# VPS release boundary

Recorded: 26 August 2026

Deployment state recorded on 26 August: private preview deployed and rollback proven; public cutover pending

Current production state is recorded separately in the [public launch boundary](/evidence/public-launch-2026-08-28.md).

## Source identifiers

- `deploy/kingsbury-install-release.sh` — validates and activates a versioned release under `/srv/kingsbury/releases/`.
- `deploy/caddy/Caddyfile.production` — declares the apex site and permanent `www` redirect.
- `deploy/caddy/Caddyfile.preview` — supports local verification without automatic HTTPS.
- `deploy/caddy/kingsbury-common.caddy` — records static serving, compression, cache and security-header rules.
- `deploy/kingsbury-vps-audit.sh` — records the read-only OS, network, port, disk, Caddy and firewall inventory needed before provisioning.
- `deploy/kingsbury-verify-preview.sh` — fails unless the live preview socket is bound only to loopback and returns the release.
- `deploy/kingsbury-validate-release.sh` — provides one checksum-pinned completeness and internal-reference check for activation and rollback.
- `deploy/kingsbury-rollback.sh` — validates and atomically restores a retained release under the same deployment lock.
- `release-contract.txt` — defines the required public release inventory used by build, package, install, rollback and transaction checks.
- `scripts/deploy-vps.ps1` — packages and transfers the generated static release with a source revision, archive checksum and manifest.
- `scripts/verify-vps.mjs` — defines private route/header checks and opt-in production TLS, canonical redirect, DNS-convergence and Microsoft-record checks.
- `research/hostinger-vps-caddy-hosting-2026-08-26.md` — records the primary-source Hostinger, Caddy, DNS, mail and recovery review.

## Activation boundary

The local deployer accepts only a stable clean Git revision for real releases, builds it afresh, then rechecks `HEAD` and the working-tree state before packaging. The server installer accepts only an explicit `/tmp/kingsbury-*.tar.gz` archive, a restricted release identifier, matching archive and release-contract SHA-256 checksums, and that Git source revision. It copies the deploy-user upload into a root-only staging directory before checksumming, inspecting or extracting it, closing the mutable-upload race. It rejects unsafe paths and non-static archive entries. One shared validator is used by both activation and rollback to require the public release inventory and prove that referenced internal routes and content-hashed Astro assets exist. Each root-owned release record binds the release to its own contract checksum, so a later legitimate contract change does not invalidate rollback. Release changes are serialised, the Caddy configuration is validated, and the `current` symlink changes only after the release is installed. Failure or interruption restores the prior state, including the no-current-link first-release state. A successful activation writes a durable release record before it reports success. Normal content switches do not reload Caddy or apply unrelated configuration changes.

## Private deployment evidence

On 26 August 2026, the release at source revision `d1be30450a53bb15c437dde36b8b557f8907c8e1` was installed on Kingsbury's existing Hostinger VPS behind an additive Caddy fragment. The live verifier proved the preview listener was exactly loopback-only and returned HTTP 200. The complete route and browser verification passed through a pinned-host-key SSH tunnel. A guarded rollback to the retained predecessor passed, and the active release was then restored and verified again. The six applications already sharing the Caddy service returned the same expected status codes before and after the Kingsbury work.

The release archive SHA-256 is `3e3600275314dbe2baedf19c3ed8767131f46f825cbe52530028dd2456213bbf`; its release-contract SHA-256 is `943a5ca3044d5c683fa5f75dd67987ee200a6c3bf05bde3457c77c391ef12617`. GitHub Actions run `32966829739` passed the loopback binding regression at that source revision, and run `32967331904` passed the later documentation-only release gate.

## Limit

This record supports the claim that a versioned release was installed, served privately on the real shared host, verified, rolled back and restored without changing the existing applications. It does not claim a public deployment, trusted-certificate result, DNS cutover, two-way mail test, external uptime result or observation window. Those later facts belong to the separate dated public launch record.