Task iceberge

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ env:
   RUST_BACKTRACE: 1
   RUST_LIB_BACKTRACE: 1
 
-# 7 parallel jobs. See doc/working/plan-test.md § "CI Job Grouping Guide"
+# 10 parallel jobs. See doc/working/test.md § "Current CI Test Design"
 # for the assignment rule and how to add new test tasks.
 jobs:
   Lint:
@@ -223,6 +223,70 @@ jobs:
       if: always()
       run: pixi run clean-env
 
+  IcebergE2E:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Free disk space
+      run: |
+        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache
+        sudo apt-get clean
+        df -h /
+    - uses: prefix-dev/setup-pixi@v0.8.1
+      with:
+        pixi-version: latest
+    - uses: Swatinem/rust-cache@v2
+    - name: Run Iceberg acceptance
+      run: pixi run -e iceberg-e2e test-iceberg-e2e
+    - name: Upload Iceberg failure logs
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: runtime-iceberge2e-${{ github.run_attempt }}
+        path: |
+          .crowdb-runtime/
+          target/iceberg-rck/open-api/build/reports/tests/
+          target/iceberg-rck/open-api/build/test-results/
+        if-no-files-found: ignore
+        retention-days: 7
+    - name: Clean subprocesses
+      if: always()
+      run: pixi run clean-env
+
+  IcebergSDK:
+    runs-on: ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Free disk space
+      run: |
+        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache
+        sudo apt-get clean
+        df -h /
+    - uses: prefix-dev/setup-pixi@v0.8.1
+      with:
+        pixi-version: latest
+    - uses: Swatinem/rust-cache@v2
+    - name: Run Iceberg acceptance
+      run: pixi run -e iceberg-e2e test-iceberg-sdk
+    - name: Upload Iceberg failure logs
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: runtime-icebergsdk-${{ github.run_attempt }}
+        path: |
+          .crowdb-runtime/
+          target/iceberg-rck/open-api/build/reports/tests/
+          target/iceberg-rck/open-api/build/test-results/
+        if-no-files-found: ignore
+        retention-days: 7
+    - name: Clean subprocesses
+      if: always()
+      run: pixi run clean-env
+
   ConsoleTests:
     runs-on: ubuntu-latest
     steps:
@@ -334,3 +398,39 @@ jobs:
     - name: Clean subprocesses
       if: always()
       run: pixi run clean-env
+
+  DockerPreview:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+    - name: Free disk space
+      run: |
+        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache
+        sudo apt-get clean
+        df -h /
+    - uses: prefix-dev/setup-pixi@v0.8.1
+      with:
+        pixi-version: latest
+    - name: Build and test single-node preview image
+      env:
+        CROWDB_PREVIEW_TEST_ARTIFACTS: ${{ runner.temp }}/crowdb-preview-artifacts
+      run: pixi run test-single-node-container
+    - name: Capture Docker diagnostics on failure
+      if: failure()
+      run: |
+        docker ps -a
+        docker images
+        docker info
+        df -h
+    - name: Upload preview failure logs
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: docker-preview-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/crowdb-preview-artifacts
+        if-no-files-found: ignore
+        retention-days: 7

.github/workflows/release-container.yml

@@ -0,0 +1,157 @@
+name: Publish crowdb-iceberge docker container
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing Git release tag to publish
+        required: true
+        type: string
+
+concurrency:
+  group: crowdb-iceberg-single-node-preview-release
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      version: ${{ steps.source.outputs.version }}
+      revision: ${{ steps.source.outputs.revision }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.tag }}
+        fetch-depth: 0
+        submodules: true
+    - uses: prefix-dev/setup-pixi@v0.8.1
+      with:
+        pixi-version: latest
+    - name: Install host test prerequisites
+      run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+    - name: Verify release source
+      id: source
+      env:
+        RELEASE_TAG: ${{ inputs.tag }}
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        pixi run bash -euc '
+          [[ "$GITHUB_REPOSITORY" == buzzcrow/crowdb ]]
+          [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]
+          [[ "$RELEASE_TAG" == "v$(cat VERSION)" ]]
+          revision=$(git rev-parse --verify "refs/tags/$RELEASE_TAG^{commit}")
+          [[ "$revision" == "$(git rev-parse HEAD)" ]]
+          [[ "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" == false ]]
+          printf "version=%s\nrevision=%s\n" "${RELEASE_TAG#v}" "$revision" >> "$GITHUB_OUTPUT"
+        '
+    - name: Free disk space
+      run: |
+        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup /opt/hostedtoolcache
+        sudo apt-get clean
+        df -h /
+    - name: Build and test image without publication credentials
+      env:
+        CROWDB_PREVIEW_TEST_ARTIFACTS: ${{ runner.temp }}/crowdb-preview-artifacts
+      run: pixi run test-single-node-container
+    - name: Run S3 client acceptance
+      run: pixi run clean-env && pixi run -e s3-e2e test-boto3-e2e
+    - name: Run Iceberg client acceptance
+      run: pixi run clean-env && pixi run -e iceberg-e2e test-pyiceberg-e2e
+    - name: Run console acceptance
+      run: pixi run clean-env && pixi run test-console
+    - name: Require installed system browser
+      run: |
+        pixi run bash -euc '
+          for browser in /snap/bin/chromium /usr/bin/chromium /usr/bin/chromium-browser /usr/bin/google-chrome /usr/bin/google-chrome-stable /usr/bin/microsoft-edge; do
+            [[ ! -x "$browser" ]] || exit 0
+          done
+          echo "Release runner requires an installed system browser" >&2
+          exit 1
+        '
+    - name: Run console UI acceptance
+      run: pixi run clean-env && pixi run test-console-ui
+    - name: Check Rust formatting and lint
+      run: pixi run rs-fmt-check && pixi run rs-lint
+    - name: Archive verified runtime files
+      run: pixi run tar -C target/container-runtime -czf target/container-runtime.tar.gz .
+    - uses: actions/upload-artifact@v4
+      with:
+        name: verified-container-runtime
+        path: target/container-runtime.tar.gz
+        compression-level: 0
+        retention-days: 7
+    - name: Upload preview failure logs
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: release-preview-${{ github.run_attempt }}
+        path: ${{ runner.temp }}/crowdb-preview-artifacts
+        if-no-files-found: ignore
+        retention-days: 7
+
+  publish:
+    needs: verify
+    runs-on: ubuntu-24.04
+    environment: DockerHub
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.tag }}
+        fetch-depth: 0
+        submodules: true
+    - uses: prefix-dev/setup-pixi@v0.8.1
+      with:
+        pixi-version: latest
+    - name: Require publication credentials and unused immutable tags
+      env:
+        RELEASE_TAG: ${{ inputs.tag }}
+        REVISION: ${{ needs.verify.outputs.revision }}
+        DOCKERHUB_USERNAME: ${{ vars.DOCKERHUB_USERNAME }}
+        DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      run: |
+        pixi run bash -euc '
+          [[ -n "$DOCKERHUB_USERNAME" && -n "$DOCKERHUB_TOKEN" ]]
+          [[ "$(git rev-parse HEAD)" == "$REVISION" ]]
+          for tag in "$RELEASE_TAG" "git-$REVISION"; do
+            status=$(curl --silent --show-error --output /dev/null --write-out "%{http_code}" \
+              "https://hub.docker.com/v2/namespaces/crowdb/repositories/crowdb-iceberg/tags/$tag")
+            [[ "$status" == 404 ]] || { echo "Immutable tag $tag is present or registry unavailable (HTTP $status)" >&2; exit 1; }
+          done
+        '
+    - uses: docker/setup-buildx-action@v4
+    - uses: actions/download-artifact@v4
+      with:
+        name: verified-container-runtime
+        path: target
+    - name: Extract verified runtime files
+      run: pixi run bash -euc 'mkdir -p target/container-runtime && tar -C target/container-runtime -xzf target/container-runtime.tar.gz'
+    - uses: docker/login-action@v4
+      with:
+        username: ${{ vars.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Build and publish signed-source image with attestations
+      id: build
+      uses: docker/build-push-action@v7
+      with:
+        context: target/container-runtime
+        file: container/single-node-container/Dockerfile
+        platforms: linux/amd64
+        push: true
+        provenance: mode=max
+        sbom: true
+        build-args: |
+          SOURCE_REVISION=${{ needs.verify.outputs.revision }}
+          PREVIEW_VERSION=${{ needs.verify.outputs.version }}
+        tags: |
+          docker.io/crowdb/crowdb-iceberg:${{ inputs.tag }}
+          docker.io/crowdb/crowdb-iceberg:git-${{ needs.verify.outputs.revision }}
+    - uses: sigstore/cosign-installer@v4.1.2
+    - name: Sign published digest
+      env:
+        DIGEST: ${{ steps.build.outputs.digest }}
+      run: pixi run cosign sign --yes "docker.io/crowdb/crowdb-iceberg@$DIGEST"

