Backend updates are now delivered as signed channel-specific offers. Each instance follows the image namespace selected by Compose (moshiro-dev or moshiro, unless explicitly overridden). The admin UI receives new offers through SSE and shows the channel and tag. A user must confirm the exact release sequence; the host updater rechecks that sequence, verifies the CI signature and pinned image repository, snapshots the database, updates by digest, restarts, checks /healthz, and restores the database and previous image if startup fails.
The main and version-tag pipelines sign Backend manifests and register them through the release-scoped API token only after publishing the image. Agent and Probe update policies are unchanged.
Agent and Probe hello/heartbeats include IPv6 diagnostics (socket support, listen state, global address, default route, and container/host network scope). Diagnostics report booleans and coarse states; they do not contain IP addresses or interface names. Host-network Compose and systemd examples set the reported scope explicitly.
Validation on Windows: dotnet test --solution MoShiro.slnx -c Release (363 passed, 0 failed, 2 platform/AOT skips); npm run gen:api --prefix web; npm run build --prefix web; npm run lint:css --prefix web. The signed updater shell syntax and existing container-updater regression script also passed under WSL.
Backend updates are now delivered as signed channel-specific offers. Each instance follows the image namespace selected by Compose (`moshiro-dev` or `moshiro`, unless explicitly overridden). The admin UI receives new offers through SSE and shows the channel and tag. A user must confirm the exact release sequence; the host updater rechecks that sequence, verifies the CI signature and pinned image repository, snapshots the database, updates by digest, restarts, checks `/healthz`, and restores the database and previous image if startup fails.
The main and version-tag pipelines sign Backend manifests and register them through the release-scoped API token only after publishing the image. Agent and Probe update policies are unchanged.
Agent and Probe hello/heartbeats include IPv6 diagnostics (socket support, listen state, global address, default route, and container/host network scope). Diagnostics report booleans and coarse states; they do not contain IP addresses or interface names. Host-network Compose and systemd examples set the reported scope explicitly.
Validation on Windows: `dotnet test --solution MoShiro.slnx -c Release` (363 passed, 0 failed, 2 platform/AOT skips); `npm run gen:api --prefix web`; `npm run build --prefix web`; `npm run lint:css --prefix web`. The signed updater shell syntax and existing container-updater regression script also passed under WSL.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Backend updates are now delivered as signed channel-specific offers. Each instance follows the image namespace selected by Compose (
moshiro-devormoshiro, unless explicitly overridden). The admin UI receives new offers through SSE and shows the channel and tag. A user must confirm the exact release sequence; the host updater rechecks that sequence, verifies the CI signature and pinned image repository, snapshots the database, updates by digest, restarts, checks/healthz, and restores the database and previous image if startup fails.The main and version-tag pipelines sign Backend manifests and register them through the release-scoped API token only after publishing the image. Agent and Probe update policies are unchanged.
Agent and Probe hello/heartbeats include IPv6 diagnostics (socket support, listen state, global address, default route, and container/host network scope). Diagnostics report booleans and coarse states; they do not contain IP addresses or interface names. Host-network Compose and systemd examples set the reported scope explicitly.
Validation on Windows:
dotnet test --solution MoShiro.slnx -c Release(363 passed, 0 failed, 2 platform/AOT skips);npm run gen:api --prefix web;npm run build --prefix web;npm run lint:css --prefix web. The signed updater shell syntax and existing container-updater regression script also passed under WSL.