fix(ci): make the daemon release complete, and correct two false claims

Review found that the previous commit asserted two things that are not true,
and that this workflow could still publish a wrong or half-finished release.

**The kept image references are not public.** That commit justified keeping
`blox-sandbox` and `blox-browser` on the grounds that they "name public images
in this repository's own organization". They do not: an anonymous ghcr token
request is refused for both, while `openblox-sandbox` — the image this repo
actually builds and publishes — is granted. So the de-identification pass kept
two private references on a rationale that a one-command check refutes. The
sandbox examples now use the real public image; the browser example uses a
neutral placeholder, because no reference browser image is published.

**The release could still be partial.** Three ways, all now closed:

- `fail-fast` was left at its default, so a failing amd64 leg cancels arm64 and
  the release ends up holding one architecture. That is the same
  partially-published failure this workflow exists to end, only harder to notice
  than shipping nothing at all.
- `gh release upload` needs the release object, which it does not create. A
  hand-pushed tag has none, and on the normal path go-semantic-release creates
  the tag ref and the release in separate calls — this job's trigger fires on
  the first. The build usually outlasts that gap; "usually" is the wrong
  property here. It now waits for the object and fails loudly if it never
  appears, rather than creating one and racing the sibling leg.
- The verify step ran `--version` and threw the output away, so it proved the
  flag exists and nothing about the stamp. If `-X main.version` ever stops
  landing, the binary prints `dev` and the step still passes — publishing an
  asset that claims to be someone's local build, which is exactly what the
  `dev` default is for. It now asserts the value equals the tag.

Also: attach the systemd unit and example config, since the workflow header
claimed to ship a unit and did not; key the concurrency group on the tag rather
than the triggering ref, which had it backwards (dispatches for different tags
serialized, while a dispatch and a tag push for the same tag did not); document
the install in docs/security.md, which described deploying a daemon whose binary
had no stated source; and drop the comment in release.yml claiming there are no
binaries to ship, which the previous commit diagnosed as the cause of the
assetless release and then left in place.

`TestVersionDefaultsToDev` pins the invariant the `version` doc comment argues
for, so stamping in-tree fails a test instead of shipping.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Lutherwaves

.github/workflows/publish-daemon.yml

@@ -5,9 +5,9 @@ name: Publish daemon
 # openbloxd is installed on a host, not pulled as an image: it holds the Docker
 # socket so the containerized callers do not have to, and running it in a
 # container with that socket mounted would put the privilege straight back where
-# this daemon exists to take it from. So the artifact is a binary and a systemd
-# unit, which is what deploy/openbloxd.service expects at
-# /usr/local/bin/openbloxd.
+# this daemon exists to take it from. So the artifact is a binary, which is what
+# deploy/openbloxd.service expects at /usr/local/bin/openbloxd, plus the unit and
+# example config so an operator gets all three versioned together.
 #
 # Tag-triggered, matching publish-image.yml: release.yml cuts the tag from
 # conventional commits once CI is green on main, and both publish jobs hang off
@@ -31,7 +31,11 @@ permissions:
   contents: read
 
 concurrency:
-  group: publish-daemon-${{ github.ref }}
+  # Key on the tag being published, not the triggering ref. Every
+  # workflow_dispatch shares refs/heads/main, so github.ref would serialize
+  # unrelated tags while letting a dispatch and a tag push for the SAME tag run
+  # concurrently — exactly backwards.
+  group: publish-daemon-${{ inputs.tag || github.ref_name }}
   cancel-in-progress: false
 
 defaults:
@@ -48,6 +52,11 @@ jobs:
       # contents. Scoped to this job rather than the workflow.
       contents: write
     strategy:
+      # Never cancel the sibling arch. A cancelled leg leaves the release holding
+      # one architecture and silently missing the other — the same
+      # partially-published failure this workflow exists to end, just harder to
+      # spot than shipping nothing.
+      fail-fast: false
       matrix:
         goarch: [amd64, arm64]
     steps:
@@ -95,29 +104,83 @@ jobs:
             -o "openbloxd-linux-${GOARCH}" ./cmd/openbloxd
           sha256sum "openbloxd-linux-${GOARCH}" > "openbloxd-linux-${GOARCH}.sha256"
 
