Updates and decommissioning

Signed offline updates, rollback, and erasing all site data at the end.

Signed offline updates

A release package is a folder with manifest.json (the version and the SHA-256 of each file: the container images and the Compose file), manifest.sig (an Ed25519 signature of the manifest by 4M's release key) and the files. It arrives on removable media; the edge PC never fetches updates.

python -m settings.release install /media/usb/boolex-<version> [--key /config/release-key.pub]
python -m settings.release status

install checks the signature against the release public key on the edge PC, and every file's hash, with no network access, before anything is applied. A package that fails either check is refused untouched. Installed releases are kept under releases/<version>. Site data lives in the database and data volumes, which a release does not touch.

Each release ships its SBOM, release notes and security evidence pack. A release build fails if any component has a known vulnerability scored CVSS 7.0 or higher that is not listed, with its reason and review date, as an accepted exception.

Rollback

python -m settings.release rollback

re-applies the previous installed release.

Decommissioning

When BooleX leaves a site, erase all site data and keep a record of it:

python -m settings.decommission --record /media/usb/deletion-record.json /config /data /backup

Every table of the platform store (code model, documents, work orders, process data, alarm history, audit trail, embeddings) is dropped, and every file under the given folders (configuration, data volume, backups) is deleted. The deletion record goes to --record, which must be outside the erased folders (a USB stick the site keeps): when, by whom, each table with its row count, and each folder with the number of files and bytes removed.