Repository navigation
docs(repo): name active fork Unzen - #57
Merged
Merged
Conversation
davidtaikocha
changed the title
Unzen
The fork name is a deploy-tree segment and compose project name, not just an env value, so switching from shasta to unzen bootstraps a new sealed enclave key and leaves the old stack running on the same host port. Document that migration cost in the SGX runbook, qualify the section 8 rollback guarantee as fork-scoped, and flip the deploy test harness to unzen so it mirrors the documented flow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two corrections to the migration note: Running two forks side by side is supported. The host port is the only contended resource, so --port avoids migration downtime; compose projects namespace containers and networks, and config and secrets are per-release bind mounts. Fork names should be canonical lowercase slugs. release_dir() uses the fork name verbatim while compose_project_name() slugifies it, so Unzen and unzen write to different deploy trees but share one compose project. The registered.gaiko2.json lookup is byte-for-byte and fails only at server start. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ion claim The slug collision is not fork-specific. release_dir() uses RELEASE verbatim while compose_project_name() slugifies it, so the v1.0.0 form this runbook recommends collides with v1-0-0 and v1_0_0 on one compose project. Cover both identifiers and pin the naming contract with a regression test, so a slugify change cannot silently re-home running deployments. Also narrow the side-by-side isolation claim. The host port is the only Compose binding conflict, but both stacks map the same SGX device nodes, compete for the same EPC, and use the same PCCS, so running two is a cutover window rather than a steady state. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
PCCS_HOST is seeded from .env.example into each release .env and can be overridden per release with --pccs-host, the same mechanism as --port. Only the SGX device mappings are hardcoded in compose.yaml. Separate the two claims instead of listing PCCS among the fixed host resources. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
smtmfft
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
GAIKO2_FORKand SGX deployment examples fromshastatounzen/prove/shastaroutes,raiko2-shasta-*schemas, fixture names, and historical plan titlesTesting
go test ./...bash scripts/test-deploy-tee.sh(GNU-sed-compatible environment used by Ubuntu CI)bash -n scripts/deploy-tee.shgit diff --check