MB685 extends the Debian 13 readiness work started in MB684.
MB684 proved that a clean Debian 13 environment could bootstrap Mediabot dependencies and execute the real fresh configuration path.
MB685 moves one boundary further: it makes CI create and validate a real fresh Mediabot database on Debian 13.
Final commit:
Version : 3.4dev-20260822_084108
Commit : 45e35f6
Branch : master
🗄️ Make Debian 13 Prove the Database Chamber Is Ready
MB685 focuses on the fresh database installation boundary.
Changed:
.github/workflows/debian13.yml
README.md
docs/CONFIGURE.md
install/db_install.sh
t/cases/886_mb684_debian13_fresh_install_gate.t
t/cases/887_mb685_debian13_fresh_database_gate.t
VERSION
Unchanged:
Mediabot runtime bot code
install/mediabot.sql
database schema definition
IRC runtime behaviour
The Debian 13 workflow now goes beyond installing MariaDB packages.
It starts a real MariaDB server inside the Debian 13 environment and waits for it with a bounded readiness check.
The workflow then exercises the real Mediabot database installation path.
This closes the gap between:
"MariaDB packages can be installed"
and:
"Mediabot can actually create and validate a fresh database"
db_install.sh pathThe workflow now executes the actual project installer:
install/db_install.sh
rather than reproducing its SQL behaviour in CI-specific commands.
The installer imports the project’s real reference schema:
install/mediabot.sql
and creates the application database/account through the same path intended for a fresh deployment.
The schema file itself was not changed by MB685.
While wiring the real installer into CI, MB685 uncovered an important logging issue.
When db_install.sh was invoked with -c, the randomly generated database password could be displayed as the default value inside an interactive prompt.
That is unacceptable for CI logs.
MB685 changes this behaviour specifically for configuration-driven installation:
db_install.sh -c
The generated password is no longer echoed in the prompt.
It remains stored only in the private Mediabot configuration.
The historical standalone installer behaviour without -c is preserved.
The Debian 13 database gate verifies that the resulting Mediabot configuration remains protected:
owner : mediabot:mediabot
mode : 0600
The application credentials written by the installation flow are therefore not left in a broadly readable file.
The CI gate does not stop after creating the database.
It reconnects using the generated Mediabot application credentials.
That proves that the account created by the fresh install is actually usable by the application boundary it was created for.
After the fresh database has been installed, MB685 runs the project’s schema drift checker against the real database.
Validation includes:
--strict
--types
--indexes
This connects three pieces that previously had separate proofs:
install/mediabot.sql
↓
db_install.sh
↓
live MariaDB database
↓
strict schema drift checker
A fresh installation should therefore match the repository’s expected schema immediately after creation.
MB685 adds:
t/cases/887_mb685_debian13_fresh_database_gate.t
and updates the MB684 contract:
t/cases/886_mb684_debian13_fresh_install_gate.t
because the existing Debian 13 workflow has legitimately grown from a bootstrap/fresh-config gate into a bootstrap + fresh-database gate.
The installer/database/CI contract group passed:
PASSED : 348/348 (13s)
This included existing contracts around:
db_install.sh
SQL literal handling
CPAN/MariaDB driver requirements
schema drift
configure fail-closed behaviour
Doctor database/migrations
public CI
MB684 Debian 13 gate
MB685 database gate
perl t/test_commands.pl --fast --progress
Result:
Selected: 324 of 770 discovered test file(s)
[====================] 100% [324/324 files | 5992 tests]
PASSED : 5992/5992 (65s)
perl t/test_commands.pl --progress
Result:
[====================] 100% [770/770 files | 15528 tests]
PASSED : 15528/15528 (212s)
The final worktree contained:
M .github/workflows/debian13.yml
M README.md
M docs/CONFIGURE.md
M install/db_install.sh
M t/cases/886_mb684_debian13_fresh_install_gate.t
A t/cases/887_mb685_debian13_fresh_database_gate.t
No unexpected runtime/install file was modified.
The one installer change was the expected MB685 hardening in:
install/db_install.sh
Version : 3.4dev-20260822_084108
Commit : 45e35f6
🗄️ Make Debian 13 Prove the Database Chamber Is Ready
Commit summary:
7 files changed
294 insertions
17 deletions
New contract:
t/cases/887_mb685_debian13_fresh_database_gate.t
The commit was successfully pushed to GitHub.
The Debian 13 workflow is strong automated evidence, but it is not the final human acceptance test.
The main teuk.org host currently runs Debian 12.
Before Mediabot 3.5 is declared ready, a real end-to-end fresh installation should still be performed manually on a dedicated Debian 13 VM.
That test should cover the complete deployment experience from an empty machine, not only the isolated CI boundaries.
The next round is MB686.
Its exact scope must be derived from a fresh post-45e35f6 snapshot.
Remaining candidates include:
upgrade/migration path
systemd/service installation boundary
live first startup
IRC connectivity
security/secrets
release artefact hygiene
manual Debian 13 acceptance checklist
final 3.5 readiness
The actual next change should remain evidence-driven rather than roadmap-driven.
🗄️ The database chamber is no longer assumed to exist. Debian 13 now has to build it, unlock it, and prove every shelf is where the map says it should be.
You must be logged in to reply.