[abruption]

v0.5.0 scope

Advanced-user experimental external-recovery research and operating documentation. The standard installer does not install the broker, register a Dots task, enable automatic recovery, or restart the stopped watchdog. The four installed executable sources remain byte-identical to v0.4.0; VERSION and source-manifest metadata advance to 0.5.0.

Included:

• Authenticated HTTPS observations, bounded network operations and subscription/delivery health reporting.
• Durable single-claim recovery, preflight reports, explicit eligibility/retry information and bounded policy-unblock reminders without resetting history.
• Dedicated broker account/Unix socket, resource and request limits, validated IPv6 guard ordering, and reviewed migration helpers.
• Read-only lifecycle collection, English/Korean operating guides, all-language README scope notes, stop/rollback and Python-upgrade relay restart instructions.

Remaining work in #20, #31, #43, #44 and #45 is kept OPEN and moved to v0.6.0. This PR is the v0.5.0 milestone deliverable; it does not close broader research or general-support acceptance criteria.

Evidence and limits

• 168 research tests passed on Linux Python 3.12 for the deployed policy implementation; exact final candidate CI must also pass.
• Three external recovery observations after changed boot IDs: 7m35s, 9m45s and 7m34s on Oct 24–25. These do not establish VM replacement or an execution latency guarantee. Dots reported one command each; the protected claim ledger was not independently reread for those cases.
• Broker reboot restored service/authentication/subscription and ingestion. The corrected guard helper verified an unchanged safe Tailscale prefix without rewriting firewall rules.
• The relay recovered after a relay-only restart following interpreter replacement. Exact swallowed child exception is unknown; runtime-maintenance hardening remains follow-up work.
• The old rolling-limit-blocked incident needed manual resume and is excluded from unattended results. Other-account fresh setup is not reproduced.

Release preparation

Released merge commit: 6741383ddf1296db1f3ff31db56887e22db83580 (v0.5.0); tree matches candidate 37d7aaf.

• VERSION/source manifest set to 0.5.0; manifest verification passes.
• Latest main incorporated, preserving README badges.
• Eight final assets rebuilt after merge: ZIP, tar.gz, four sources, manifest and SHA256SUMS.
• Both final archives and all 112 tracked file contents match the merged commit; all eight uploaded assets were downloaded and hash-verified.
• Exact revised candidate CI passes: core 256 tests on Python 3.11/3.13; recovery 179 and lifecycle 11 tests on Python 3.12/3.13; shell and security checks pass.
• Latest code re-review remains pending; operator explicitly authorized proceeding. Latest security review passed; all submitted findings were addressed.
• Approved scope merged and exact merge-commit CI passed.
• Annotated v0.5.0 tag and stable/latest GitHub Release published; production broker deployment verified afterward.

See docs/releases/v0.5.0.md and docs/experimental-recovery.md. The changelog publication date is set to 2026-10-25 for this authorized release. Local runtime credentials, callback secrets, databases and private logs are excluded from source and assets.

[abruption]

Deployment and operational verification update — 2026-10-25

• Recovery-policy candidate passed 168 tests on Linux Python 3.12 before deployment. Deployed trial limit: 12 claims/24h and 3600-second cooldown; default: 3/3600. Existing claims/authentication/subscriptions retained.
• Dots' actual task instructions were saved through the browser to use server policy, advisory retry timestamps, and fresh claims. Cutover output showed two recent claims and eligibility under both old and new limits; no live unblock notification is inferred from that cutover.
• The controlled broker-server reboot restored broker/proxy/authentication services and monitoring ingestion with the existing subscription. IPv6 rules were unchanged; the validator correction accepted only the inspected, narrowly exempt Tailscale prefix. The installed helper reported guard_present=true, protected_order=true, firewall_changed=false.
• External logs confirm three subsequent new-boot recovery boundaries: Oct 24 13:33:41, Oct 25 00:40:03 and 06:51:30 KST. Observed outage durations were 7m35s, 9m45s, 7m34s. Boot IDs changed; VM replacement itself is unproven. Dots reported one execution each; this check did not independently reread the protected claim ledger.
• Oct 25 Mac relay failure after a Python upgrade was recovered by restarting only that relay at 12:02:36 KST. Fresh ACK, active subscription and zero consecutive failures were confirmed. Exact swallowed child exception remains unknown; sanitized diagnostics/runtime-upgrade handling remain follow-up work in research: investigate external MCP event triggers for Dots recovery #43.

