feat: release Dever 0.1.5 with direct workers and long transactions

test/dever-cli-tests/native_release/bootstrap.rs

@@ -64,7 +64,6 @@ fn bootstrap_payload_has_a_separate_signed_complete_loader_closure() {
         "bootstrap/deverd",
         "bootstrap/lib/libgcc_s.so.1",
         "bootstrap/deverd.service",
-        "bootstrap/dever-sandbox",
     ] {
         let artifact = manifest
             .artifacts
@@ -78,9 +77,12 @@ fn bootstrap_payload_has_a_separate_signed_complete_loader_closure() {
     assert!(unit.contains("RuntimeDirectory=dever"));
     assert!(!unit.contains("Environment"));
     assert!(!unit.contains("PATH"));
-    assert_eq!(
-        fs::read_to_string(release.join("bootstrap/dever-sandbox")).unwrap(),
-        dever_sandbox::APPARMOR_PROFILE
+    assert!(!release.join("bootstrap/dever-process").exists());
+    assert!(
+        !manifest
+            .artifacts
+            .iter()
+            .any(|artifact| artifact.path.contains("bwrap") || artifact.path.contains("apparmor"))
     );
 }
 
@@ -174,6 +176,73 @@ fn signed_installed_versions_keep_their_original_bootstrap_service_template() {
     );
 }
 
+#[test]
+fn signed_historical_bootstrap_profiles_are_read_only_and_version_bound() {
+    use dever_cli::toolchain::{Artifact, Layout, MachineManager, Version};
+    for release_version in ["0.1.4", "0.1.5"] {
+        let mut author = Author::new();
+        author.settings["version"] = json!(release_version);
+        add_bootstrap(&mut author);
+        author.save();
+        let machine = TemporaryDirectory::new();
+        let layout = Layout::new(machine.path().join("machine"));
+        layout.initialize().unwrap();
+        let version = Version::parse(release_version).unwrap();
+        let installed = layout.versions().join(release_version);
+        let mut manifest = packaging::create(&author.root, &installed).unwrap();
+        let profile = installed.join("bootstrap/dever-sandbox");
+        fs::write(&profile, b"historical profile fixture\n").unwrap();
+        manifest.artifacts.push(Artifact {
+            path: "bootstrap/dever-sandbox".into(),
+            bytes: fs::metadata(&profile).unwrap().len(),
+            sha256: sha256_file(&profile).unwrap(),
+        });
+        let encoded = serde_json::to_vec(&manifest).unwrap();
+        let key = Ed25519KeyPair::from_pkcs8(&fs::read(author.root.join("signing.pk8")).unwrap())
+            .unwrap();
+        fs::write(installed.join("manifest.json"), &encoded).unwrap();
+        fs::write(
+            installed.join("manifest.sig"),
+            key.sign(&encoded)
+                .as_ref()
+                .iter()
+                .map(|byte| format!("{byte:02x}"))
+                .collect::<String>(),
+        )
+        .unwrap();
+        fs::write(
+            layout.state().join("trusted-release-key"),
+            author
+                .public_key
+                .iter()
+                .map(|byte| format!("{byte:02x}"))
+                .collect::<String>(),
+        )
+        .unwrap();
+        let manager = MachineManager::new(layout);
+        if release_version == "0.1.4" {
+            assert_eq!(
+                manager.resolve_core(&version).unwrap(),
+                installed.join("dever-core")
+            );
+            fs::write(profile, b"unsigned change").unwrap();
+            assert!(
+                manager
+                    .resolve_core(&version)
+                    .unwrap_err()
+                    .contains("integrity verification")
+            );
+        } else {
+            assert!(
+                manager
+                    .resolve_core(&version)
+                    .unwrap_err()
+                    .contains("unsupported artifact")
+            );
+        }
+    }
+}
+
 #[test]
 #[ignore = "root-only installer trust rejection; never touches the actual machine installation"]
 fn bootstrap_installer_rejects_untrusted_inputs_before_publication() {
@@ -313,7 +382,6 @@ fn bootstrap_recovery_is_idempotent_and_rejects_unrecorded_targets() {
     for directory in [
         "usr/local/bin",
         "etc/systemd/system/multi-user.target.wants",
-        "etc/apparmor.d",
     ] {
         fs::create_dir_all(root.join(directory)).unwrap();
     }
@@ -331,20 +399,12 @@ fn bootstrap_recovery_is_idempotent_and_rejects_unrecorded_targets() {
     let link_hash =
         |target: &str| format!("{:x}", Sha256::digest(format!("link\0{target}").as_bytes()));
     let journal = json!({"format":"dever-bootstrap-transaction-v1","phase":"prepared","service_was_active":null,"service_start_requested":false,"changes":[
-        {"target":"sandbox","before":null,"after":node_hash("directory",b"")},
-        {"target":"apparmor","before":null,"after":node_hash("file",b"new profile")},
         {"target":"bin","before":node_hash("directory",b""),"after":node_hash("directory",b"")},
         {"target":"service","before":null,"after":node_hash("file",b"new service")},
         {"target":"entry","before":null,"after":link_hash("/opt/dever/bin/dever")},
         {"target":"enable","before":null,"after":link_hash("../deverd.service")},
         {"target":"active","before":null,"after":node_hash("file",b"new active")}
     ]});
-    fs::create_dir(root.join("opt/dever/.dever-bootstrap-sandbox.next")).unwrap();
-    fs::write(
-        root.join("etc/apparmor.d/.dever-bootstrap-dever-sandbox.next"),
-        b"new profile",
-    )
-    .unwrap();
     let path = layout.state().join("bootstrap-install.json");
     fs::write(&path, serde_json::to_vec(&journal).unwrap()).unwrap();
     let mut invalid = journal.clone();
@@ -374,8 +434,6 @@ fn bootstrap_recovery_is_idempotent_and_rejects_unrecorded_targets() {
     // undo the new active version, including after a failed cleanup retry.
     fs::write(&service, b"new service").unwrap();
     symlink("/opt/dever/bin/dever", &entry).unwrap();
-    fs::create_dir(root.join("opt/dever/sandbox")).unwrap();
-    fs::write(root.join("etc/apparmor.d/dever-sandbox"), b"new profile").unwrap();
     symlink(
         "../deverd.service",
         root.join("etc/systemd/system/multi-user.target.wants/deverd.service"),