Quantum_Wizard_Studio/qwsg
2
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions
6 releases 6 tags
  • v1.4.0 996fb90d0f

    QWSG Community 1.4.0 Stable

    quantumwizard released this 2026-09-28 17:19:19 +00:00 | 6 commits to main since this release

    QWSG Community 1.4.0 signed release publication (Task 094). The frozen Task 093 release notes are reproduced unchanged below and attached verbatim; their preparation-state statements describe Task 093. Task 094 publishes this exact candidate under separate Owner authority. Real-system C9 acceptance is not performed or claimed; C9 remains MISSING.

    Source: 996fb90d0f53d4ae6088cd884a654d9d0a32fff9

    Artifact: qwsg-1.4.0-linux-amd64.tar.gz, 3680796 bytes, SHA-256 26cbf8d76fa27c652e11ee49f4570e05b3be6b969309e3cfd486977a27a6224d.

    Signed index SHA-256: fbb39b52e240ff3691090a48a1e7915e516da6fb2f6a1faa9ed5fc069b633c41. The archive companion is the exact production-signed index, authenticated with the independently trusted verifier. Production index publication is verified separately.

    QWSG 1.4.0 release candidate

    Task 093 prepares an unsigned, unpublished release candidate. The semantic
    version is 1.4.0; this is not a production-signed, published or accepted release.
    Community C9 remains MISSING. No new product scope is introduced here.

    Version decision

    VERSION was 1.3.1. Historical 1.3.0 introduced authenticated discovery and
    notifications; 1.3.1 was its narrowly corrective patch. Accepted Tasks 082–092
    add authenticated exact-source migration capabilities, stronger offline archive
    authority, policy/capability and bounded orchestration foundations, stable service
    identity and durable recovery. These include additive functionality beyond a
    patch; existing supported configuration/state schemas remain preserved. The
    smallest next minor identity is 1.4.0, within major 1.

    The existing stable index rejects prerelease identities, and the production
    update path selects stable only. Using 1.4.0 as a frozen candidate identity
    preserves that contract without introducing a preview update mechanism. The
    candidate state is recorded separately from its SemVer; no tag or production
    publication is authorized. The historical 1.0.0 RC convention in the initial
    release policy does not renumber the later 1.1/1.2/1.3 release lineage.

    Included accepted changes

    • Task 082: release-index/2, exact source migration/1 declarations and the local
      preserve-package-v1 capability; signed archive companions and helper revalidation.
    • Tasks 083–087: policy/capability foundations, bounded orchestration, Guardian
      handoff, common mutation exclusion and verified recovery. Production still
      resolves Community; no production Pro entitlement or automatic install claim.
    • Task 088: frozen product maturity scope, separate from semantic release numbering.
    • Task 089: stable privacy-preserving service identity.
    • Task 090: recognized local evidence interruption recovery and integrity checks.
    • Task 091: durable explicit update/rollback recovery and truthful outcome evidence.
    • Task 092: operator readiness, optional SMTP and recovery guidance reconciliation.

    Bootstrap and compatibility

    Official 1.3.1 predates Task 082 and cannot consume release-index/2. Its native
    update command is not the supported bootstrap coordinator. After separate signing
    and publication authorization, independently authenticate the signed index using
    the established release-index verifier and bundled production public key; bind
    archive name, length and SHA-256 to that index before executing extracted code.
    Use the verified 1.4.0 archive binary as the explicit bootstrap coordinator with
    its archive, checksum and full signed index companion. It classifies the actual
    installed 1.3.1 package, checks exact signed compatibility and independently
    reauthenticates in the privileged helper before mutation.

    The sole declaration is 1.3.1 -> 1.4.0, linux-amd64, preserve-package-v1:
    Configuration 1.0, Guardian 1.0, Scheduler 1.0, Operator State 1.0–1.2. No schema
    conversion or new migration route is added. Unsupported source, capability,
    schema, platform, signature or package identity fails closed. Do not run the
    archive install.sh over an existing installation to bypass these checks.

    The exact frozen artifact and Dell1 handoff are recorded after the source commit
    under release/candidates/1.4.0/. Build only that source commit with the recorded
    full BUILD_COMMIT, SOURCE_DATE_EPOCH and toolchain. Closure metadata is outside
    the package input boundary. Never rebuild using a later documentation commit and
    label it with the frozen source commit.

    Remaining release gate

    C9 must prove clean installation, the actual candidate-coordinated bootstrap from
    immutable official 1.3.1, preservation, explicit rollback and Guardian recovery on
    a separately authorized real supported system after signing/publication. Optional
    notification acceptance remains truthful and separate from core health. Task 093
    performs no such acceptance. Historical 1.3.1 tag, artifact, hash, signatures and
    source/release commit remain immutable.