-      - name: Verify the binary runs
+      - name: Verify the binary runs and reports its version
         # A release asset that cannot execute is worse than a missing one: the
-        # install step succeeds and the daemon fails at boot on the host. Only
-        # meaningful for the native arch; the cross-built one is checked by file
-        # type instead.
+        # install step succeeds and the daemon fails at boot on the host.
+        #
+        # Assert the STAMP, not merely that the flag runs. If -X main.version
+        # ever stops landing — the var is renamed, moved out of main, or the
+        # ldflags get dropped in a refactor — the binary prints "dev", and
+        # `--version` alone would still exit 0. A release asset claiming to be
+        # someone's local build is precisely what the "dev" default exists to
+        # make visible, so let it fail here instead.
+        #
+        # The arm64 leg cannot execute on this runner, so it checks the
+        # architecture only. That is weaker, and deliberately not dressed up as
+        # more: the stamping logic is arch-independent, so amd64 covers it.
         env:
           GOARCH: ${{ matrix.goarch }}
+          TAG: ${{ steps.tag.outputs.tag }}
         run: |
           set -euo pipefail
           if [ "$GOARCH" = "amd64" ]; then
-            ./"openbloxd-linux-${GOARCH}" --version
+            got="$(./"openbloxd-linux-${GOARCH}" --version)"
+            if [ "$got" != "$TAG" ]; then
+              echo "version stamp is '$got', expected '$TAG'" >&2
+              exit 1
+            fi
           else
             file "openbloxd-linux-${GOARCH}" | grep -q 'ARM aarch64'
           fi
 
       - name: Attach to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
           TAG: ${{ steps.tag.outputs.tag }}
           GOARCH: ${{ matrix.goarch }}
         run: |
           set -euo pipefail
+
+          # `gh release upload` needs the release OBJECT, not just the tag ref,
+          # and does not create one. Two ways that bites: a hand-pushed tag has
+          # no release at all, and on the normal path go-semantic-release creates
+          # the tag ref and the release as separate API calls — this job's trigger
+          # fires on the first. The build usually outlasts that gap, but "usually"
+          # is the wrong property for the release path.
+          #
+          # Wait rather than create: creating it here would race the sibling
+          # matrix leg for who creates it.
+          for _ in $(seq 1 12); do
+            if gh release view "$TAG" >/dev/null 2>&1; then
+              break
+            fi
+            sleep 10
+          done
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            echo "no release object for tag '$TAG' after 120s — refusing to guess" >&2
+            exit 1
+          fi
+
+          # The two legs upload disjoint filenames, so they cannot collide;
+          # --clobber is here to make a re-dispatch idempotent rather than an
+          # error on an asset that already exists.
           gh release upload "$TAG" \
             "openbloxd-linux-${GOARCH}" \
             "openbloxd-linux-${GOARCH}.sha256" \
             --clobber
+
+      - name: Attach the unit and example config
+        # One arch only — these are arch-independent, and both legs uploading
+        # them would have the two races --clobber cannot help with.
+        if: matrix.goarch == 'amd64'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          gh release upload "$TAG" \
+            deploy/openbloxd.service \
+            deploy/openbloxd.example.yaml \
+            --clobber

.github/workflows/release.yml

@@ -2,14 +2,17 @@ name: Release
 
 # Tags a semver release from conventional commits once CI is green on main.
 #
-# For a Go module a tag *is* the release — there is no registry to publish to,
-# so this stays useful while the repository is private: consumers can require a
-# real version instead of a commit pseudo-version. No goreleaser hook yet; there
-# are no binaries to ship until cmd/openbloxd exists.
+# For a Go module a tag *is* the release for library consumers — there is no
+# registry to publish to, so they can require a real version instead of a commit
+# pseudo-version.
 #
-# The tag is not inert, though: publish-image.yml watches `v*` and builds the
-# matching sandbox image from it. That makes the token this job pushes with load
-# bearing — see the note on it below.
+# The tag is not inert, and this job does not do the publishing. Two workflows
+# watch `v*` and hang off the tag rather than off each other:
+#   publish-image.yml   builds the sandbox image
+#   publish-daemon.yml  builds and attaches the openbloxd binaries
+# That makes the token this job pushes with load bearing — see the note on it
+# below. It also means a tag cut without those workflows firing is a release that
+# ships nothing, which is how v0.3.0 came to have no assets.
 on:
   workflow_run:
     workflows: [CI]

cmd/openbloxd/main_test.go

@@ -71,3 +71,14 @@ func TestServeShutsDownOnContextCancel(t *testing.T) {
 		t.Fatal("serve() did not return after ctx cancellation")
 	}
 }
+
+// TestVersionDefaultsToDev pins the invariant the `version` doc comment argues
+// for: an in-tree build must never look like a release. The only thing allowed to
+// change this value is -ldflags at release time, so if a refactor ever stamps it
+// in the tree — or someone edits the default to a plausible-looking number —
+// this fails rather than letting a local build claim a version it does not have.
+func TestVersionDefaultsToDev(t *testing.T) {
+	if version != "dev" {
+		t.Errorf("version = %q in an unstamped build, want %q", version, "dev")
+	}
+}

