Poll the release manifest: fetch, verify, cache, on a timer

[onel]

Closes #397.

#396 built the pure half — verify, parse, decide, cache — and nothing called it. This gives it a clock and a network. After this an appliance box discovers on its own that a newer release exists, which is the first thing in the update design that does not need a human to type something.

A failed poll changes nothing on disk. That is the promise RELEASE_MANIFEST.md # Failure modes makes for an offline box, and it is the thing in this slice most worth getting right: unreachable host, HTTP 500, truncated body, tampered manifest, a signature from a key this box does not accept, wrong schema — seven table cases, each caching a good manifest first and then breaking the CDN one way.

Verify before cache, not after, or anyone who can answer an HTTP request could replace what an offline box acts on.

Keys are stamped at build time (-X ...relmanifest.BakedKeys=...), empty by default, and there is no environment override on purpose: changing which releases a box accepts should take a new binary that arrives through apt and is itself signed, not an edit to a unit file. A build with no key does not poll at all — inert rather than credulous, and it reads in the journal as "this build trusts nobody" instead of "no releases published".

Appliance only. A hosted box's target is held per box by the cloud (UPDATES.md # 8.1), so it gets a no-op twin and main.go carries no build tags. The poll starts last, after the socket is serving and the brain is launched, so a hanging CDN sits in front of nothing.

Two things not in the spec, both now recorded there as "as built": jitter of up to five minutes per tick (boxes cluster after a provider window or a regional power cut), and a 64 KiB body cap.

A mutation check caught a bad test, which is why they are worth doing. The oversized-body case first served junk — which fails signature verification anyway, so it proved nothing about the cap. It now serves a real, correctly signed, schema-valid manifest padded past the limit, and asserts the error names the size: without the explicit check the poll still fails, but as "signature does not verify", which sends whoever reads that log hunting a key problem that does not exist.

The -ldflags symbol path was checked by building a throwaway program against the package (stamped: 1 key, unstamped: 0). A wrong path there fails silently.

docs/architecture.md is also brought up to date for the last four merged slices — it still said the updater had no real-box proof and no release manifest.

Progress entry: docs/progress/release-manifest-poll.md. make test-nopam green, gofmt clean, OpenAPI unchanged (no API surface touched).

Still true after this lands: no signing key, no releases.malmo.network, version → image digest undecided, and the ghcr packages still private — so no appliance box can complete an update yet.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
internal/hostagent/relmanifest/poll.go	Adds the timed fetch, verification, state tracking, bounded-body handling, and cache-update workflow; no eligible follow-up finding remains.
internal/hostagent/relmanifest/keys.go	Parses build-stamped minisign public keys while safely skipping malformed entries.
cmd/host-agent-real/releasepoll_appliance.go	Wires cache loading and background polling into appliance startup with cancellation and HTTP timeouts.
cmd/host-agent-real/releasepoll_hosted.go	Keeps release-manifest polling disabled for hosted builds.
cmd/host-agent-real/main.go	Starts polling after brain launch and registers cleanup on normal and explicit exit paths.
internal/hostagent/relmanifest/poll_test.go	Exercises polling success, failure preservation, size limits, startup cache loading, timing, keyless behavior, and cancellation.
Makefile	Adds the release-manifest trust-key value to linker flags with an intentionally empty default.

_{Reviews (2): Last reviewed commit: "Review notes: Poll refuses without a ver..." | Re-trigger Greptile}