Record verified Linux release and downloaded-archive checks [skip ci]

agent.md

@@ -48,3 +48,5 @@ User explicitly requires optional substitution, default off. Implemented per-ser
 
 ## Portable Linux release in progress
 User wants a ready-to-run Linux x64 build on GitHub, exact distribution unknown. Package static musl binary with run.sh, empty first-run config and random persistent private password; do not package runtime data or enable substitution. Workflow verifies native Clippy/fmt and musl tests plus archive login/API/TCP/restart smoke, then tag releases publish privately. Main push artifacts do not replace releases. Actual CI/package verification pending; docs in deploy/QUICKSTART.md.
+
+Portable release completed: v0.1.0 at source f264f8a, private GitHub Release includes static musl Linux x64 tar.gz + SHA256SUMS. CI40011983417 succeeded: fmt/Clippy,50 musl tests, static linkage check, release build and packaged first-run/login/API/restart/256KiB TCP smoke. Downloaded release independently passed SHA256, full package smoke in Orb Ubuntu amd64 and launcher/HTTP/graceful-stop in isolated Alpine3.22 without glibc. Native49 tests/fmt/Clippy also passed. No runtime/compiler/database dependencies beyond normal shell utilities for run.sh. First-run config is empty; real targets still require operator setup. Live demo unchanged. See docs/linux-release-verification.md.

docs/linux-release-verification.md

@@ -0,0 +1,13 @@
+# Portable Linux x64 release — 2026-10-23
+
+Published [v0.1.0](https://github.com/mrvasil/ctf-ad-mirror-tool-rust/releases/tag/v0.1.0), source f264f8a. Repository remains PRIVATE. Assets: mirror-tool-linux-x64.tar.gz (4717473 bytes) and SHA256SUMS. Archive SHA256: `43ec87c748b7c1957bd0fe0b270e6ccff5f55deca308b9ab98d072c586f4f7be`.
+
+[Successful tag workflow40011983417](https://github.com/mrvasil/ctf-ad-mirror-tool-rust/actions/runs/40011983417): pinned Rust1.93.1, musl-tools, fmt, all-target Clippy with warnings denied,50 all-target musl tests, JS/shell syntax, optimized musl build, static ELF validation and package integration smoke. Initial duplicate main run was intentionally cancelled. Native macOS fmt/Clippy and49 tests passed before publication.
+
+Downloaded the actual Release assets through gh, checked SHA256 and independently ran scripts/verify-linux-package.py in Orb Ubuntu26.04 amd64. It extracts into a path containing spaces, creates empty configuration and48-character random password with0600 permissions, starts from a different cwd, logs in, adds a team/service, verifies exact256KiB TCP echo plus half-close, restarts and checks config/password/topology persistence and default-off substitution. SIGTERM exits cleanly. No real targets or credentials used.
+
+file reports x86-64 static-pie ELF; package script rejects PT_INTERP or DT_NEEDED. Actual release also ran in Alpine3.22 via Orb Docker with network disabled and read-only root, writable tmpfs only: run.sh check, automatic password, HTTP login page and graceful stop passed without glibc. Initial readiness connection refusal was retried until the listener started. No packages installed inside the Alpine test.
+
+Local downloaded artifacts: ignored dist/github-v0.1.0 and host Downloads/mirror-tool-linux-work/github-v0.1.0. Existing live demo was not restarted or changed. Release includes binary, launcher, example TOML, docs, systemd template and BUILD-COMMIT; no runtime config/state/credentials.
+
+run.sh depends on ordinary POSIX shell/Linux utilities and /dev/urandom; extracting needs tar/gzip. Binary requires Linux x86-64, no AVX-specific tuning, no external libc/SQLite/OpenSSL/compiler. This is not a guarantee for arbitrary old kernels, seccomp policies or insufficient resources. Rust target baseline Linux3.2+ was documented, not tested on a3.2 kernel. Real protocol/checker compatibility still requires a pre-game check.

progress.md

@@ -21,3 +21,5 @@
 2026-10-23 flag feature: user selected universal configurable mode. Design explained before implementation; use same-format random tokenization plus authenticated encrypted durable SQLite records (not homemade same-length encryption). Initial cargo-add multiple-dependency feature syntax rejected; retried separate dependency additions successfully. No existing source behavior changed yet.
 
 2026-10-23 flag completion: per-service opt-in defaults off for existing/new configurations; UI switch and indicator preserve the legacy page. Encrypted durable cache, split-safe transformations and documented protocol limits complete. Final native49/Orb50 tests, fmt/Clippy/JS and releases passed. Browser verified on/off persistence; loopback round-trips, replicas, half-close, errors and restart covered. Demo16700 updated with original topology and protection off. Orb lacked rsync, so staging used cp; launchctl bootstrap rejected relative plist path, succeeded with the absolute path after validating plist and absent job. See docs/flag-protection-verification.md.
+
+2026-10-23 Linux packaging: added static x86_64-unknown-linux-musl archive, run.sh with non-overwriting config and private persistent random password, standalone quickstart and pinned Actions build/release. Published v0.1.0 automatically after CI40011983417 passed50 musl tests and archive smoke. Downloaded published artifact verified in Orb Ubuntu and glibc-free Alpine3.22; SHA256 and static ELF confirmed. Native49 tests/fmt/Clippy pass. Initial main CI cancelled deliberately in favor of identical tag run. No game endpoints touched; demo remains unchanged.

task_plan.md

@@ -48,4 +48,4 @@ Flag implementation issues recorded: cargo-add combined feature syntax rejected
 ## Portable Linux release — 2026-10-23
 - [complete] Add static x86_64-unknown-linux-musl packaging, first-run launcher and operator quickstart.
 - [complete] Add pinned GitHub Actions build/test/artifact and tag-triggered release workflow.
-- [in progress] Validate actual archive on Linux, publish private GitHub release and verify downloaded asset.
+- [complete] Validate actual archive on Linux, publish private GitHub release and verify downloaded asset.