignored: the fork worktrees and their targets
|
|
git commit --allow-empty -m "fresh repository: first push" && git push origin master # the deploy of step 7
|
|
```
|
|
The private `CLAUDE.md` names the login and the repository: update both lines in the same commit (or the scrubbed
|
|
file of step 4).
|
|
10. (0 min, each agent) Unfreeze: every agent removes its old worktree directory and re-creates it from the new
|
|
checkout, `git -C ~/Projects/igneum worktree add ../igneum-wt-<name> <branch>`; never a merge of an old-id branch
|
|
into a new one. `TZ=UTC` in every shell that commits. `~/igneum-old-history` and the dated secret files go on
|
|
12 October (8f step 6).
|
|
|
|
### 8h. What this branch changes (`rotation-3`)
|
|
|
|
| File | Change |
|
|
|---|---|
|
|
| `tools/logs.mjs` | `--rotation`: once no `.next` file exists, the "old" fingerprints come from the newest `log-intake-key.old-<date>` and `dl-token.old-<date>` instead of the plain files (which are the new values after the rename); the summary line says which. `--self-test` passes |
|
|
| `tools/repo/fresh-repo.sh` | the secret rules take every `log-intake-key.old-*` and `dl-token.old-*` file next to the four names, so the rewrite scrubs the old values after the rename; the count line no longer says "of 4" |
|
|
| `tools/ship-app.mjs` | `FOLDER_FILES` carries `payload-inputs.json.sig` (the mirror step had left the signature behind; `windows.yml` fetches it). `--self-test` passes |
|
|
| this file | section 8 |
|