release: freeze Nexus One AI 1.0.0-rc1
This commit is contained in:
Jino Jose committed
1 parent
63acefd890
commit
4f1419ca93
152 files changed
+9445
-828
No files matched your search
@@ -0,0 +1,15 @@
|
||||
# Nexus One AI 1.0.0-rc1
|
||||
|
||||
This is the frozen RC1 release contract for a model-less, offline-capable appliance. It includes local browser commissioning, signed 30-day machine-bound trial generation, license feature profiles, monitoring and backup/restore hooks, SBOM/checksum gates, and clean-server qualification. Model weights are separate future signed packs.
|
||||
|
||||
Coding and Meeting edge agents are not implemented or licensed in RC1. `agent-registry.schema.json` reserves only their future centrally managed control-plane contract: enrollment, device identity, certificates, declared capabilities, content-free audit correlation and license allocation.
|
||||
|
||||
RC1 is fail-closed. A distributable artifact may not be called signed or qualified until an approved amd64 build host supplies a non-empty Ubuntu base ISO, complete offline payload, production release key, generated SBOM/checksums, and a passing disconnected wiped-server qualification receipt.
|
||||
|
||||
Generate the customer trial only on the controlled signing host:
|
||||
|
||||
```sh
|
||||
python3 make-trial.py --private-key /secure/trial.pem --machine-id MACHINE_ID --customer CUSTOMER --output trial.json
|
||||
```
|
||||
|
||||
Qualification deliberately returns non-zero unless real media is supplied and the command runs as root on a disposable Linux server with `NEXUS_OFFLINE_QUALIFICATION=1`.
|
||||
@@ -0,0 +1,25 @@
|
||||
{
|
||||
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||
"$id": "https://nexus.cezen.local/schemas/edge-agent-registry-v1.json",
|
||||
"title": "Nexus centrally managed edge-agent registration",
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["agentId", "deviceId", "agentType", "certificateFingerprint", "capabilities", "status", "enrolledAt"],
|
||||
"properties": {
|
||||
"agentId": {"type": "string", "format": "uuid"},
|
||||
"deviceId": {"type": "string", "format": "uuid"},
|
||||
"agentType": {"enum": ["coding", "meeting"]},
|
||||
"certificateFingerprint": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
|
||||
"capabilities": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[a-z][a-z0-9.-]{1,63}$"}},
|
||||
"status": {"enum": ["pending", "enrolled", "suspended", "revoked"]},
|
||||
"enrolledAt": {"type": "string", "format": "date-time"},
|
||||
"lastSeenAt": {"type": ["string", "null"], "format": "date-time"},
|
||||
"licenseAllocation": {
|
||||
"type": "object", "additionalProperties": false,
|
||||
"required": ["profile", "seatUnits"],
|
||||
"properties": {"profile": {"type": "string"}, "seatUnits": {"type": "integer", "minimum": 0}}
|
||||
},
|
||||
"auditContext": {"type": "object", "description": "Content-free correlation metadata only"}
|
||||
},
|
||||
"$comment": "Contract reserved for post-RC1 use. RC1 exposes no Coding or Meeting agent runtime."
