Promote v1.9.0 to production

.agents/skills/changeset-release-pr/SKILL.md

@@ -412,8 +412,13 @@ Release refresh deliberately refuses that state; push-triggered Release runs
 also refuse to replace its metadata with the original version-bump SHA. Do not
 force the candidate back onto develop. Reconcile a later pinned production base
 through another reviewed run, or obtain a separately audited replacement-release
-decision if newer develop work is needed. If any pin, approval, publication, or
-scope guard fails, stop and re-audit rather than bypassing it.
+decision if newer develop work is needed. An explicitly authorized same-version
+replacement uses the Release workflow with the full current candidate SHA and
+audited develop SHA; its force-with-lease comparison is CI-owned, requires the
+release bot, and invalidates all checks, reviews, and reconciliation provenance
+from the prior candidate. Never reproduce that replacement with a manual push.
+If any pin, approval, publication, or scope guard fails, stop and re-audit
+rather than bypassing it.
 
 ## Emergency direct-to-main hotfix path
 

.changeset/README.md

@@ -45,6 +45,12 @@ Chores, docs-only, and pure-internal refactors can skip a changeset; they ride a
    Candidate** workflow with pinned candidate/main commits and an independently
    approved resolution on an ordinary branch. Never push a release branch
    manually. See the [release skill](../.agents/skills/changeset-release-pr/SKILL.md#reconcile-a-frozen-candidate-with-production).
+   If a reconciled candidate must instead be replaced from `develop` without
+   changing its unpublished version, dispatch Release with the exact current
+   candidate and audited `develop` SHAs. This explicit replacement uses a
+   force-with-lease comparison against the pinned candidate, requires the
+   release bot, and invalidates all prior candidate checks and reconciliation
+   provenance.
 4. Merge the Promote PR with a **merge commit** (not squash) into `main` to tag
    `vX.Y.Z`. GHCR builds the matching images, and the GitHub Release is created
    only after those images exist so `releases/latest` never points at a missing

.docker/app/Dockerfile

@@ -115,16 +115,16 @@
 ENV S3_ENDPOINT=http://minio:9000
 ENV S3_PRESIGN_ENDPOINT=http://minio:9000
 ENV S3_REGION=us-east-1
 ENV S3_ACCESS_KEY_ID=roomote
 ENV S3_SECRET_ACCESS_KEY=roomote-local-artifacts-password
 ENV S3_BUCKET_ARTIFACTS=roomote-artifacts
 ENV JOB_AUTH_PRIVATE_KEY=local-self-host-build-job-auth-private-key
 ENV JOB_AUTH_PUBLIC_KEY=local-self-host-build-job-auth-public-key
 ENV PREVIEW_AUTH_PRIVATE_KEY=local-self-host-build-preview-auth-private-key
 ENV PREVIEW_AUTH_PUBLIC_KEY=local-self-host-build-preview-auth-public-key
 ENV DASHBOARD_PASSWORD=roomote-local-admin
 ENV ENCRYPTION_KEY=local-roomote-encryption-key-0001
 ENV ARTIFACT_SIGNING_KEY=local-roomote-artifact-signing-key-1
 ENV PREVIEW_PROXY_BASE_URL=http://localhost:18081
 ENV PREVIEW_DOMAINS=localhost,127.0.0.1,roomotepreview.localhost
 
@@ -433,6 +433,7 @@
 COPY --from=github-cli /usr/bin/gh /usr/local/bin/gh
 RUN command -v git >/dev/null && command -v gh >/dev/null && \
   command -v opencode >/dev/null && \
+  test -f /roomote/apps/bullmq/dist/xhr-sync-worker.js && \
   cd /roomote/apps/bullmq && node -e "require.resolve('zod/package.json')" && \
   ls -d /roomote/node_modules/.pnpm/zod@*/node_modules/zod >/dev/null
 

