[hanthor]

Closes #468
Closes #476

Where main already stood

#474 already did most of the packaging repair. scripts/tuna-release builds, stages and version-checks tuna-shell-gtk, declares libgtk4-layer-shell0 (>= 1.1), libgtk-4-1 (>= 4.12) and libadwaita-1-0 (>= 1.0) plus the dpkg-shlibdeps closure, and builds with dpkg-deb --root-owner-group. scripts/check-release-package validates numeric uid/gid in both original archives (with negative tests in release-deb-ownership-tests.py). The journey job apt-installs the .deb and runs tuna-gtk-shell-proof --installed-package. The GTK shell's CSS and icons are compiled into the binary, so there are no extra data files to ship. Because it is installed beside the compositor, SHELL_BINARIES selects it ahead of the legacy shell, which matches the Arch package.

What this PR adds

• scripts/check-deb-clean-install, a new CI step right after the package build:
  • It reads the dpkg-deb -c listing and requires every entry to be root/root, the archive root to be drwxr-xr-x, and ./usr/bin/tuna-shell-gtk to be -rwxr-xr-x.
  • It apt-installs the .deb on a pristine ubuntu:26.04 container. Each of the six installed binaries must be 0:0 755, have no not found libraries in ldd, and report <bin> <package version>. tuna-shell-gtk must sit beside tuna-compositor, the roost-* compat symlinks from Rename roost to tuna (reproducible script + compat layer) #536 must resolve to the tuna-* binaries, the session Exec must resolve, and the PAM and systemd files must be root-owned.
  • This fills a real gap: the existing install ran on a runner that already has every -dev package, so a missing Depends could never fail CI. The Arch job's equivalent is its pacman -U plus --version step in archlinux:latest.
• The control Depends no longer lists libgtk-4-1 and libadwaita-1-0 twice.
• packaging/README.md no longer says the .deb ships only the legacy shell. docs/install.md and docs/release.md now describe the Ubuntu 26.04 target and the clean-install check.
• A new contract test, release_contract::debian_archive_is_root_owned_and_ships_the_gtk_shell, pins --root-owner-group, the clean-install checks and the CI step.

This is rebased onto the rename (#536) and keeps its tuna-desktop package and compat layer. scripts/rename-to-tuna --check --no-cargo passes.

Verification

• Locally:
  • shellcheck -x scripts/check-deb-clean-install is clean.
  • I ran the listing checks against synthetic debs. The root-owned deb passes, the deb built without --root-owner-group is rejected ("entries not owned by root/root"), and the deb without the GTK shell is rejected.
  • The release_contract tests pass (7 of 7, run before the rename).
• Left to CI: the real release build, the clean ubuntu:26.04 install, and the installed GTK session proof.

Known issue

journey failing at G-IME-CANDIDATES on ubuntu-26.04 is pre-existing (#526).

🤖 Generated with Claude Code

https://claude.ai/code/session_016YpFGeYYmfpLzk2LMr8ebX

[hanthor-hive-agent]

325e307

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 325e30770071) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

🛑 Fix loop escalated — human attention needed

This PR has stayed red on the same commit through 6 delivered fix re-dispatches with no new commit pushed (2 distinct red heads seen). The hive has stopped dispatching further automated fixes for it.

Failing checks: arch-package

Also red on the base branch / other open PRs (shared breakage, not this PR): gtk-shell, journey

Raw failure evidence (from check-run annotations):

arch-package: Process completed with exit code 1.

Remove the needs-human label after addressing the root cause to return the PR to the automated fix lane.

[hanthor-hive-agent]

325e307

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 325e30770071) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

4768fc4

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @hanthor, head 4768fc4fd4f8) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/ci.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hanthor-hive-agent]

✅ Escalation cleared — back in the automated lane

The shared CI breakage this escalation was raised over (gtk-shell, journey) has cleared — returning this PR to the automated lane.

The needs-human label has been removed; the fix loop owns this PR again.