feat(release): publish installable memd and reconcile /v1/version (#151) by waterbro-8 · Pull Request #216 · bytefolk/mem

waterbro-8 · 2026-09-17T08:17:09Z

Requirement and scope

Re-lands #157 onto current main as an organization branch. #157 was closed because the fork head could not carry CI, not because the work was rejected.

Refs #151. Implementation owner on the issue is @waterbro-8; human review owner is @Bindy-lbb. Original implementation: @sun-970.

Changes

Release workflow builds memd, mem-migrate, mem-healthcheck, and mem for linux/darwin amd64/arm64 in addition to mem-mcp.
Two checksum manifests: mem-mcp-checksums.txt (6) and mem-checksums.txt (16). The post-fix(release): validate compare links and protect checksum output (successor to #170) #199 output-path protections (no process-substitution find, no wc -l, refuse existing/late output symlinks, private mktemp staging) are kept and applied to both manifests.
/v1/version exposes distinct version / revision / contract fields; CLI mem version prints them and still redacts the server URL.
Docker image and DEPLOYMENT.md first-run notes from feat(release): publish installable memd and reconcile /v1/version with client revision pins #157.

Validation ledger

ID	Criterion	Command	Status
V1	Checksum output safety	`bash scripts/test_release_checksum_output_safety.sh`	PASS
V2	Release guards	`bash scripts/test_release_guards.sh`	PASS
V3	Bash 3.2 helper compat	`bash scripts/test_release_helpers_compat.sh`	PASS
V4	`git diff --check`	local	PASS
V5	Go API/CLI tests	`make test-server`	NOT VERIFIED — host Go is 1.22.12, module requires 1.25.0
V6	Built release binaries on six platforms	release workflow	NOT VERIFIED — no tag cut
V7	Client revision pin against a published memd	needs published artifact	NOT VERIFIED

No tag, GitHub Release, npm publish, merge, or issue closure is performed by this PR.

waterbro-8 · 2026-09-17T16:11:00Z

CI is green after the Windows npm rerun. I cannot approve or merge: I am the author. Needs @PeterGuy326 or @Bindy-lbb.

waterbro-8 · 2026-09-17T16:22:25Z

请评审合入（作者是我，不能自批）。

把可安装的 memd/mem/mem-migrate/mem-healthcheck 纳入 release，并分开 version/revision/contract。CI 已绿（Windows npm 重跑后通过）。

需要 @PeterGuy326 或 @Bindy-lbb 批准。不切 tag、不发 npm。

PeterGuy326

HOLD: current head 4f6fcd6 is conflicting with main, so this cannot be approved or merged yet. Please update the branch onto the current main, rerun the required CI for that new head, and refresh the still-unverified Go/release validation items in the ledger before requesting CODEOWNER review.

xiaocui-big · 2026-09-18T03:59:44Z

平台组 Review（崔泽生，assigned by @冯浩然）

一、总体评价

将 memd、mem-migrate、mem-healthcheck、mem 四个 server 二进制纳入 release 发布流程，并将 /v1/version 扩展为 version / revision / contract 三字段。整体方向正确，release 安全模型（preflight → build → draft → verify → publish）保持一致。但存在一个 release 验证会失败的 bug。

二、阻塞问题

release.yml 资产数量断言与实际列表不一致（length == 23 vs 实际 24 项）

两处 jq 验证都写的是 (.assets | length == 23)，但 expected_assets 列表实际包含 24 个条目：

分组	数量
`memd-{darwin,linux}-{amd64,arm64}`	4
`mem-migrate-{darwin,linux}-{amd64,arm64}`	4
`mem-healthcheck-{darwin,linux}-{amd64,arm64}`	4
`mem-{darwin,linux}-{amd64,arm64}`	4
`mem-mcp-{darwin,linux}-{amd64,arm64}` + windows exe	6
`mem-checksums.txt`	1
`mem-mcp-checksums.txt`	1
合计	24

release job 的 draft 验证步骤 一定会失败，发布流程走不通。需要将两处 length == 23 改为 length == 24。

建议：资产清单在 workflow 中硬编码了三处（assets=() 数组、两处 expected_assets），考虑提取成变量或用脚本生成，避免将来再加平台/二进制时再次不同步。

三、重要但非阻塞

Dockerfile 中 mem-migrate / mem-healthcheck / mem / mem-mcp 没有注入版本 ldflags——memd 正确传入了 VERSION / REVISION / CONTRACT_VERSION，但其余四个仍是 -ldflags="-s -w"。用户从 Docker 镜像 exec mem version 会看到 dev。建议保持一致或在注释中说明 by design。
/v1/version 暴露完整 git commit SHA——当前无需认证即可访问。不是漏洞（tag 公开，go version -m 也能读出），但值得确认有意为之。从 DEPLOYMENT.md 看，curl /v1/version 作为无认证可达性检查，设计合理。
generate_release_checksums.sh trap 嵌套——generate_checksums() 内 trap cleanup_tmp EXIT 是全局的，两次顺序调用间 trap - EXIT 清除了，功能没问题。但未来若并行调用或中途 return，tmp 文件可能泄漏。建议改用显式 cleanup 调用。
PR 分支落后 main（mergeable_state: behind）——rebase 后需确认 CI 重跑绿，以及 main 上若有新 binary 需相应更新资产列表。