.docker/minio/Dockerfile

@@ -0,0 +1,123 @@
+# syntax=docker/dockerfile:1
+#
+# MinIO (object storage) and mc (its client), built from the last community
+# source releases and published as ghcr.io/roocodeinc/roomote-minio.
+#
+# MinIO Community Edition went source-only on 2025-10-23 and the upstream
+# repositories are archived; the prebuilt images were removed from Docker Hub
+# in September 2026 and only linger on quay.io. Building from the pinned,
+# checksum-verified source is the only distribution nobody else can delete
+# out from under a deployment. Hosted (Railway) and self-hosted (compose,
+# Coolify, Render) deployments run this same image.
+#
+# The build is byte-for-byte the one apps/api/scripts/setup-sandbox-minio.ts
+# performs for sandboxes: same Go toolchain, same module version and Go
+# checksum-database sums, same flags, and the resulting binaries are asserted
+# against the same SHA-256 values. deploy/ci/validate-deployment-artifacts.mjs
+# keeps the two pin sets identical.
+#
+# Upgrading: bump the *_RELEASE / *_MODULE_VERSION / *_SUM args together with
+# the sandbox script (there will be no newer upstream releases; a bump only
+# happens if we ever fork), then let the publish-minio workflow produce the
+# digest to pin in deploy/deployment-catalog.json.
+
+ARG GO_IMAGE=golang:1.24.8-bookworm@sha256:4ed690d6649d63c312b99a6120025ec79ce3b542968a37da53d6236c7c61a848
+ARG RUNTIME_IMAGE=debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171
+
+# Upstream release names, declared before the first stage so both stages (and
+# the publish workflow, which reads MINIO_RELEASE from this file) share them.
+ARG MINIO_RELEASE=RELEASE.2025-10-15T17-29-55Z
+ARG MC_RELEASE=RELEASE.2025-08-13T08-35-41Z
+
+FROM ${GO_IMAGE} AS build
+
+ARG TARGETARCH
+
+# MinIO server: github.com/minio/minio at its final community release.
+ARG MINIO_RELEASE
+ARG MINIO_MODULE_VERSION=v0.0.0-20251015172955-9e49d5e7a648
+ARG MINIO_MODULE_SUM=h1:6TdolSCLSs2nwm8i0PpWDqf9iX2Ty9WQK8wmr7dCnUM=
+ARG MINIO_GOMOD_SUM=h1:yCWDkwWO9IWpGsT4mreDDN/B/QVmK2zC666uInRAcqE=
+ARG MINIO_SHA256_AMD64=6456634c06fa937dfeb708e37db80c8a02ffc50874d211ee3fc5cc0f71f95b96
+ARG MINIO_SHA256_ARM64=3f9e2d92ca9fe43ebac8f069349a3fefb91500ed06b22697e9d9f3dba6e1db17
+
+# MinIO client: github.com/minio/mc at its final community release. Bundled
+# because deployments create the artifact bucket with it (compose minio-init)
+# and Coolify's documented container healthcheck is `mc ready local`.
+ARG MC_RELEASE
+ARG MC_MODULE_VERSION=v0.0.0-20250813083541-7394ce0dd2a8
+ARG MC_MODULE_SUM=h1:9tuRE4iEaDkuxatxe7pddYYh1SX5mT0/D0haofZFeTY=
+ARG MC_GOMOD_SUM=h1:agCKg3UT5wU3auhPL2lZbOWlqqT2RokeAT7Xc+HK3cU=
+ARG MC_SHA256_AMD64=38b9aa4ae9eb7eda22c4010199dc3f85099266f063efca793aed29b5a95612ae
+ARG MC_SHA256_ARM64=d0c72d33cf6a30a1f0b69a327c6f5dea065fa5b3d0c5dc7cf87f8de102384a98
+
+# Mirrors the sandbox script's Go environment: the public proxy and checksum
+# database authenticate the module, and the pinned toolchain plus -trimpath
+# make the build reproducible so the SHA-256 assertions hold on any builder.
+ENV CGO_ENABLED=0 \
+    GOOS=linux \
+    GOENV=off \
+    GOFLAGS=-mod=readonly \
+    GONOSUMDB= \
+    GOPRIVATE= \
+    GOPROXY=https://proxy.golang.org \
+    GOSUMDB=sum.golang.org \
+    GOTOOLCHAIN=local
+
+# Set to 0 only when computing new pins (see build.sh); published builds
+# always verify.
+ARG VERIFY_SHA256=1
+
+COPY build.sh /usr/local/bin/build-minio-module
+
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    build-minio-module minio github.com/minio/minio \
+      "$MINIO_RELEASE" "$MINIO_MODULE_VERSION" "$MINIO_MODULE_SUM" "$MINIO_GOMOD_SUM" \
+      "$MINIO_SHA256_AMD64" "$MINIO_SHA256_ARM64"
+
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    build-minio-module mc github.com/minio/mc \
+      "$MC_RELEASE" "$MC_MODULE_VERSION" "$MC_MODULE_SUM" "$MC_GOMOD_SUM" \
+      "$MC_SHA256_AMD64" "$MC_SHA256_ARM64"
+
+
+FROM ${RUNTIME_IMAGE}
+
+ARG MINIO_RELEASE
+ARG MC_RELEASE
+
+# ca-certificates so MinIO can reach TLS endpoints (KMS, replication targets);
+# curl for operators and healthchecks. A shell stays available on purpose:
+# compose runs `sh -c` bucket bootstrap against this image.
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends ca-certificates curl \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /out/minio /out/mc /usr/local/bin/
+COPY --from=build /licenses /licenses
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+
+# MC_CONFIG_DIR: mc must be usable by whatever user runs the container; its
+# default config lives under $HOME, which need not be writable.
+# MINIO_UPDATE=off: there will never be another upstream release to check for.
+ENV MC_CONFIG_DIR=/tmp/.mc \
+    MINIO_UPDATE=off
+
+# Runs as root like the upstream image so existing /data volumes provisioned
+# under it keep their ownership. Drop privileges with MINIO_UID/MINIO_GID if a
+# deployment needs to.
+
+LABEL org.opencontainers.image.title="Roomote MinIO" \
+      org.opencontainers.image.description="MinIO server and mc client built from the final community source releases" \
+      org.opencontainers.image.source="https://github.com/RooCodeInc/Roomote" \
+      org.opencontainers.image.licenses="AGPL-3.0-only" \
+      org.opencontainers.image.version="${MINIO_RELEASE}" \
+      io.roomote.minio.release="${MINIO_RELEASE}" \
+      io.roomote.mc.release="${MC_RELEASE}"
+
+EXPOSE 9000 9001
+
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["minio"]

