Skip to content

PREVIEW11.md

Latest commit

 

History

History
43 lines (35 loc) · 2.26 KB

PREVIEW11.md

File metadata and controls

43 lines (35 loc) · 2.26 KB
Raw

Preview.11 supervised Buyer bootstrap and Provider offer lifecycle

GATED_UNRELEASED: v0.1.0-preview.11 is not installable until GitHub publishes a non-draft Linux/x64 prerelease with a matching archive and SHA256SUMS asset.

Preview.11 keeps the Preview.9 clean-v4, owner-targeted zero-price lifecycle, adds supervised NetBird bootstrap to punch-buyer join, and includes Provider-owned offer-status, offer-unlist, and offer-retire. Payment settlement, payouts, refunds, public free offers, and self-service Provider onboarding stay disabled.

Buyer join contract

On Linux/x64, join first validates the Punch invitation. It then checks for the official NetBird client. If NetBird is missing, the CLI explains the privileged change and requires interactive confirmation or the explicit automation flag --yes before downloading the official installer. It never runs an unauthenticated curl | sh pipeline.

After Buyer authentication, Control may issue one one-off, ephemeral setup key bound to that approved Buyer and the existing narrow Buyer group. The CLI gives the key to NetBird through a private mode-0600 temporary file, verifies startup connectivity, and immediately removes the local file. The Buyer does not need a NetBird dashboard, NetBird login, or second enrollment code. Setup key values must not appear in command arguments, public configuration, output, or logs. A consumed enrollment cannot mint a second peer.

Unsupported platforms and declined privileged installation fail closed before any package change. If enrollment fails, retry the exact same Punch invitation; do not obtain or paste a setup key manually.

Proof boundary

The machine-readable Preview.11 runtime contract binds private release source 0e615565780e60c49fd1c5fc6d1d07940e1d4be4, tree 1b78916a4896459365b7ad3439a5e67bb5794f99, proven runtime/builder commit 76041898382f764d3404ecb12112b684bafad1af, Linux/x64, the immutable images, and this contract. The Provider offer lifecycle has one disposable PostgreSQL integration pass; that is not exact archive acceptance. The release remains gated until an isolated Linux/x64 Buyer completes join, discovery, targeted $0 order, brokered SSH, Buyer stop, revocation, and cleanup with the exact archive.