四、做得好的地方

/v1/version 三字段设计清晰，ldflags 注入路径完整
api_test.go 新增 TestVersionEndpointExposesAllCoordinates 覆盖三字段
build-server job 完整复制了 build-mcp 的安全模式（checkout exact tag → revalidate → build with ldflags → verify vcs.revision）
go version -m 验证 vcs.revision 和 vcs.modified=false 是好的 supply-chain 实践
Checksum 脚本重构的 generate_checksums 函数抽象合理
CI 21/21 全绿

五、合并阻塞项

项	状态
asset count 23→24 修复	❌ 必须修
Rebase 到 main（behind）	❌ 需 rebase
非 author APPROVE	❌ 尚无

六、核心判断

核心设计合理，安全模型一致，测试覆盖到位。但 asset count bug 会导致 release 流程失败，必须合并前修复。修复 + rebase 后可进入 CODEOWNER 审批。

Rebased onto main. Also fix draft asset count: upload mem-mcp-checksums.txt and require 24 assets so jq matches the inventory. Refs: #151

waterbro-8 · 2026-09-18T05:02:21Z

Addressed 崔泽生's blocking review:

Rebased onto current main (884b54d).
Draft asset inventory is now 24: gh release create also uploads mem-mcp-checksums.txt, and both jq checks plus test_release_guards.sh require length == 24.

Head: c5679bf.

sun-970

Review — Comment (not approving yet)

Scope: #151 publish installable memd and reconcile /v1/version.

Analysis

Server binary publishing ✅ — New build-server job in release workflow builds memd, mem-migrate, mem-healthcheck for linux/darwin amd64/arm64. Binary verification via go version -m checks vcs.revision and vcs.modified=false.
/v1/version endpoint ✅ — Returns version (semver), revision (40-hex git commit), and contract (informational). Clean separation: clients can pin by revision or accept a version range.
Release guards ✅ — Checksum generation, release helper compatibility tests, and Dockerfile VERSION/REVISION injection all present.
Documentation ✅ — DEPLOYMENT.md updated with post-install verification steps.

Blocker

Merge conflict with main — PeterGuy326 flagged this in an earlier review. The branch needs to be rebased onto current main before this can be approved. Once rebased and CI re-verified, I will approve.

waterbro-8 · 2026-09-18T07:16:55Z

Rebased onto current main after #217 (cdc7cd6e). Required CI is green on this head (Go, PostgreSQL integration, CodeQL, npm wrapper, web, worker, deployment profiles).

@sun-970 you previously said you would approve after rebase + CI; please take another look.

waterbro-8 · 2026-09-18T07:40:37Z

Squash-merged #219. Updating this branch onto current main.

waterbro-8 · 2026-09-18T07:47:21Z

Post-#219 update-branch CI is green on caae9ed5 (Go, PostgreSQL integration, CodeQL, npm wrapper, web, worker, deployment profiles). Still needs review/CODEOWNERS before merge.

sun-970

Review — Approve

Head caae9ed is mergeable onto current main. Previous blockers are gone:

Draft asset inventory is 24 in both jq checks, test_release_guards.sh, and the gh release create upload list (16 server binaries + 6 mcp + 2 checksum manifests).
Branch is no longer conflicting; required CI on this head is green (Go, PostgreSQL, HTTP/CLI/MCP lifecycle, CodeQL, npm, web, worker, deployment profiles).

What I re-checked

build-server job builds memd / mem-migrate / mem-healthcheck / mem for linux+darwin amd64/arm64, injects version/revision/contract ldflags, and verifies vcs.revision + vcs.modified=false.
/v1/version returns three distinct fields; TestVersionEndpointExposesAllCoordinates covers them; CLI still redacts the server URL.
Checksum split (mem-checksums.txt 16 rows, mem-mcp-checksums.txt 6 rows) matches the asset sets in generate_release_checksums.sh and the guard tests.
Release safety model (preflight → build-mcp + build-server → draft → verify → publish) is intact; pattern filter on artifact download was correctly removed so server assets are included.

No tag / npm publish / issue close in this PR, as stated.