|
||||
}
|
||||
Executable
+20
@@ -0,0 +1,20 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
if [ "$#" -ne 4 ]; then echo "Usage: $0 BASE_ISO OFFLINE_PAYLOAD RELEASE_PRIVATE_KEY OUTPUT_ISO" >&2; exit 2; fi
|
||||
base=$(cd "$(dirname "$1")" && pwd)/$(basename "$1")
|
||||
payload=$(cd "$(dirname "$2")" && pwd)/$(basename "$2")
|
||||
key=$(cd "$(dirname "$3")" && pwd)/$(basename "$3")
|
||||
out=$4
|
||||
for f in "$base" "$payload" "$key"; do test -s "$f" || { echo "Missing/empty required input: $f" >&2; exit 1; }; done
|
||||
case "$(basename "$payload")" in *model*|*gguf*|*safetensors*) echo "Model payloads are forbidden in RC1" >&2; exit 1;; esac
|
||||
command -v xorriso >/dev/null; command -v openssl >/dev/null
|
||||
work=$(mktemp -d); trap 'rm -rf "$work"' EXIT
|
||||
xorriso -osirrox on -indev "$base" -extract / "$work/iso" >/dev/null 2>&1
|
||||
mkdir -p "$work/iso/nexus/rc1"
|
||||
cp "$payload" "$work/iso/nexus/rc1/offline-payload.tar.zst"
|
||||
cp "$(dirname "$0")/release.json" "$(dirname "$0")/feature-profiles.json" "$(dirname "$0")/agent-registry.schema.json" "$work/iso/nexus/rc1/"
|
||||
(cd "$work/iso/nexus/rc1" && find . -type f -print0 | sort -z | xargs -0 shasum -a 256 > SHA256SUMS)
|
||||
openssl dgst -sha256 -sign "$key" -out "$work/iso/nexus/rc1/SHA256SUMS.sig" "$work/iso/nexus/rc1/SHA256SUMS"
|
||||
echo "RC1 content staged and signed. Use the Ubuntu-preserving hybrid repack in phase2/appliance-iso/build-iso.sh on the approved amd64 build host." >&2
|
||||
echo "$work/iso"
|
||||
test "${NEXUS_ALLOW_UNQUALIFIED_REPACK:-0}" = 1 || { echo "Refusing unqualified local repack; stage path retained only during this process." >&2; exit 1; }
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
"schema": "nexus.feature_profiles.v1",
|
||||
"profiles": {
|
||||
"trial": {
|
||||
"features": ["portal", "commissioning", "chat-shell", "knowledge", "audit", "monitoring", "backup-restore", "agent-control-plane"],
|
||||
"limits": {"humanSeats": 10, "registeredEdgeDevices": 0, "activeEdgeAgents": 0},
|
||||
"modelsIncluded": false
|
||||
},
|
||||
"team": {
|
||||
"features": ["portal", "commissioning", "chat-shell", "knowledge", "audit", "monitoring", "backup-restore", "agent-control-plane", "api-access"],
|
||||
"limits": {"humanSeats": 25, "registeredEdgeDevices": 25, "activeEdgeAgents": 0},
|
||||
"modelsIncluded": false
|
||||
},
|
||||
"enterprise": {
|
||||
"features": ["portal", "commissioning", "chat-shell", "knowledge", "audit", "monitoring", "backup-restore", "agent-control-plane", "api-access", "advanced-guardrails"],
|
||||
"limits": {"humanSeats": 100, "registeredEdgeDevices": 250, "activeEdgeAgents": 0},
|
||||
"modelsIncluded": false
|
||||
}
|
||||
},
|
||||
"rc1AgentRuntimePolicy": "deny-all"
|
||||
}
|
||||
Executable
+39
@@ -0,0 +1,39 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Create a production-key-signed, machine-bound 30-day offline trial."""
|
||||
import argparse, base64, copy, datetime as dt, json, subprocess, tempfile, uuid
|
||||
from pathlib import Path
|
||||
|
||||
def canonical(value):
|
||||
clean = copy.deepcopy(value)
|
||||
clean.pop("signature", None)
|
||||
clean.pop("signature_status", None)
|
||||
return json.dumps(clean, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
|
||||
|
||||
def main():
|
||||
p = argparse.ArgumentParser()
|
||||
p.add_argument("--private-key", required=True)
|
||||
p.add_argument("--machine-id", required=True)
|
||||
p.add_argument("--customer", required=True)
|
||||
p.add_argument("--output", required=True)
|
||||
a = p.parse_args()
|
||||
now = dt.datetime.now(dt.timezone.utc).replace(microsecond=0)
|
||||
payload = {
|
||||
"schema": "cezen.license.v2", "license_id": str(uuid.uuid4()),
|
||||
"install_type": "offline-trial", "customer_name": a.customer,
|
||||
"allowed_tier": "starter", "feature_profile": "trial",
|
||||
"feature_overrides": {"agent_runtime": False, "model_weights": False},
|
||||
"limits": {"trial_days": 30, "registered_edge_devices": 0, "active_edge_agents": 0},
|
||||
"machine_binding": {"machine_id": a.machine_id},
|
||||
"issued_at": now.isoformat().replace("+00:00", "Z"),
|
||||
"expires_at": (now + dt.timedelta(days=30)).isoformat().replace("+00:00", "Z"),
|
||||
"signature_alg": "rsa-sha256"
|
||||
}
|
||||
with tempfile.TemporaryDirectory() as d:
|
||||
body, sig = Path(d)/"body", Path(d)/"sig"
|
||||
body.write_bytes(canonical(payload))
|
||||
subprocess.run(["openssl", "dgst", "-sha256", "-sign", a.private_key, "-out", sig, body], check=True)
|
||||
payload["signature"] = base64.b64encode(sig.read_bytes()).decode()
|
||||
payload["signature_status"] = "signed"
|
||||
Path(a.output).write_text(json.dumps(payload, indent=2) + "\n")
|
||||
|
||||
if __name__ == "__main__": main()
|
||||
Executable
+34
@@ -0,0 +1,34 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Fail-closed static and clean-server evidence qualification for RC1."""