.docker/minio/README.md

@@ -0,0 +1,93 @@
+# roomote-minio
+
+MinIO server and `mc` client, compiled from the final MinIO Community Edition
+source releases and published as `ghcr.io/roocodeinc/roomote-minio`.
+
+## Why this exists
+
+MinIO stopped publishing binaries and container images for the community
+edition in October 2025 and archived the source repositories. The Docker Hub
+images were deleted in September 2026 and the quay.io copies have no stated
+future. Roomote deployments of every shape (Railway, compose, Coolify, Render)
+need an artifact store whose image nobody else can remove, so we build it
+from the pinned source ourselves.
+
+## What is pinned
+
+Everything that could change the output is pinned in the `Dockerfile` and
+verified during the build:
+
+| Pin                                   | Verified by                                    |
+| ------------------------------------- | ---------------------------------------------- |
+| Go toolchain image (by digest)        | Docker                                         |
+| Module version and `h1:` sums         | Go checksum database, compared to the args     |
+| Compiled binary SHA-256 per arch      | `sha256sum` after `go build`, compared to args |
+| Runtime base image (by digest)        | Docker                                         |
+
+The MinIO pins are the same values `apps/api/scripts/setup-sandbox-minio.ts`
+uses to build MinIO for sandboxes, and `deploy/ci/validate-deployment-artifacts.mjs`
+fails if the two drift. A sandbox and a deployment therefore run the identical
+binary.
+
+Both builds pass `-trimpath -ldflags="-buildid= -s -w"`: no VCS or path
+noise, no toolchain-derived build ID, no DWARF or symbol table (upstream's
+release builds stripped them too; the binaries are about a quarter smaller).
+
+The checksums are for **native** builds, meaning the Go toolchain runs on the
+same architecture it targets. That is how the CI runners build (one amd64,
+one arm64 runner) and how the linux/amd64 sandbox builds. `mc` reproduces
+from any host with these flags, but `minio`'s code differs by a few hundred
+bytes when the compiler runs on the other host architecture (same symbol
+table and sizes, different instruction bytes, so it is codegen rather than
+metadata). A cross-compile from an Apple Silicon laptop therefore matches the
+arm64 pins but not the amd64 pins; use `docker build --platform linux/amd64`,
+which runs the real linux/amd64 toolchain under emulation, to verify those.
+
+## Bumping a pin
+
+There will be no newer upstream releases, so this only applies if the module
+or toolchain pin ever changes (a fork, a Go security release).
+
+1. Update the `*_RELEASE`, `*_MODULE_VERSION`, `*_MODULE_SUM`, `*_GOMOD_SUM`
+   or `GO_IMAGE` args. `go mod download -json <module>@<release>` prints the
+   version and sums.
+2. Build once in report mode to learn the new binary checksums, for each arch:
+   `docker build --build-arg VERIFY_SHA256=0 --platform linux/arm64 .docker/minio`
+   and the same with `linux/amd64`. The build log prints `sha256=` per binary.
+   Both must be Docker builds for the stated platform (native or emulated), not
+   host cross-compiles, for the reason above.
+3. Put the printed values in the `*_SHA256_*` args and in
+   `apps/api/scripts/setup-sandbox-minio.ts`, then build again without the
+   flag; the validator checks the two files agree.
+
+## Publishing
+
+`.github/workflows/publish-minio.yml` builds both architectures natively,
+merges them into one manifest, and prints the `image@sha256:` pin in the job
+summary. It runs on pushes to `develop` and `main` that touch this directory
+and on manual dispatch. Deployments do not track a tag: copy the printed pin
+into `deploy/deployment-catalog.json` and the compose and template files the
+validator checks against it.
+
+## Compatibility with the upstream image
+
+- Same invocation: `server /data --console-address :9001` works unchanged;
+  the entrypoint prepends `minio` for `server` and flag arguments only.
+- `mc` is on the path with `MC_CONFIG_DIR=/tmp/.mc`, so `mc ready local`
+  healthchecks and the compose `minio-init` bucket bootstrap work against
+  this one image. There is no separate client image.
+- Runs as root like upstream so existing `/data` volumes keep working.
+- `MINIO_UPDATE=off`: there are no further upstream releases to check for.
+- Adds `curl` and a shell, which the upstream image lacked.
+
+## Local build and smoke test
+
+```bash
+docker build -t roomote-minio:local .docker/minio
+docker run --rm -d --name minio-smoke -p 19100:9000 \
+  -e MINIO_ROOT_USER=roomote -e MINIO_ROOT_PASSWORD=roomote-local-artifacts-password \
+  roomote-minio:local server /data
+curl -fsS http://127.0.0.1:19100/minio/health/live
+docker exec minio-smoke mc ready local
+docker stop minio-smoke
+```