Non-blocking (do not hold merge)

Dockerfile injects VERSION/REVISION/CONTRACT only into memd. mem / mem-migrate / mem-healthcheck / mem-mcp still build with -ldflags="-s -w". /v1/version is served by memd, so this is OK; mem version inside the image will still print dev. Docs say “the Docker image inject[s] all three at build time” — true for memd only.
docs/DEPLOYMENT.md says Compose/Helm pass the tag commit as REVISION. deploy/compose/compose.yaml currently only passes VERSION. Not a release-path bug.

CODEOWNER still needs to approve for merge (REVIEW_REQUIRED / branch protection). I am not a CODEOWNER.

waterbro-8 · 2026-09-18T07:50:33Z

sun-970 approved current head caae9ed5. CI is green. Merge is still blocked on CODEOWNERS (@Bindy-lbb / @PeterGuy326); I cannot self-approve.

Bindy-lbb

Reviewed current head caae9ed.

Previous release-build blocker is fixed: go build -buildvcs=true is now passed as a build flag, separate from -ldflags.
Release asset inventory/checksum guards are consistent.
/v1/version coordinates and CLI redaction coverage are present.
Branch is mergeable and all required CI checks are green.

Non-blocking note: Docker injects VERSION/REVISION/CONTRACT into memd only; this is sufficient for the served /v1/version endpoint.

Rebase the identity migration onto current main. Windows installer EPERM lock retry is already on main from #216; this commit only moves package name, version, cache namespace, and matching docs/tests to ByteFolk 0.1.2.

waterbro-8 requested review from Bindy-lbb and PeterGuy326 as code owners September 17, 2026 08:17

waterbro-8 mentioned this pull request Sep 17, 2026

feat(release): publish an installable memd artifact and reconcile /v1/version with client revision pins #151

Open

PeterGuy326 reviewed Sep 18, 2026

View reviewed changes

PeterGuy326 force-pushed the feat/151-memd-release-artifacts branch 2 times, most recently from e93b94a to e42ef06 Compare September 18, 2026 03:29

feat(release): publish installable memd and reconcile /v1/version (#151)

c5679bf

Rebased onto main. Also fix draft asset count: upload mem-mcp-checksums.txt and require 24 assets so jq matches the inventory. Refs: #151

waterbro-8 force-pushed the feat/151-memd-release-artifacts branch from d1e4791 to c5679bf Compare September 18, 2026 05:01

waterbro-8 requested a review from PeterGuy326 September 18, 2026 05:13

sun-970 reviewed Sep 18, 2026

View reviewed changes

Merge branch 'main' into feat/151-memd-release-artifacts

cdc7cd6

Merge branch 'main' into feat/151-memd-release-artifacts

caae9ed

sun-970 approved these changes Sep 18, 2026

View reviewed changes

Bindy-lbb approved these changes Sep 18, 2026

View reviewed changes

waterbro-8 merged commit 3cf85bf into main Sep 18, 2026
21 checks passed

waterbro-8 deleted the feat/151-memd-release-artifacts branch September 18, 2026 07:59

waterbro-8 mentioned this pull request Sep 18, 2026

chore(release): rebase ByteFolk mem-mcp 0.1.2 and add MCP Registry OIDC (G5) #222

Open

3 tasks

waterbro-8 mentioned this pull request Sep 18, 2026

chore(release): prepare ByteFolk mem-mcp 0.1.2 #193

Closed

Navigation Menu

feat(release): publish installable memd and reconcile /v1/version (#151) - #216

feat(release): publish installable memd and reconcile /v1/version (#151)#216
waterbro-8 merged 3 commits into
mainfrom
feat/151-memd-release-artifacts

waterbro-8 commented Sep 17, 2026

Uh oh!

waterbro-8 commented Sep 17, 2026

Uh oh!

waterbro-8 commented Sep 17, 2026

Uh oh!

PeterGuy326 left a comment

Uh oh!

xiaocui-big commented Sep 18, 2026

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

sun-970 left a comment

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

sun-970 left a comment

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

Bindy-lbb left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

waterbro-8 commented Sep 17, 2026

Requirement and scope

Changes

Validation ledger

Uh oh!

waterbro-8 commented Sep 17, 2026

Uh oh!

waterbro-8 commented Sep 17, 2026

Uh oh!

PeterGuy326 left a comment

Choose a reason for hiding this comment

Uh oh!

xiaocui-big commented Sep 18, 2026

平台组 Review（崔泽生，assigned by @冯浩然）

一、总体评价

二、阻塞问题

三、重要但非阻塞

四、做得好的地方

五、合并阻塞项

六、核心判断

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

sun-970 left a comment

Choose a reason for hiding this comment

Review — Comment (not approving yet)

Analysis

Blocker

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

sun-970 left a comment

Choose a reason for hiding this comment

Review — Approve

What I re-checked

Non-blocking (do not hold merge)

Uh oh!

waterbro-8 commented Sep 18, 2026

Uh oh!

Bindy-lbb left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants