Skip to content

feat(worker): add Hands Installer consumer service - #459

Open
bytemain wants to merge 3 commits into
mainfrom
volta/installer-service-contract
Open

feat(worker): add Hands Installer consumer service#459
bytemain wants to merge 3 commits into
mainfrom
volta/installer-service-contract

Conversation

@bytemain

@bytemain bytemain commented Aug 17, 2026

Copy link
Copy Markdown
Member

Implements the Hands Installer v1 Worker source contract:

  • human-only PKCE consumer auth with opaque access and rotating refresh tokens
  • explicit non-enumerating catalog admission
  • revision-guarded subscriptions
  • active/non-QA rollout-aware APK/HAP manifests
  • shared public_v2 candidate, rollout, and asset resolver
  • exact inspected artifact/hash/package/version binding
  • bounded ordered signer lineages, derived from full APK verification and bound to immutable asset bytes
  • automatic verified APK parser → installer metadata ingestion before catalog opt-in

Validation on current head:

  • Worker and container TypeScript builds: green
  • Worker tests: 45 files / 460 tests green
  • Android build-tools 34.0.0 apksig helper compiled and parsed the real public raft-android 1.9.1 APK as old→current lineage b4919381…1a455f08bbe8…b0b1, with exact package/version/hash readback

Migration 0067 must not land or deploy before the in-flight 0066 Agent Login migration. Production deployment remains frozen, and no migration, deploy, production data write, package, or release is authorized by this PR.

Signed-off-by: Volta <volta@mail.build>
@bytemain
bytemain marked this pull request as ready for review August 17, 2026 15:49
Volta added 2 commits August 17, 2026 17:59
Signed-off-by: Volta <volta@mail.build>
Signed-off-by: Volta <volta@mail.build>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant