# How Bento releases pom. Lives here rather than in the daemon's config so it is
# versioned with the code it describes.
#
# A service, not an app or a library: pom is run rather than distributed. There
# is no bundle for a user to download and no crate to publish.
#
# The kind says what pom IS. Who delivers it is a separate question, and the
# answer changed: Bento used to install the binary and restart the unit itself
# (`[[deploy]]` tables, now gone). Under the Sando/Bento boundary Bento builds
# and packages, and Sando decides whether a thing advances a stage. So the
# release ends at `collect`, and the daemon's `[handoff.pom]` table carries the
# artifact to sandod, which verifies it against its record, gates it, and
# promotes it tier by tier.
#
# That is what pom gets out of the move: a content-addressed release history and
# a real rollback horizon, instead of the single `<install-path>.prev` file
# Bento's installer kept. pom had the worst deploy story of anything shipped
# purely because of its architecture; this is the fix.
#
# Bento refuses to start if this file and the daemon config disagree — a service
# must either deploy itself or hand off, never neither and never both.
kind = "service"

# Two arches, two machines, built natively on each. Sando cannot do this job:
# sando-daemon.toml sets build_host = "fw13" and build::run refuses to compile
# anywhere else, which is the never-build-on-prod invariant and also makes Sando
# single-architecture. pom needs an aarch64 binary for astra, so Sando could
# never build half of this release without breaking its own rule.
targets = ["linux/x86_64", "linux/aarch64"]

# Workspace root carries the version.
version_path = "Cargo.toml"

# MNW is one .git over the server, sando, multithreaded, pom and more, each
# versioned separately, so the default `v{version}` names no product in
# particular here. pom and multithreaded are both at 0.4.1 as it stands, which
# makes a bare `v0.4.1` ambiguous the day it is created rather than eventually.
tag_format = "pom-v{version}"

# Still not the both-or-neither gate it looks like: `require_all_targets` is
# consulted by `publish`, and pom does not publish. The 0.4.1 release showed what
# that costs -- x86_64 installed on the Hetzner box and restarted it while the
# aarch64 build was still failing its test gate, leaving the mesh split across
# two versions until the retry landed.
#
# What changes under the handoff is where the guarantee comes from. It is no
# longer Bento's to give: each arch is handed over as its own artifact with its
# own evidence, and Sando resolves BOTH bundles before it touches a node, so a
# version missing its x86_64 half fails the promote whole rather than halfway.
# The split-mesh failure moves from "possible, untracked" to "refused by the
# promote".
#
# Left on because it is the right intent and costs nothing.
require_all_targets = true

# No `[[deploy]]` tables. They are what a service that installs ITSELF declares,
# and pom no longer does -- the daemon's `[handoff.pom]` sends the collected
# artifact to sandod instead, and sandod owns install, restart, health and
# rollback from there.
#
# Kept here as the record of what the old path was, because the addresses moved
# to sando's topology rather than disappearing:
#
#   linux/x86_64  root@100.120.174.96 (Tailscale SSH on 22, NOT 2200 -- 2200 is
#                 what the retired deploy.sh used and it refuses this machine's
#                 key for both root and max, which is why 0.4.0 was done by hand)
#   linux/aarch64 astra
#   both          install_path /usr/local/bin/pom, unit pom.service,
#                 health http://<host>:9100/api/health