    Downloads
  • v1.3.1 45009fe616

    QWSG Community 1.3.1 Stable

    quantumwizard released this 2026-09-06 22:56:55 +00:00 | 22 commits to main since this release

    QWSG Community 1.3.1

    This corrective release addresses two regressions discovered during the real
    1.3.0 production upgrade acceptance. The published 1.3.0 tag, artifact and
    release metadata remain immutable.

    • After installation changes, release checking fetches and authenticates the
      full index before re-evaluating installed versus available versions. A 304
      response cannot retain an earlier newer/update_available classification.
      Previously saved stale 1.3.0 evaluations also trigger a full authenticated
      fetch; equal versions become current/equal.
    • Successful update-notification identity survives version changes, failed
      checks and restarts. The same already-notified release is not delivered
      again solely because the installed version changed. A genuinely different
      authenticated supported newer release remains eligible under the configured
      notify/SMTP policy.
    • A failed refresh after a version change reports unknown awareness while
      retaining historical authenticated evidence for anti-rollback checks and
      the successful notification record. It does not claim the old classification
      applies to the new installation.

    The supported corrective migration is 1.3.0 to 1.3.1. Because the installed
    1.3.0 predates this explicit route, invoke the verified 1.3.1 archive binary's
    existing updater with that archive and version. Its narrow privileged helper
    revalidates provenance and compatibility and records deterministic rollback.
    Configuration, credentials, supported state and Guardian service intent remain
    preserved. This is an operator-controlled action, never an automatic install.

    The production acceptance recovery may restore a previously lost notification
    record only from the retained, integrity-verified pre-update evidence. The
    product does not invent a record for an email whose successful delivery cannot
    be proved. Historical release bytes and index authenticity are not altered.

    The authenticated Ed25519 release contract, artifact integrity/provenance,
    Guardian resource limits, Scheduler bounds and privacy boundaries are unchanged.
    There is no telemetry, registration, new listener or unattended privileged update.

    Source commit: 45009fe6169bff00842a4c4e9561bf339a5db81e

    Artifact: qwsg-1.3.1-linux-amd64.tar.gz, 3600553 bytes

    SHA-256: 0ab726bcde36182232ff89e3ea33e2d5ab77d8cad2b94ce56c9534a8147d9cd7

    Downloads
  • v1.3.0 2e2b723f6f

    QWSG Community 1.3.0 Stable

    quantumwizard released this 2026-09-06 12:11:54 +00:00 | 27 commits to main since this release

    QWSG Community 1.3.0

    QWSG Community 1.3.0 adds authenticated update awareness to the local Guardian.
    Official release metadata is verified against the bundled Ed25519 Community
    trust anchor, and installed binary/package provenance is checked independently.

    • qwsg update check explicitly refreshes awareness. qwsg update status
      reads only local state and performs no network request.
    • Guardian checks the official release index every 24 hours when due, in an
      isolated bounded task. A failed release check does not stop monitoring.
    • With the existing notify policy and Community SMTP configured, an
      authenticated supported newer release becomes eligible for a localized email.
      Successful delivery is persisted and deduplicated across repeated checks and
      Guardian restarts; failed deliveries remain bounded and retryable.
    • Awareness checking downloads metadata only. Artifact acquisition and
      installation still require the operator to invoke qwsg update explicitly.
    • Scheduler history retains at most 64 results. State larger than 8 MiB is
      rejected before decoding, avoiding legacy-history allocation amplification.
      Guardian retains its 128 MiB memory and 32-task limits and 64 MiB Go memory target.

    The supported upgrade is 1.2.0 to 1.3.0. Configuration, SMTP credential
    references/storage, scheduling, supported local evidence and service intent
    are preserved by the existing update/rollback workflow. Unknown or oversized
    Scheduler state fails closed without being deleted; retain a private backup
    and resolve it before relying on healthy scheduled execution. Never remove
    legacy state merely to make installation appear successful.

    For the first production acceptance, the installed 1.2.0 instance received an
    Owner-authorized compatibility-route backport. It is distinct from the
    unchanged historical official 1.2.0 archive. Canonical 1.3.0 supersedes that
    private compatibility baseline.

    Community requires no registration, API key or installation ID. There is no
    telemetry, inventory upload to release infrastructure, new inbound listener,
    automatic artifact download from awareness, or automatic update installation.
    Existing explicit SMTP notification policy remains operator controlled.

    Source commit: 2e2b723f6f9a2bcea368fbbddc8449cdbaac7fab

    Artifact: qwsg-1.3.0-linux-amd64.tar.gz, 3598177 bytes

    SHA-256: 8e19f624ccd1a49f32f6127889390e3389aec6eda958c7fbaaaa657d7b7cf9a0

    Downloads
  • v1.2.0 348d927ffc

    QWSG 1.2.0 Stable

    quantumwizard released this 2026-08-29 16:58:13 +00:00 | 59 commits to main since this release

    QWSG 1.2.0 Release Notes

    QWSG 1.2.0 promotes the externally accepted RC.7 implementation unchanged to the final release identity. It provides guided installation and setup, deterministic release discovery and update/rollback, localized lifecycle notifications, synchronized Guardian readiness, and bounded Guardian operation on the supported Ubuntu 24.04 LTS amd64 platform.

