Make native AOS Homebrew convergence refresh-safe #748

New issue

Closed

opened 2026-08-04 22:49:03 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-04 22:49:03 +00:00

Owner

The aos-native role asks Homebrew for state: latest without refreshing existing taps. community.general.homebrew disables automatic updates by default, so server tap clones can predate Formula/aos.rb or the paired aosguard resource.

The role also declares a fixed aos_native_version while consuming the tap's rolling latest formula. After a correct refresh, the rolling release can advance beyond the declared value and fail the final assertion.

Acceptance:

Refresh Homebrew metadata before resolving the AOS formula.
Treat the tap release as the channel source and require aos and aosguard to report the same release.
Keep clean-environment verification and bounded rollback behavior.
Update stale documentation that still describes the role as disabled.
Validate through the repository Ward gate.

The `aos-native` role asks Homebrew for `state: latest` without refreshing existing taps. `community.general.homebrew` disables automatic updates by default, so server tap clones can predate `Formula/aos.rb` or the paired `aosguard` resource. The role also declares a fixed `aos_native_version` while consuming the tap's rolling latest formula. After a correct refresh, the rolling release can advance beyond the declared value and fail the final assertion. Acceptance: * Refresh Homebrew metadata before resolving the AOS formula. * Treat the tap release as the channel source and require `aos` and `aosguard` to report the same release. * Keep clean-environment verification and bounded rollback behavior. * Update stale documentation that still describes the role as disabled. * Validate through the repository Ward gate.

coilyco-ops referenced this issue from a commit

2026-08-04 22:54:58 +00:00

fix(ansible): refresh native AOS release channel

coilyco-ops commented

2026-08-04 22:55:30 +00:00

Author

Owner

Implemented by ed584b9eb3 on canonical main.

Refreshes Homebrew metadata before resolving the AOS channel formula.
Removes the stale fixed version pin.
Requires aos and aosguard to report the same aos-v* release.
Updates the rollout, rollback, README, and feature documentation.

Validation passed with ward exec ansible-lint and ward exec pre-commit.

The intended closing trailer was rendered with literal newline escapes in the pushed commit body, so this comment records the link before explicit closure.

Implemented by ed584b9eb34adb532ff9fa5d7722691bb14fb96a on canonical `main`. * Refreshes Homebrew metadata before resolving the AOS channel formula. * Removes the stale fixed version pin. * Requires `aos` and `aosguard` to report the same `aos-v*` release. * Updates the rollout, rollback, README, and feature documentation. Validation passed with `ward exec ansible-lint` and `ward exec pre-commit`. The intended closing trailer was rendered with literal newline escapes in the pushed commit body, so this comment records the link before explicit closure.

coilyco-ops closed this issue

2026-08-04 22:55:34 +00:00

coilyco-ops referenced this issue

2026-08-04 23:05:10 +00:00

Scope native AOS Homebrew refresh to its declared tap #750