.docker/minio/build.sh

@@ -0,0 +1,71 @@
+#!/bin/sh
+# Build one MinIO Go module from the public proxy with every pin verified.
+#
+# Usage: build-minio-module <name> <module> <release> <module-version>
+#          <module-sum> <go.mod-sum> <sha256-amd64> <sha256-arm64>
+#
+# `go mod download` fetches the tagged release through the checksum database;
+# the returned version and h1: sums must equal the pinned ones before anything
+# is compiled, and the compiled binary must match the pinned SHA-256 for the
+# target architecture. Any mismatch fails the build.
+#
+# `-ldflags="-buildid= -s -w"` drops the toolchain-derived build ID and the
+# debug info, as upstream's release builds did. That makes mc reproducible from
+# any host, but MinIO's compiled code still differs when the Go compiler runs
+# on a different host architecture than it targets, so the pinned checksums
+# are for NATIVE builds: the per-arch CI runners, or a Docker build for the
+# stated --platform (emulated is fine, a host cross-compile is not).
+#
+# VERIFY_SHA256=0 (build arg) reports the checksums instead of enforcing them;
+# use it once when bumping pins, never in a published build.
+set -eu
+
+name="$1"
+module="$2"
+release="$3"
+expected_version="$4"
+expected_sum="$5"
+expected_gomod_sum="$6"
+sha256_amd64="$7"
+sha256_arm64="$8"
+
+case "${TARGETARCH:?TARGETARCH is required}" in
+  amd64) expected_sha256="$sha256_amd64" ;;
+  arm64) expected_sha256="$sha256_arm64" ;;
+  *)
+    echo "Unsupported TARGETARCH: $TARGETARCH" >&2
+    exit 1
+    ;;
+esac
+export GOARCH="$TARGETARCH"
+
+json="$(go mod download -json "${module}@${release}")"
+field() {
+  printf '%s\n' "$json" | sed -n "s/^[[:space:]]*\"$1\": \"\\(.*\\)\",\\{0,1\\}\$/\\1/p" | head -n 1
+}
+actual_version="$(field Version)"
+actual_sum="$(field Sum)"
+actual_gomod_sum="$(field GoModSum)"
+source_dir="$(field Dir)"
+
+check() {
+  if [ "$2" != "$3" ]; then
+    echo "$name: $1 mismatch: expected $3, got $2" >&2
+    exit 1
+  fi
+}
+check "module version" "$actual_version" "$expected_version"
+check "module checksum" "$actual_sum" "$expected_sum"
+check "go.mod checksum" "$actual_gomod_sum" "$expected_gomod_sum"
+[ -d "$source_dir" ] || { echo "$name: module directory missing: $source_dir" >&2; exit 1; }
+
+mkdir -p /out /licenses
+cd "$source_dir"
+go build -trimpath -ldflags="-buildid= -s -w" -o "/out/$name" .
+cp LICENSE "/licenses/$name.LICENSE"
+
+actual_sha256="$(sha256sum "/out/$name" | cut -d' ' -f1)"
+if [ "${VERIFY_SHA256:-1}" = 1 ]; then
+  check "binary sha256 ($TARGETARCH)" "$actual_sha256" "$expected_sha256"
+fi
+echo "$name $release ($TARGETARCH) sha256=$actual_sha256"

.docker/minio/docker-entrypoint.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# Mirrors the upstream image's contract: a bare server invocation such as
+# `server /data --console-address :9001` (how every Roomote deployment shape
+# runs it) gets the `minio` binary prepended; anything else (`mc ...`, `sh`)
+# runs as given so the same image doubles as the client.
+set -eu
+
+case "${1:-}" in
+  '') set -- minio ;;
+  server | -*) set -- minio "$@" ;;
+esac
+
+exec "$@"