    The final release retains MemoryMax=128M, TasksMax=32, CPUQuota=25%, the hardened user service, and GOMEMLIMIT=64MiB. The measured memory remediation releases completed scheduler execution graphs after publication and gives the Go runtime a cgroup-aware soft pacing limit while preserving independently enforced systemd limits and observable OOM behavior.

    The update registry explicitly declares a fail-closed 1.2.0-rc.2 -> 1.2.0 compatibility path. It performs package replacement with the final Guardian unit while preserving configuration, protected SMTP credentials, Guardian/Scheduler/operator state schemas, service intent and deterministic rollback metadata. Unsupported routes remain rejected before mutation.

    Project Owner-supplied final acceptance covered deterministic RC.2 update, exact rollback and re-update; guided installation on a preserved-state host; reboot autostart; readiness synchronization; bounded resources without restart or OOM; coexistence with the production-like Hestia stack; STARTTLS SMTP acceptance; and manual mailbox receipt of test and localized lifecycle notifications. See ACCEPTANCE_1.2.0.md for the canonical evidence boundary and final publication ledger.

    QWSG remains a local, non-root Community Guardian. Optional email delivery depends on operator configuration; a working core with that optional capability disabled or unconfigured truthfully reports Partial readiness.

    Downloads
  • v1.1.0 305f4088e9

    QWSG 1.1.0 Stable

    attila released this 2026-08-26 14:14:44 +00:00 | 89 commits to main since this release

    QWSG 1.1.0 Release Notes

    QWSG 1.1.0 is the final release of the product behavior externally accepted as
    QWSG 1.1.0-rc.6. The final source changes are limited to release identity,
    documentation and deterministic release plumbing; they do not change runtime
    behavior.

    Highlights

    • Read-only Smart Install assessment for supported Ubuntu 24.04 amd64 hosts.
    • Guided, resumable ordinary-user setup and explicit Guardian activation.
    • Safe configuration/state separation with strict ownership, modes and
      non-symlink filesystem handling.
    • Optional one-recipient SMTP notification using protected local credentials.
    • Operational readiness that distinguishes Guardian core readiness from
      optional external-notification verification.
    • Pre-login Guardian startup with systemd user lingering and automatic
      Restart=on-failure recovery.

    Guardian recovery correction

    The final release contains the RC.6 correction for QWSG-059-F001. After a
    configuration identity changes, a boot-time or systemd-recovered Guardian now
    replaces only integrity-valid Scheduler state owned by the superseded
    configuration. The recovered generation can own its checkpoint, complete fresh
    work and publish current canonical evidence. Same-configuration recovery,
    generation isolation and truthful degradation for genuine failures remain
    intact.

    Acceptance basis

    Task 061 externally verified Ubuntu 24.04 amd64 Smart Install, documented RC.5
    replacement, safe state and credential preservation, controlled SMTP delivery
    with actual Owner-confirmed receipt, physical reboot, pre-login autostart,
    automatic systemd recovery, current configuration/generation ownership and
    fresh canonical Guardian evidence. No RC.6 product defect was found.

    notification.external=unknown_requires_verification and overall partial are
    valid when the Guardian core is ready but no Guardian monitoring notification
    queue entry exists. A controlled notification test proves transport delivery
    without manufacturing such an incident.

    Installation

    Download the immutable versioned archive and checksum sidecar from the Forgejo
    Release, verify the sidecar, extract the archive, run ./bin/qwsg install --check, then follow INSTALL.md. QWSG does not install dependencies, enter
    credentials, enable lingering or perform privileged host remediation.

    This release is QWS Community / Free License Version 1.0 software. See
    LICENSE, README.md, INSTALL.md, and the packaged operator documentation.

    Downloads
  • v1.0.0 177535e44b

    QWSG 1.0.0 Stable

    attila released this 2026-08-12 05:17:56 +00:00 | 125 commits to main since this release

    QWSG 1.0.0 Community Release

    QWSG is a local, non-root Linux Server Guardian for deterministic inventory,
    snapshot comparison, drift and health analysis, policy evaluation, reporting,
    Guardian operation, and a read-only Operator Console.

    Release-source commit:
    177535e44b

    Linux amd64 artifact SHA-256:
    edfba7366adf2c1ce0a8ce56369bb0dc5ad11326c4e3d1e301625a5313292fa5

    Verify the downloaded archive with the attached checksum sidecar before
    installation. See the packaged Quick Start, release notes, security/privacy
    guidance, known limitations, support policy, and QWS Community / Free License.

    Downloads