The manual checkout and the --ref seed example now use
refs/remotes/origin/main, matching the unattended path in auto-deploy.sh,
so a tag or local branch named origin/main cannot be picked up instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
F24-1: resolve refs/remotes/origin/main^{commit} instead of the ambiguous
origin/main, which a tag or local branch of that name would shadow.
F24-2: the timer fires on OnCalendar=*-*-* *:0/15:00 so Persistent=true
catches up a check missed while the host was down; the runbook documents
the new schedule.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The snapshot helper runs under sudo; with /tmp on its import path any local
user could plant a module and run code as root. The Count check helpers and
check files now live in a private mktemp directory and python runs with -I.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
deploy/auto-deploy.sh runs deploy/RUNBOOK.md unattended: no-op when
origin/main is the last deployed SHA in the deploy record, wait while its
Gitea CI status is pending, refuse (exit 1) on failure or no status, then
run every runbook block (rollback SHA from the running /health, clean
checkout, make docker, Litestream restore point, boot-required
configuration, retag, restart, version and PWA verification) and append a
deploy record line. --ref <ref> deploys an explicit ref through the same
blocks, bypassing the gates. A failed deploy is recorded and never retried
by the timer.
mealquest-auto-deploy.service/.timer run it as overseer every 15 minutes
(+5 min random delay), skipped while mealquest.service is not active.
deploy/RUNBOOK.md is the PR #203 runbook (feature/launch-readiness, not yet
on dev) plus an "Automated deploys" section; AGENTS.md describes deploy/.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dev_agentandClaude Opus 5.5
orchestrator-agent