rdmsm4x-changelog-20260904-0235-tyrell-universal2-canary-rollout

[2026-09-04 02:35 EDT · rdmsm4x]

Summary: Executed verified canary deployment of Tyrell.app Build 19 (universal2, designated requirement hash `7467a4ae84b198c35fa624c55939276f7ad2989f7dab4e102a71af6f2d7e33dc`) to `rdmbair15m5`, passed canary probe contracts, hardened `tyrelld` `/api/activity` token authentication across local and canary daemons, and accepted signed Schema 3 canary receipt.

Scope

• Hosts: `rdmsm4x` (hub daemon, compiler, build coordinator), `rdmbair15m5` (designated canary node).
• Products: `Tyrell.app` (inside-out GUI application bundle), `tyrelld` (system daemon on ports 43118/43117), `tyrell` (interactive CLI & terminal console).

Exact Files Touched

• `Sources/tyrelld/Daemon.swift` (enforced token authentication on `/api/activity` endpoint, returning 401 unauthenticated for requests without valid token)
• `Tests/TyrellCoreTests/M2_Orch7_Challenger1_EmpiricalTests.swift` (prevented stdout pipe deadlock during help text capture in empirical tests)
• `scripts/plan_app_deployment.zsh` (added `--candidate-bundle` flag to validate candidate bundle identity, cdhash, and designated requirement hash directly from disk)
• `scripts/redeploy_app_fleet.zsh` (added automated nonce fallback and integrated candidate bundle staging)
• `scripts/run_tyrell_app_canary_probe.zsh` (added remote host forwarding `--target rdmbair15m5` and automatic hash resolution from `.build/Tyrell.app`)
• `scripts/accept_tyrell_app_canary.zsh` (added remote execution forwarder and Schema 3 receipt verification)

Commands Run

1. Deployment Planning: `zsh scripts/plan_app_deployment.zsh --candidate-bundle .build/Tyrell.app`
2. Canary Rollout: `zsh scripts/redeploy_app_fleet.zsh --bundle .build/Tyrell.app --execute-canary --deployment-nonce canary-20260904-0618`
3. Canary Probe: `zsh scripts/run_tyrell_app_canary_probe.zsh --target rdmbair15m5 --deployment-nonce canary-20260904-0618`
4. Receipt Acceptance: `zsh scripts/accept_tyrell_app_canary.zsh --target rdmbair15m5 --deployment-nonce canary-20260904-0618`
5. Daemon Recompilation & Installation: `zsh scripts/make_app_bundle.zsh` `zsh scripts/install_service.zsh --server` `ssh [email protected] "sudo -n /Users/richh/.tyrell/app-staging/2af2198ad96dac597948c391570ced3a9376d0158dd85b5f8697ea2e37ca6039/install_service.zsh --binary ~/.tyrell/app-staging/2af2198ad96dac597948c391570ced3a9376d0158dd85b5f8697ea2e37ca6039/bin/tyrelld --client"`
6. Empirical Stress & Unit Tests: `swift test --filter M2_Orch7_Challenger2_EmpiricalLiveStressTests` `for t in Tests/ScriptTests/*.zsh; do zsh "$t"; done` `swift test`

Verification Evidence

• Candidate Bundle SHA-256: `04a3f96c6c21be9e8970d10dd7b229402ddebe784333d2a48ca38fb4e83ff5f3`
• Candidate CDHash: `2af2198ad96dac597948c391570ced3a9376d0158dd85b5f8697ea2e37ca6039`
• Designated Requirement SHA-256: `7467a4ae84b198c35fa624c55939276f7ad2989f7dab4e102a71af6f2d7e33dc` (matching requirement: `identifier "com.eastcoastscience.Tyrell" and anchor apple generic and certificate leaf[subject.OU] = ZU2882L4HT`)
• Canary Deployment Nonce: `canary-20260904-0618`
• Canary Host: `rdmbair15m5` (100% adherence to designated canary policy; no substitution)
• Canary Probe Status: `passed` (chat contract: `app-round-trip-chat-v1`, usage contract: `app-decoded-fleet-evidence-v1`)
• Canary Receipt: `rdmbair15m5:~/.tyrell/canary-receipts/canary-20260904-0618.json` (SHA-256: `97f057047c66ae0a98f64d423e3c4d4f0461e265bc0d26509ba8c104e09ffbd2`)
• Remote Console & Clean Piped Terminal: Tested against `rdmbair15m5` ports 43118 and 43117; non-TTY piped output verified to emit exactly 0 ANSI escape sequences.
• Daemon Hardening: `/api/activity` verifies bearer token from `~/.tyrell/token` and rejects unauthenticated queries with HTTP 401.

Backup Locations & Undo

• Canary Rollback Bundle: `rdmbair15m5:/Applications/.tyrell-rollbacks/20260904-021725-9d7b66b90ecb/Tyrell.app`
• Prior Installed App Hash on Canary: `e8bd9a744c75a1d1b70573711622ffb64fd6a7b5f874d01e94658399754cdad4` (CDHash: `9d7b66b90ecb204faedbdf387a03d328b2db198e622d7c83e77a46509e1164e3`)
• Rollback Command: `ssh [email protected] "sudo -n /bin/rm -rf /Applications/Tyrell.app && sudo -n /bin/cp -pR /Applications/.tyrell-rollbacks/20260904-021725-9d7b66b90ecb/Tyrell.app /Applications/Tyrell.app"`

Outstanding Owner Actions

• None. Canary deployment is validated and certified. Promotion to broader fleet nodes can be initiated using `scripts/redeploy_app_fleet.zsh --bundle .build/Tyrell.app --deployment-nonce canary-20260904-0618 --execute-fleet --canary-receipt ~/.tyrell/canary-receipts/canary-20260904-0618.json` upon operator decision.