|
||||
import argparse, hashlib, json, os, platform, subprocess
|
||||
from pathlib import Path
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[2]
|
||||
RELEASE = Path(__file__).resolve().parent
|
||||
|
||||
def sha(path):
|
||||
h=hashlib.sha256()
|
||||
with path.open("rb") as f:
|
||||
for block in iter(lambda:f.read(1024*1024), b""): h.update(block)
|
||||
return h.hexdigest()
|
||||
|
||||
def main():
|
||||
p=argparse.ArgumentParser(); p.add_argument("--iso"); p.add_argument("--clean-server", action="store_true"); p.add_argument("--output", required=True); a=p.parse_args()
|
||||
checks=[]
|
||||
def check(name, ok, evidence=""): checks.append({"name":name,"status":"pass" if ok else "fail","evidence":evidence})
|
||||
manifest=json.loads((RELEASE/"release.json").read_text()); profiles=json.loads((RELEASE/"feature-profiles.json").read_text())
|
||||
check("release-version", manifest.get("version")=="1.0.0-rc1")
|
||||
check("model-less", manifest.get("modelPolicy")=="model-less" and not any("model" in x.lower() for x in manifest.get("includedProfiles",[])))
|
||||
check("agent-runtimes-disabled", profiles.get("rc1AgentRuntimePolicy")=="deny-all" and all(v["limits"]["activeEdgeAgents"]==0 for v in profiles["profiles"].values()))
|
||||
check("browser-commissioning", (ROOT/"autoinstall/websetup/server.py").is_file())
|
||||
check("backup-restore", (ROOT/"scripts/cezen-backup.sh").is_file())
|
||||
iso=Path(a.iso).resolve() if a.iso else None
|
||||
check("iso-present", bool(iso and iso.is_file() and iso.stat().st_size>100_000_000), str(iso or "not supplied"))
|
||||
if iso and iso.is_file(): check("iso-checksum", True, sha(iso))
|
||||
check("clean-server", a.clean_server and platform.system()=="Linux" and os.geteuid()==0, "must run as root on wiped disposable Linux target")
|
||||
check("disconnected", os.environ.get("NEXUS_OFFLINE_QUALIFICATION")=="1", "set only inside network-denied qualification lab")
|
||||
result={"schema":"nexus.qualification.v1","release":"1.0.0-rc1","checks":checks,"qualified":all(x["status"]=="pass" for x in checks)}
|
||||
Path(a.output).write_text(json.dumps(result,indent=2)+"\n")
|
||||
raise SystemExit(0 if result["qualified"] else 1)
|
||||
|
||||
if __name__=="__main__": main()
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"schema": "nexus.release.v1",
|
||||
"product": "Nexus One AI",
|
||||
"version": "1.0.0-rc1",
|
||||
"channel": "release-candidate",
|
||||
"modelPolicy": "model-less",
|
||||
"networkPolicy": "offline-install-and-operation",
|
||||
"commissioning": "browser-local-lan",
|
||||
"trialDays": 30,
|
||||
"includedProfiles": ["trial", "team", "enterprise"],
|
||||
"excludedRuntimes": ["coding-edge-agent", "meeting-edge-agent", "model-weights"],
|
||||
"reservedControlPlane": [
|
||||
"agent-registry", "device-enrollment", "device-certificates",
|
||||
"capability-declarations", "agent-audit", "license-limits"
|
||||
],
|
||||
"promotionRequires": [
|
||||
"signed-media", "disconnected-install", "clean-server-qualification",
|
||||
"restore-drill", "sbom-and-checksum-verification", "zero-open-critical-findings"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user