No release/merge or general unattended-recovery guarantee is implied. Detailed operational report: #43; lifecycle evidence: #20; policy coordination: #44; public support gates: #45.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-25T03:32:19.695250Z	37d7aaf	Manual request
🔒 Security Review	✅ Completed 2026-10-25T03:38:28.517087Z	37d7aaf	Manual request

Security findings

Advisory findings (1)

• 🟡 Reserve OAuth capacity from public slow requests · Medium

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 952631e80d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[abruption]

@codex review
@codex security review

All three P2 code-review findings are addressed in ccb9931. Added regression coverage for expired subscription admission, explicit no-error ping classification and authenticated deployment examples. Local research suite: 173 tests, one Linux-only skip. Candidate artifacts regenerated and verified against this commit. Please review the fixes; the previous commit security review completed without findings. No live deployment or release publication was performed.

[abruption]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: ccb9931c74

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: ccb9931c74

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[abruption]

@codex review

[abruption]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 37d7aaf39b

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[abruption]

v0.5.0 published — 2026-10-25

PR merged as 6741383ddf1296db1f3ff31db56887e22db83580; the merged tree matches the reviewed head. Both Checks and Research checks passed on that exact merge commit. The latest security review completed without findings; the operator explicitly authorized merging without waiting for the still-pending code re-review.

Annotated tag v0.5.0 resolves to the merge commit. The stable/latest release is public: https://github.com/abruption/dots-tailscale/releases/tag/v0.5.0

Eight assets were rebuilt from the merge commit. Both archives contain exactly the 112 tracked files, with every file compared to Git; source assets match the versioned manifest. All eight uploaded assets were downloaded again and matched local SHA-256 values.

KR production deployment is staged with pinned released-source hashes and rollback for three broker files plus the scoped Caddy client-IP header update. It has not yet been applied: final sudo authentication is pending. No OAuth, subscription or recovery ledger reset is part of deployment. The Dots installed runtime is not changed by publication.

[abruption]

v0.5.0 production broker deployment verified — 2026-10-25

Release commit: 6741383ddf1296db1f3ff31db56887e22db83580 (public annotated v0.5.0).

The initial deployment preflight correctly deferred during a real Dots outage. Existing service/code remained unchanged. The external observer subsequently confirmed SSH and ping recovery at 15:38:05 KST, and the healthy observation was acknowledged before retrying deployment.

The retry applied three broker code files (event_core.py, recovery_core.py, oauth_adapter.py) and the two scoped Caddy upstream identity-header overwrites. Installed SHA-256 values match the released sources. Before/after deployment summaries both showed fresh healthy observations, 0 open incidents, 8 claims, 1 active subscription, 0 sending deliveries. Existing configuration, authentication, subscription and recovery databases were retained.

Independent post-deployment checks:

• Broker, socket, Caddy and Authelia active; dedicated service identity retained; no automatic service restarts reported.
• External /healthz: 200; anonymous /mcp: 401; deliberately invalid OAuth client at /token: 401 invalid_client, demonstrating the request reaches OAuth validation through the new proxy boundary.
• A new observation at 15:39:08 KST, after the broker started at 15:38:37, was acknowledged with subscription_active=true, zero consecutive delivery failures and no stale delivery.

This verifies deployment and the sampled transport/authentication paths; it is not a new production slow-request stress test or proof of future token renewal. The Dots installed package was not replaced by this broker deployment. The operator explicitly authorized merge/publication while the latest code re-review remained pending; latest security review and exact merged-commit CI passed.