.gitignore

@@ -44,3 +44,6 @@ lib/crowdb-rpc/.cache/
 app/crowdb-diskio/build/
 app/crowdb-diskio/build*/
 app/crowdb-diskio/.cache/
+
+# Python tooling bytecode
+__pycache__/

CHANGELOG.md

@@ -1,36 +1,39 @@
+<!-- Copyright 2026-present Gian <crow.db@outlook.com> -->
+<!-- Licensed under the Apache License, Version 2.0. -->
+
 # Changelog
 
-All notable changes to CROWDB will be documented in this file.
+CROWDB is preparing its first development release, `0.1.0-dev`. Publication
+is pending; this is not a production release or a compatibility promise.
+
+CROWDB does not yet maintain compatibility for persisted data, WAL, metadata,
+or other on-disk formats. A newer checkout may be unable to read data created by
+an older checkout. Use disposable data only.
+
+Changelog history begins with the first public Docker preview. Development work
+before that baseline remains available in Git history and project requirements
+but is intentionally not reconstructed as released change history.
 
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+The changelog will follow [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
+from that baseline. Version tags alone do not imply Semantic Versioning
+compatibility until the project explicitly adopts and documents a compatibility
+policy.
 
 ## [Unreleased]
 
-### Added
-- Copyright headers on all source files
-- AGENTS.md with project overview and dispatch table
-- CONTRIBUTING.md, PR/Issue templates
-- Demo recording plan (`doc/working/plan-demo.md`)
-
-### Changed
-- Restructured agent workflows: conventions merged into `/coding` workflow
-- Slimmed coding.md, doc.md, review.md
-- README: added badges, folded Getting Started into `<details>`
-
-## [0.1.0] - 2026-07-13
-
-### Added
-- Multi-Paxos consensus with per-key slot pipelining and out-of-order apply
-- WAL with multi-disk segments, batched durable flush, replay, and GC
-- crowdb-tree storage engine: B+tree with delta chains, io_uring async I/O, epoch-safe lock-free reads, buffer pool
-- `KVEngine` trait with in-memory and crowdb-tree backends
-- crowdb-rpc services: Paxos (Prepare/Promise/Accept/Accepted), KV, Snapshot
-- Leader election with term/ballot fencing and leader lease
-- Reconfiguration: member add/remove, leader transfer, membership epoch fence
-- `crowdb-kv-server` binary with HTTP management API
-- `crowdb-kv-client` library with topology cache, retry, idempotency
-- `crowdb-console`: web UI (Axum + React) and CLI for cluster lifecycle management
-- Comprehensive design documentation (`doc/`)
-- CI with GitHub Actions (fmt, clippy, test, Playwright E2E)
-- Pre-commit hooks (cargo fmt, clippy, clang-format, clang-tidy)
+### 0.1.0-dev preparation
+
+- Single-node Linux amd64 container with native Iceberg REST catalog and FileIO,
+  backed by CROWDB metadata, chunk storage and disk services.
+- Persistent bootstrap, generated client credentials, health checks, bounded
+  service recovery and restart validation.
+- S3 object access through an optional published endpoint.
+- Host builds and runtime-only container packaging, with a manual Docker Hub
+  publication workflow for version and commit tags, signatures, SBOM and provenance.
+
+The intended image is `crowdb/crowdb-iceberg:v0.1.0-dev`; no published digest is
+recorded yet. The GUI is not ready for this container. Multi-node deployment,
+production hardening and data-format upgrades are outside this release.
+
+See the [container guide](doc/user-manual/docker-single-node-user-guide.md) for
+supported startup, persistence, credentials and recovery behavior.