fix(release): harden stable promotion after canary acceptance

Verify matching 103 canary evidence before 8081 promotion, fix agent-run drain JSON parsing, tolerate macOS full-backup tar races, and extend goosed remount health waits for non-interactive SSH releases. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-27 07:09:27 +08:00
parent 67bf2c2bbb
commit 41bf775c4c
3 changed files with 165 additions and 7 deletions
@@ -42,6 +42,21 @@ test('production release verifies gate report before any 103 connection', async
  assert.match(source, /禁止 ALLOW_PORTAL_RELEASE_SCOPE_BYPASS/);
 });

+test('production stable release verifies canary promotion evidence before gate checks', async () => {
+  const source = await fs.readFile(
+    path.join(ROOT, 'scripts', 'release-portal-runtime-prod.sh'),
+    'utf8',
+  );
+  const promotionIndex = source.indexOf('verify-canary-promotion-evidence.mjs');
+  const gateIndex = source.indexOf('verify-release-gate-report.mjs');
+  assert.ok(promotionIndex > 0, 'missing canary promotion evidence verifier');
+  assert.ok(gateIndex > promotionIndex, 'gate verification must follow promotion evidence');
+  assert.doesNotMatch(source, /在同一候选完成 103 灰度验收且晋升证据校验落地前，禁止非 dry-run/);
+  assert.match(source, /read_agent_run_status_json/);
+  assert.match(source, /sed -n '\/\^\{/);
+  assert.match(source, /for _ in \$\(seq 1 120\)/);
+});
+
 test('runtime builder removes every persisted path forbidden by artifact policy', async () => {
  const source = await fs.readFile(
    path.join(ROOT, 'scripts', 'build-portal-runtime.mjs'),