Implements #8 (single-binary form). After this merges, the miner on benjy and quadbrat follows main of this repo; lair/quantus#4 retires the release-pinned deploy-miner there.
What changed
.gitea/workflows/deploy.yaml
build on cuda-13.0: Fedora 43 like the hosts (the rust runner's binaries fail on them with GLIBC_2.43 not found) and the runner with nvcc for #3. MINER_BUILD_SHA is the pushed commit, so --version identifies the deploy.
deploy on fedora-43, matrix of benjy and quadbrat (beast present, commented out per the policy in #1): sudoers preflight against deploy/infra-setup.sh, credentials copied from the node host, miner.env rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. All of that is lair/quantus's step moved verbatim.
validate: unit active, --version carries this commit (informational in validate mode), miner_gpu_devices equals the matrix row, miner_hashes_total advances within 120 s (a poll, since the miner reconnects after restart).
rollback: when validate fails on a run that restarted, the previous binary (kept as .prev before the push) is restored and the miner restarted.
Triggers: push to main except markdown and the other two workflows; workflow_dispatch with mode: deploy | validate.
deploy/: the unit, sysusers, firewalld service and env template from lair/quantus asset/, unchanged. infra-setup.sh is the miner role of lair/quantus's script plus two cp grants for the rollback. Applied to benjy and quadbrat on 2026-09-03 and verified. README.md carries the traps from lair/quantus's CLAUDE.md that apply to the miner.
Validation
bash -n and YAML parse clean.
A validate-mode dispatch of this workflow from this branch runs against the hosts as currently deployed by lair/quantus (see the Actions tab). Build, reachability, preflight and validate must pass; the version check is informational in that mode because the hosts still run lair/quantus's v4.0.2 build.
The first deploy-mode run is the merge of this PR. It will replace the binary on both hosts (the build differs from origin's by build.rs) and restart them, which is the point: from then on the baseline is a deployment this repo made.
Cut-over
Merge this, watch the run on main, then lair/quantus#4 step 2: remove fetch's miner half and deploy-miner there. Never both in deploy mode.
Implements #8 (single-binary form). After this merges, the miner on benjy and quadbrat follows `main` of this repo; lair/quantus#4 retires the release-pinned `deploy-miner` there.
## What changed
**`.gitea/workflows/deploy.yaml`**
- `build` on `cuda-13.0`: Fedora 43 like the hosts (the `rust` runner's binaries fail on them with `GLIBC_2.43 not found`) and the runner with nvcc for #3. `MINER_BUILD_SHA` is the pushed commit, so `--version` identifies the deploy.
- `deploy` on `fedora-43`, matrix of benjy and quadbrat (beast present, commented out per the policy in #1): sudoers preflight against `deploy/infra-setup.sh`, credentials copied from the node host, `miner.env` rendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. All of that is lair/quantus's step moved verbatim.
- `validate`: unit active, `--version` carries this commit (informational in validate mode), `miner_gpu_devices` equals the matrix row, `miner_hashes_total` advances within 120 s (a poll, since the miner reconnects after restart).
- `rollback`: when validate fails on a run that restarted, the previous binary (kept as `.prev` before the push) is restored and the miner restarted.
- Triggers: push to `main` except markdown and the other two workflows; `workflow_dispatch` with `mode: deploy | validate`.
**`deploy/`**: the unit, sysusers, firewalld service and env template from lair/quantus `asset/`, unchanged. `infra-setup.sh` is the miner role of lair/quantus's script plus two `cp` grants for the rollback. Applied to benjy and quadbrat on 2026-09-03 and verified. `README.md` carries the traps from lair/quantus's `CLAUDE.md` that apply to the miner.
## Validation
- `bash -n` and YAML parse clean.
- A `validate`-mode dispatch of this workflow from this branch runs against the hosts as currently deployed by lair/quantus (see the Actions tab). Build, reachability, preflight and validate must pass; the version check is informational in that mode because the hosts still run lair/quantus's v4.0.2 build.