deploy/openbloxd.example.yaml

@@ -13,7 +13,7 @@ profiles:
   code-exec:
     # Pin a digest. A tag can be repointed by whoever controls the registry,
     # and the image is the sandbox's entire userland.
-    image: ghcr.io/blox-eng/blox-sandbox@sha256:CHANGEME
+    image: ghcr.io/blox-eng/openblox-sandbox@sha256:CHANGEME
     runtime: runsc          # gVisor. Anything else trades away the isolation.
     egress: none            # No interface at all: no resolver, no route.
     user: "1000:1000"
@@ -27,7 +27,8 @@ profiles:
     max_timeout: 10m
 
   browser:
-    image: ghcr.io/blox-eng/blox-browser@sha256:CHANGEME
+    # No reference browser image is published; supply your own.
+    image: ghcr.io/example/headless-browser@sha256:CHANGEME
     runtime: runsc
     egress: none
     user: "1000:1000"

docs/security.md

@@ -108,6 +108,26 @@ else on the box has to. A caller talks to it over a Unix socket instead, using
 `pkg/brokerclient`, which implements the same `Backend` interface `pkg/docker` does —
 switching to it is a constructor change, not a rewrite.
 
+**Install it on the host, not as a container.** Running `openbloxd` in a container with
+`docker.sock` mounted puts the privilege straight back where the daemon exists to take
+it from. Each release attaches the binary for `amd64` and `arm64`, alongside the systemd
+unit and an example config:
+
+```sh
+# Pick your arch; verify before trusting it.
+curl -fsSLO https://github.com/blox-eng/openblox/releases/latest/download/openbloxd-linux-amd64
+curl -fsSLO https://github.com/blox-eng/openblox/releases/latest/download/openbloxd-linux-amd64.sha256
+sha256sum -c openbloxd-linux-amd64.sha256
+
+sudo install -m 0755 openbloxd-linux-amd64 /usr/local/bin/openbloxd
+openbloxd --version      # must print the release tag, not "dev"
+```
+
+`--version` reporting `dev` means the binary is somebody's local build rather than a
+release asset. That distinction matters because the client and daemon have to agree on
+the wire format, so "what is actually running on this host" needs an answer you can
+trust.
+
 **Profiles are the whole policy surface.** Every setting that could weaken isolation —
 image, runtime, egress, resource caps, lifetime — is chosen by profile name in the
 daemon's config file (`deploy/openbloxd.example.yaml`), not by the request. `Create`

pkg/docker/image_test.go

@@ -14,7 +14,7 @@ import (
 func TestIsDigestPinned(t *testing.T) {
 	pinned := []string{
 		"alpine@sha256:abc123",
-		"ghcr.io/blox-eng/blox-sandbox@sha256:deadbeef",
+		"ghcr.io/blox-eng/openblox-sandbox@sha256:deadbeef",
 		"registry.example.test:5000/team/img@sha256:0011",
 	}
 	for _, ref := range pinned {
@@ -26,7 +26,7 @@ func TestIsDigestPinned(t *testing.T) {
 	loose := []string{
 		"alpine",
 		"alpine:3.20",
-		"ghcr.io/blox-eng/blox-sandbox:0.2.0",
+		"ghcr.io/blox-eng/openblox-sandbox:0.2.0",
 		"registry.example.test:5000/team/img",
 		// A port in the host is not a digest, and neither is an empty one.
 		"example.test:5000/img@",

plans/2026-08-15-openbloxd-policy-broker.md

@@ -1887,7 +1887,7 @@ profiles:
   code-exec:
     # Pin a digest. A tag can be repointed by whoever controls the registry,
     # and the image is the sandbox's entire userland.
-    image: ghcr.io/blox-eng/blox-sandbox@sha256:CHANGEME
+    image: ghcr.io/blox-eng/openblox-sandbox@sha256:CHANGEME
     runtime: runsc          # gVisor. Anything else trades away the isolation.
     egress: none            # No interface at all: no resolver, no route.
     user: "1000:1000"
@@ -1901,7 +1901,7 @@ profiles:
     max_timeout: 10m
 
   browser:
-    image: ghcr.io/blox-eng/blox-browser@sha256:CHANGEME
+    image: ghcr.io/example/headless-browser@sha256:CHANGEME
     runtime: runsc
     egress: none
     user: "1000:1000"

specs/2026-08-15-openbloxd-policy-broker-design.md

@@ -118,7 +118,7 @@ loudly rather than degrading quietly. That is the correct failure.
 socket: /run/openbloxd/openbloxd.sock   # 0660, group openbloxd
 profiles:
   code-exec:
-    image: ghcr.io/blox-eng/blox-sandbox@sha256:…
+    image: ghcr.io/blox-eng/openblox-sandbox@sha256:…
     runtime: runsc
     egress: none
     user: "1000:1000"
@@ -134,7 +134,7 @@ profiles:
       username: …
       password: …
   browser:
-    image: ghcr.io/blox-eng/blox-browser@sha256:…
+    image: ghcr.io/example/headless-browser@sha256:…
     runtime: runsc
     egress: none
     user: "1000:1000"