v0.2.8

v0.2.8 — deploy-posture plans again

v0.2.7 could not run deploy-posture: it asked the release payload for versions.yml, which is configuration and lives in --repo, and refused itself with versions.yml is not part of this release's payload. The other two deploys were correct. Nothing reached a host from v0.2.7's posture deploy, so nothing on a host is wrong — but the version could not do its job, and under ADR-200 the only fix is the next release.

Fixed

• bug-178 — deploy_posture::plan reads versions.yml from --repo, as site.yml already was. A test now plans against a repo whose versions.yml was edited and asserts the edited bytes are what would reach the host — the plan takes exactly two files from --repo and everything else from the payload.

Added

• Both workflows run deploy-posture and deploy-observability previews against tests/fixtures after the build. The preview that would have caught v0.2.7 was never run by hand; it is now run by the machine, every time. (deploy-updates is not yet in that step: its preview still fetches a kubeconfig over ssh — bug-179, open.)
• tests/fixtures/site.yml carries the posture status ids the deploy needs.

Operator notes

• install.sh v0.2.8 on each host, then from the host that reaches the others: substrate deploy-updates --apply (first PEER_HOSTS= apply) and substrate deploy-posture --apply.

162 tests.