Skip to content

Pin Linux real-binary upgrade integration (U1h: v1→v2 swap preserves identity + serves new version)

Placeholder ppxd requested to merge phase12.M.L.U-linux-upgrade-binary-integration into main

Summary

  • Closes the largest P0 gap from the global audit: real-binary v1→v2 upgrade integration. The bash-script tier (TentacleLinuxUpgradeLifecycleE2ETests) proves the script's logic; this PR proves the END-RESULT operators care about — after the script runs, the agent IS running new version AND retains its cert identity.
  • U1h stages a v1 binary at a per-test path, registers + service-installs against it, captures pre-upgrade version + thumbprint, swaps the binary file to v2 content (simulates Phase B's mv step), restarts the service, asserts: (1) v2 active, (2) version returns v2 stamp, (3) thumbprint UNCHANGED (cert preserved through swap), (4) service still active.
  • Extends LinuxTentacleBinaryFixture with BuildVersionV2 = "100.0.0" + EnsureBuiltV2(); Build() now parameterized so v1 + v2 cache coexist.

Why this matters

Without this pin, a regression in any of these silently ships:

  • systemd's Type=simple + Restart=on-failure coordinating with v2 startup
  • Per-instance config + cert-dir surviving a binary-only swap
  • show-thumbprint reading the same cert post-upgrade as pre-upgrade

Operators would see the upgrade UI report "success" but the agent's identity would be divorced from the server's trust list — polling fails silently hours later.

Why direct swap instead of running upgrade-linux-tentacle.sh

The script is already covered by TentacleLinuxUpgradeLifecycleE2ETests (~17 tests covering download/SHA/Phase A+B/rollback/events.jsonl/last-upgrade.json). The DELTA this PR adds is "what happens AFTER the swap mechanics" — provable with a direct stop / overwrite-file / start sequence. Driving the full script would duplicate lifecycle coverage and add 30+ seconds without complementary value. Direct swap is the surgical pin.

Test plan

  • dotnet build green
  • CI Linux passes U1h_BinarySwapWithRestart_PreservesIdentityAndServesNewVersion
  • Existing 49 Linux E2E tests still pass
  • First runner: extra ~30-60s for the v2 publish — acceptable one-time cost amortized across the test session

🤖 Generated with Claude Code

Merge request reports