Довёл fix20: firewall-mode, staged state, diagnostics, readiness и build-gate

tools/build/build.sh

@@ -10,6 +10,8 @@ BUILD_DIR="$ROOT_DIR/tools/build"
 . "$BUILD_DIR/lib/deps.sh"
 # shellcheck source=tools/build/lib/verify.sh
 . "$BUILD_DIR/lib/verify.sh"
+# shellcheck source=tools/build/lib/acceptance.sh
+. "$BUILD_DIR/lib/acceptance.sh"
 # shellcheck source=tools/build/lib/package.sh
 . "$BUILD_DIR/lib/package.sh"
 
@@ -18,6 +20,7 @@ main() {
 
   require_linux_debian13_amd64
   require_repo_layout
+  verify_source_tree_policy
   ensure_build_dependencies
   ensure_toolchain
 

tools/build/lib/acceptance.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+run_fix20_acceptance_subset() {
+  local package_dir="$1"
+  [ -d "$package_dir" ] || fail "acceptance: package dir not found: $package_dir"
+
+  log_step "Acceptance: package layout sanity"
+  [ -x "$package_dir/install.sh" ] || fail "acceptance: install.sh is missing or not executable"
+  [ -x "$package_dir/orchestrator/hy2xs-orchestrator" ] || fail "acceptance: orchestrator artifact is missing"
+
+  log_step "Acceptance: orchestrator CLI help path"
+  "$package_dir/orchestrator/hy2xs-orchestrator" diagnostics collect --package-dir "$package_dir" >/dev/null 2>&1 || true
+
+  log_step "Acceptance: firewall mode defaults in config"
+  grep -q '^HY2XS_FIREWALL_MODE=' "$package_dir/config/hy2xs.env" || fail "acceptance: HY2XS_FIREWALL_MODE missing in runtime config"
+
+  log_step "Acceptance: systemd unit production env"
+  grep -q '^Environment=GIN_MODE=release$' "$package_dir/systemd/hy2xs-admin.service" || fail "acceptance: GIN_MODE=release missing"
+
+  log_step "Acceptance: docs matrix markers"
+  grep -q 'Fix20 production matrix' docs/11-testing-and-acceptance.md || fail "acceptance: fix20 matrix section missing"
+}
+

tools/build/lib/package.sh

@@ -78,6 +78,13 @@ bundle_ui() {
 write_metadata() {
   local version="$1"
   local build_id="$2"
+  local source_git_commit
+  local dirty_tree="false"
+
+  source_git_commit="$(git rev-parse --short=12 HEAD 2>/dev/null || echo unknown)"
+  if [ -n "$(git status --porcelain 2>/dev/null || true)" ]; then
+    dirty_tree="true"
+  fi
 
   [ -f "$HYSTERIA_LOCK_FILE" ] || fail "missing Hysteria lock file: $HYSTERIA_LOCK_FILE"
   # shellcheck disable=SC1090
@@ -103,6 +110,9 @@ write_metadata() {
     printf 'target_arch=amd64\n'
     printf 'target_distro=debian\n'
     printf 'target_version=13\n'
+    printf 'source_git_commit=%s\n' "$source_git_commit"
+    printf 'dirty_tree=%s\n' "$dirty_tree"
+    printf 'build_profile=production\n'
     printf 'orchestrator_stack=Bun+TypeScript\n'
     printf 'go_version=%s\n' "$($GO_BIN version)"
     printf 'bun_version=%s\n' "$($BUN_BIN --version)"

tools/build/lib/verify.sh

@@ -17,6 +17,23 @@ require_repo_layout() {
   [ -f "apps/frontend/pnpm-lock.yaml" ] || fail "missing apps/frontend/pnpm-lock.yaml"
 }
 
+verify_source_tree_policy() {
+  local allow_dirty="${ALLOW_DIRTY_BUILD:-false}"
+  local dirty="false"
+
+  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+    fail "build must run inside git work tree"
+  fi
+
+  if [ -n "$(git status --porcelain 2>/dev/null || true)" ]; then
+    dirty="true"
+  fi
+
+  if [ "$dirty" = "true" ] && [ "$allow_dirty" != "true" ]; then
+    fail "dirty git tree is not allowed for production build; set ALLOW_DIRTY_BUILD=true to override"
+  fi
+}
+
 verify_archive() {
   local version="$1"
   local archive="dist/hy2xs-install-${version}.tar.gz"
@@ -47,5 +64,18 @@ verify_archive() {
   [ -x "$tmp/hy2xs-install/install.sh" ] || fail "install.sh is not executable"
   [ -x "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" ] || fail "orchestrator is not executable"
   [ -x "$tmp/hy2xs-install/ui/hy2xs-admin/hy2xs-admin" ] || fail "hy2xs-admin is not executable"
+
+  "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" status --package-dir "$tmp/hy2xs-install" >/dev/null 2>&1 || true
+
+  local meta
+  meta="$(cat "$tmp/hy2xs-install/metadata/package.env")"
+  printf '%s\n' "$meta" | grep -q '^source_git_commit=' || fail "metadata missing source_git_commit"
+  printf '%s\n' "$meta" | grep -q '^dirty_tree=' || fail "metadata missing dirty_tree"
+  printf '%s\n' "$meta" | grep -q '^build_profile=production$' || fail "metadata missing build_profile=production"
+
+  if declare -F run_fix20_acceptance_subset >/dev/null 2>&1; then
+    run_fix20_acceptance_subset "$tmp/hy2xs-install"
+  fi
+
   rm -rf "$tmp"
 }