Releases & binary history

The dated Rust Swift release record, candidate provenance, gate truth, and rollback discipline.

The fleet does not run “latest main”; it runs named binary generations with recorded SHA-256s, and the docs state which one is live. If a node disagrees with this page, reconcile before touching anything (health checklist).

Current lab pre-release publication state

Item	Verified state on 2026-08-31
remote	`https://github.com/0smboy/Peregrine.git`
accepted Rust Swift source	`17adf0bfa78b30b2a7eed9f39836e0d63c715d2c`
canonical integration and auxiliary build commit	`7883bbb1d021277390215e18afeb414b5b612339`
G6 evidence	W068 + W069 + W070, exact frozen 179 and zero unexpected result
publication	`g6-green-20260831`, explicitly a lab pre-release rather than production approval
Rust Swift artifact	v9 EC package, SHA-256 `5eb07c38ec1a37bd21d3a7afe744e37374f54bb3a92e352204df018aec293398`
auxiliary Linux binaries	Swift Console 180/180, Swift Deploy 79/79, Cosbench-RS 33/33, and Autocos 4/4; all locked release builds completed on Swift2
Drive archive	`gdrive:Peregrine/Peregrine-G6-green-20260831-7883bbb/`, separate from the immutable `64446f1` archive
production `:8080`	all four nodes remained on `ab5cb95c…`

The earlier append-only artifact folder is gdrive:Peregrine/Peregrine-G6-candidate-20260831-64446f1/ (10 objects, 29,319,934 bytes at verification). It preserves the superseded 64446f1 candidate and must not be overwritten by the 17adf0b release bundle. Upload is artifact preservation, not a release or production promotion.

The new Drive folder contains the two Linux release archives, per-file checksums, and the complete W068/W069/W070 evidence directories. The auxiliary archive SHA-256 is 6b5212b262057b7d361cb04f822a3878a53273f57674aecc4079439e1637ce5a. Publishing this tag makes a reproducible lab candidate available; it does not close G3, G4, G5, G7, or G8 and does not authorize a fleet rollout.

Historical proxy generations

Each generation was built once on the lab build node, rolled 1→4→3→2 (VIP owner last), verified by SHA + health, then scored by one dual-oracle round. Source: docs/fairness-lab/S3-ALIGN-20260815.md.

Generation	Binary SHA-256 (prefix)	What it closed	Status
887be hotfix	`b3dfb5c8…` (then)	empty-key `PUT /bucket/` → NoSuchKey; invalid buckets no longer routed into Swift accounts	superseded
Wave-2	`e291ea61…`	887be-era ops; empty-key mb	superseded (proxy). Object Wave-2 `e1d4f1cc…` superseded 2026-08-18
F1	`29acb863…`	clock-skew / expiry / InvalidStorageClass as real rejections	superseded
XML	`2ecabc45…`	`RequestId` in every error body	superseded
Schema	`a6b386e6…`	MPU composite ETag, ISO timestamps, PUT-ACL `Location`	superseded, kept as rollback target
Size	`69d22629…`	ListVersions `Size` stamped from the PUT request length (source `1151a88`)	superseded 2026-08-17, kept as rollback target
Gate	`671bcbaf2a1d195a…`	container-PUT account gate fails closed (`503` on failed autocreate + re-check), fail-closed ratelimit / container-sync / account-freeze config parsing, `list_endpoints` v1/v2 (merge `a48a2b2`)	superseded 2026-08-18, kept as rollback target
Guard	`3d0138d5e9970a5e…`	account-level `PUT/DELETE/POST/HEAD /` → 405 `MethodNotAllowed` (Python-aligned); version-index CAS live; `worm_clock_max_offset_ms` default 0 (PR #7, source `5992932`)	live on 4/4 proxies + VIP since 2026-08-18

Guard rolled 1→4→3→2 (VIP owner last), post-roll dual-oracle strict-s3-dual-20260818-postguard.json (SHA-256 52588c82…): 49/8 with a failing-case set identical to post-GATE (50f0c860…). The frozen 57 surface did not regress. Supplement Section B moved 0/3 → 3/3.

Object servers fleet-wide were the 2026-08-18 BUG-1 build (471e8b73340178c0…, source 5992932). Wave-2 e1d4f1cc… remains the rollback copy on each node.

Code tip vs historical live binary

main is deliberately allowed to be ahead of the fleet, and the difference is tracked here rather than blurred:

Historical live proxy record = Guard generation (built 2026-08-18 from main @ 5992932; artifact SHA-256 3d0138d5e9970a5e39e22616c7bd4e3850f207ff8046f749aef0998164a9bcda). Gate 671bcbaf… remains the rollback copy on each node.
Merge a48a2b2 retired the last unmerged branch, codex/hotfix-s3cmd-mb-live-8663-20260814, into main with a verified resolution: the S3 layer was kept byte-identical to main (the hotfix’s s3api rework was superseded by the F1→Size generations, which are dual-oracle verified in that historical roll), while the proxy-side improvements were adopted in Gate.
CI (e78469a): every push and pull request now runs the full workspace suite plus the EC slice on GitHub Actions; fmt/clippy debt is surfaced as report boards. The CI work also pinned liberasurecode ≥ 1.6.5 after reproducing a real upstream concurrency segfault (lab notes).

Recorded on Guard (2026-08-18 proxy roll)

Cross-proxy version-index CAS (PR #3): generation-fence create-only commit; Wave-2 object already enforces If-None-Match: *.
Account-level 405 guard (PR #7): signed PUT /, DELETE /, POST /, HEAD / reject with Python 2.33’s 405 MethodNotAllowed (ResourceType=SERVICE). Post-roll supplement Section B is 3/3; AUTH_dev stayed active (delete_timestamp=0) after the signed DELETE / probe.

Recorded on the 2026-08-18 object roll

BUG-1 native-gate metadata POST (PR #7): tagging-only / restore-only / transition-only sysmeta POST on a locked object is allowed. Mixed payloads that also carry lock keys stay denied. Canary on the existing AUTH_dev leftover: tagging/restore-only object POST 202, mixed 403.

Still awaiting a knob

clock_ok wired, default off (PR #7): [filter:s3api] worm_clock_max_offset_ms stays 0 (historical clock_ok=true). >0 is fail-closed against cached chronyc -c tracking. No behavior change until the knob is set.

Recorded gaps, next code windows

Fence-object offline compactor with a safety proof (fences are permanent in v1 by design).
Second scoreboard tools/strict-s3-supplement.py (PR #8): extras 7/7 vs AWS; account-root negatives 3/3 on live Guard (strict-s3-supplement-20260818-postguard.json, SHA-256 7ef42b96…).

Git branches and candidate provenance

Product repo: github.com/0smboy/Peregrine.

Branch	Role
`main`	the line of record
`build/phase1-deploy-rs-lb`	deploy line — kept at the same tip as `main`
`codex/s3-align-20260815`	S3 alignment line — same tip
`codex/finish-cold-worm-20260814`	cold/WORM line — same tip
`codex/hotfix-s3cmd-mb-live-8663-20260814`	retired into `main` by merge `a48a2b2`; kept for history
`feat/cold…`, `cursor/…`, `honesty/…`, `chore/clippy…`, `chore/fmt…`	ancestors already contained in `main` — never re-merge

The four product branches are pushed together so every line sees the same history. Work starts from the current main tip; the historical dirty working tree outside the product repo is never a merge source.

Provenance strings

Every scored run must name both binaries, e.g. peregrine@size+sha256:69d22629… vs python-swift@2.33.0+s3api+object_versioning+xml-ct@10.0.0.3:8090 — reports without provenance are not evidence.