- The first `deploy`-mode run is the merge of this PR. It will replace the binary on both hosts (the build differs from origin's by `build.rs`) and restart them, which is the point: from then on the baseline is a deployment this repo made.
## Cut-over
Merge this, watch the run on `main`, then lair/quantus#4 step 2: remove `fetch`'s miner half and `deploy-miner` there. Never both in deploy mode.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5
quantus/miner#8. The miner is now deployed from this repo, not from
lair/quantus's release-pinned workflow (lair/quantus#4 retires that half).
- .gitea/workflows/deploy.yaml: build on cuda-13.0 (Fedora 43 like the
hosts, and the runner with nvcc for #3) with the commit embedded, then per
host in the matrix: sudoers preflight against deploy/infra-setup.sh,
credentials copied from the node, miner.env rendered with the node's mesh
IP resolved on the miner host, checksum-gated push of binary and unit,
scoped firewalld rule for the exporter, restart only on change. Validate
asserts the unit is active, --version carries this commit, the miner sees
the matrix's device count, and miner_hashes_total advances within 120 s.
If validate fails after a restart, the previous binary is restored.
- deploy/: the unit, sysusers, firewalld service and env template moved
verbatim from lair/quantus asset/, plus infra-setup.sh with the miner role
(and two new cp grants for the rollback). Applied to benjy and quadbrat.
- Matrix: benjy and quadbrat; beast present but commented out per the
operating policy in #1.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Implements #8 (single-binary form). After this merges, the miner on benjy and quadbrat follows
mainof this repo; lair/quantus#4 retires the release-pinneddeploy-minerthere.What changed
.gitea/workflows/deploy.yamlbuildoncuda-13.0: Fedora 43 like the hosts (therustrunner's binaries fail on them withGLIBC_2.43 not found) and the runner with nvcc for #3.MINER_BUILD_SHAis the pushed commit, so--versionidentifies the deploy.deployonfedora-43, matrix of benjy and quadbrat (beast present, commented out per the policy in #1): sudoers preflight againstdeploy/infra-setup.sh, credentials copied from the node host,miner.envrendered with the node's mesh IP resolved on the miner host, checksum-gated push of binary and unit, scoped firewalld rule for the exporter, restart only on change. All of that is lair/quantus's step moved verbatim.validate: unit active,--versioncarries this commit (informational in validate mode),miner_gpu_devicesequals the matrix row,miner_hashes_totaladvances within 120 s (a poll, since the miner reconnects after restart).rollback: when validate fails on a run that restarted, the previous binary (kept as.prevbefore the push) is restored and the miner restarted.mainexcept markdown and the other two workflows;workflow_dispatchwithmode: deploy | validate.deploy/: the unit, sysusers, firewalld service and env template from lair/quantusasset/, unchanged.infra-setup.shis the miner role of lair/quantus's script plus twocpgrants for the rollback. Applied to benjy and quadbrat on 2026-09-03 and verified.README.mdcarries the traps from lair/quantus'sCLAUDE.mdthat apply to the miner.Validation
bash -nand YAML parse clean.validate-mode dispatch of this workflow from this branch runs against the hosts as currently deployed by lair/quantus (see the Actions tab). Build, reachability, preflight and validate must pass; the version check is informational in that mode because the hosts still run lair/quantus's v4.0.2 build.deploy-mode run is the merge of this PR. It will replace the binary on both hosts (the build differs from origin's bybuild.rs) and restart them, which is the point: from then on the baseline is a deployment this repo made.Cut-over
Merge this, watch the run on
main, then lair/quantus#4 step 2: removefetch's miner half anddeploy-minerthere. Never both in deploy mode.🤖 Generated with Claude Code
https://claude.ai/code/session_01CBgs2nSi4H2mdh8kD8vMX5