conduit: upgrade to v0.10.15

[bborbe]

Upgrade Conduit on hetzner-1 v0.10.12 -> v0.10.15.

• v0.10.13: auth bypass fix (upgrade ASAP)
• v0.10.14: account takeover fix (upgrade ASAP)
• v0.10.15: optional notary-key settings, no config action

Already applied to hz.hetzner-1 from this branch (bw apply -o bundle:conduit-server + manual daemon-reload/restart); running image verified v0.10.15, client API /versions answers.

[ben-s-pull-request-reviewer]

All facts verified. Writing the verdict.

{
  "verdict": "approve",
  "summary": "Single-line version bump in bundles/conduit-server/metadata.py (v0.10.12 -> v0.10.15), verified against the actual consuming template and upstream. The value feeds the image tag directly (conduit-server.service: ExecStart ... matrix-conduit:${version}), the registry tag matrix-conduit:v0.10.15 exists, and upstream v0.10.15 (released 2026-09-29) is the newest release and contains both the v0.10.13 auth-bypass fix and the v0.10.14 account-takeover fix, so the commit message is accurate and the upgrade is complete. Repo-wide grep found no other Conduit version pin (node hz.hetzner-1.py does not override it; groups/meta/bundles.py only names the bundle), the repo has no CHANGELOG.md so no changelog convention is broken, and HEAD sits on feat/conduit-0.10.15 delivered via PR #51 with no tags in the repo. Selector traceability: 8 candidates from the Step 4b-i glob, 6 applicable, 2 skipped (go-security/resource-ownership, go-security/tenant-isolation — both require a changed Go handler/service method and the diff contains no .go file); mechanical funnel reported 0 findings; no .reviewignore present (0 files excluded); precommit skipped (selector mode) — CI covers lint+test. Notes: the commit subject is 76 chars, exceeding the 50-char SHOULD-tier rule git-commit/subject-under-50-chars, but it pins to no file so it is recorded here rather than as an un-pinned comment. No Must Fix, Should Fix, or Nice to Have findings.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "security: verify v0.10.15 is the correct complete fix version and that the bumped tag actually reaches the deployed image — metadata.py only sets the version string, so confirm the image tag is derived from it and not pinned separately.",
      "disposition": "not-an-issue",
      "detail": "The version string is not inert: bundles/conduit-server/files/conduit-server.service line 'ExecStart=/usr/bin/docker run ... registry.gitlab.com/famedly/conduit/matrix-conduit:${version}' consumes it directly, so the metadata bump is the image-tag pin — no second pin exists. The registry tag matrix-conduit:v0.10.15 exists (verified against the GitLab container-registry API). Upstream v0.10.15 (2026-09-29) is the newest release and is a superset of v0.10.13 (auth bypass) and v0.10.14 (account takeover), so it is the correct complete fix version. The PR body additionally reports the change was applied to hz.hetzner-1 and the running image confirmed at v0.10.15 with /versions responding."
    },
    {
      "concern": "correctness: check whether the Conduit version is pinned anywhere else (docker-compose, image tag lists, lockfiles, README/docs, CHANGELOG) — if so, this one-line change leaves the repo inconsistent with the running deployment.",
      "disposition": "not-an-issue",
      "detail": "Repo-wide case-insensitive grep for 'conduit' returns only 6 files: nodes/hz.hetzner-1.py, groups/meta/bundles.py, and the 4 files of the bundle itself. Grep for v0.10.1x returns exactly one hit — metadata.py:6. nodes/hz.hetzner-1.py enables the bundle but sets no 'version' key, so it inherits the new default; groups/meta/bundles.py only lists the bundle name. No docker-compose, lockfile, or docs reference the version. The change is consistent, not partial."
    },
    {
      "concern": "correctness: confirm the upstream release tag v0.10.15 exists and is not a typo (e.g. vs v0.10.14 or v0.10.16), and that the release comment URL still points at the correct releases page.",
      "disposition": "not-an-issue",
      "detail": "The GitLab API for famedly/conduit returns tag v0.10.15 (target commit a3dd72ed51df0668049309280ac6f6bdd0e085bf, protected) as the most recent entry, and no v0.10.16 exists — so the value is neither stale nor a typo. The comment URL 'https://gitlab.com/famedly/conduit/-/releases' is the live releases page for the same project the image registry path references."
    },
    {
      "concern": "correctness: PR body states v0.10.15 adds optional notary-key settings with no config action required — verify that the new version does not require additional or renamed config keys that this bundle does not yet set.",
      "disposition": "not-an-issue",
      "detail": "Upstream v0.10.15 release notes describe the additions as options ('Added an option to set the expected public keys for notary servers', 'Added an option to set old_verify_keys') — optional, with defaults, not required or renamed keys. The bundle's conduit.toml sets only global.server_name, database_path, database_backend, port, address, allow_registration, allow_federation, all of which are unchanged across the 0.10.x line. Empirically the server started and answered /versions after the deploy per the PR body, which would not happen with an invalid or missing required key."
    },
    {
      "concern": "tests: no test, CI check, or changelog entry accompanies the bump. Check repo convention: whether a CHANGELOG entry is expected and whether anything validates the effective deployed version.",
      "disposition": "not-an-issue",
      "detail": "The repo has no CHANGELOG.md anywhere (verified by filesystem search), so no changelog convention is violated. Precedent confirms the convention: the two prior bumps of this same file — 3d9b93c 'fix(conduit-server): pin version to v0.10.11' and d8816ef 'update conduit-serve' — were also single-line metadata.py changes with no accompanying test or changelog entry. Validation is CI's job: Makefile 'test' runs 'bw test --ignore-missing-faults', which parses and validates the bundle including this metadata; precommit was skipped in selector mode per procedure and CI covers lint+test."
    }
  ]
}