Release model & SKYNET pipeline

How a commit you merge becomes code running on every production box. Two halves:

• The branch/edition model decides what ships (nine public branches, three editions, tags only on the two stable branches).
• The serial/fetch pipeline decides how it lands (cron-driven, stamp-gated re-fetch — no push, no orchestration server; every box pulls on its own schedule).

The model in brief: omega8cc is upstream. There are three public editions per DUALLICENSE.md:

• LTS (free)
• PRO (licensed)
• DEV (licensed, cutting edge)

Each has a 5.x-<edition> branch family of three:

• raw work lands on 5.x-dev;
• non-breaking commits flow to 5.x-dev-base;
• the stable pair 5.x-pro / 5.x-lts accept commits only from their own -base branches, which accept only from 5.x-dev-base;
• the -edge branches are per-family experiments.

Tags go only on 5.x-pro and 5.x-lts, and a tag is the fleet trigger: the mirror pool is published from the tagged tree (publication itself happens outside this repo — treat the mirror as the tag's delivery surface), and every box with an active SKYNET agent pulls it unattended. Nothing reaches a tag that has not been through -base.

The per-box edition selector is _tRee (dev/pro/lts), exported with the rest of the release identity at BOA.sh.txt:47-50:

• _tRee
• _xSrl (release serial, part of every stamp name)
• _rLsn (release name, BOA-5.10.3 at HEAD)
• _bTs (run-once gate serial)

_tRee is re-derived from the operator verb by barracuda's _set_tree_vars (up-dev|up-pro|up-lts → _tRee, _bRnh="5.x-${_tRee}", _rgUrl="https://files.boa.io/versions/${_tRee}/boa", barracuda:1925-1968; downgrade protection at barracuda:432-468).

The shipping path

tag on 5.x-pro / 5.x-lts                       (only tagged branches)
   ↓
mirror pool: files.boa.io · files.o8.io · files.host8.biz   (BOA.sh.txt:404-409)
   serves https://<mirror>/versions/<tree>/boa/…            (_urlHmr, BOA.sh.txt:428)
   ↓  every 5 min per box (cron/crontabs/root:13), skipped while /run/boa_run.pid
clear.sh:  wget -qO- …/versions/${_tRee}/boa/BOA.sh.txt | bash ; autoupboa
                                                            (clear.sh:232-238)
   ↓
_update_boa_tools — runs ALWAYS, even with SKYNET off       (BOA.sh.txt:3563)
_update_agents    — runs only while SKYNET is active        (BOA.sh.txt:1108)
   each tool:  _fetch_versioned <dest> <url> fNN \
                 [--mode M] [--owner O] [--symlink P] [--guard PAT]
                                                            (BOA.sh.txt:1056-1106)
   ↓  weekly cron line written by autoupboa _crontab_update (autoupboa:921,963)
autoupboa weekly-system up-<tree> system [php-*] noscreen   (autoupboa:25,71-75)
   → barracuda up-<tree>: fetches BARRACUDA.sh.txt + barracuda.sh.cnf
     from ${_rgUrl}, sed-tunes the cnf copy, runs the installer
                                                            (barracuda:1834-1835,1042)

Every file on the tool path is gated by a stamp <name>.ctrl.<serial>.${_tRee}.${_xSrl}.pid under /var/log/boa (BOA.sh.txt:1072): move the tool's fNN serial — or ship a new _xSrl with a release — and every box re-fetches exactly once, then re-stamps only on a successful non-empty fetch (BOA.sh.txt:1093-1105).

The bump convention is decrement (f58 → f57): the mechanism is direction-free at HEAD because old stamps are cleaned on success (BOA.sh.txt:1097), but a box that skipped an intermediate update can still hold an old higher stamp, so counting down stays the rule.

Serial-bump discipline, the --guard/rollback contract, the two-tier duplication rules and the _bTs axis are on the pipeline leaf.

Opt-outs

Opt-outs, for completeness of the model:

• _SKYNET_MODE=OFF in /root/.barracuda.cnf reduces a BOA.sh.txt run to key-tools-only and exits before _update_agents (BOA.sh.txt:4473-4488) and aborts autoupboa early (autoupboa:174-177).
• /root/.turn.off.auto.update.cnf (or a cluster marker /root/.my.cluster_root_pwd.txt) strips the upgrade cron lines entirely (autoupboa:1179-1235).

The two opt-outs differ in what they silence, and the release-notice mailer keys on the first one only: nightly owl.sh (cron 15 4 * * *) fetches conf/version/barracuda-release.txt from the mirror and mails an upgrade notice when it does not match the box's /var/log/barracuda_log.txt history — but that whole block is gated on [ -z "${_SKYNET_MODE}" ] || [ "${_SKYNET_MODE}" = "ON" ] (owl.sh:349-388), so a _SKYNET_MODE=OFF box goes silent (the else branch just deletes the cached file).

A .turn.off.auto.update.cnf box, by contrast, only loses its upgrade cron lines — _SKYNET_MODE stays unset, so it still receives the owl notice.

The log line owl compares against is written by _barracuda_log_update (helper.sh.inc:1273-1307); the shipped version strings live in aegir/conf/version/*.txt.

Pages in this topic

• Branches, editions & tags — the nine public branches and their commit-flow contract, the LTS/DEV/PRO editions and licensing boundaries (LTS code-freeze, PRO-only roadmap items), the tag policy and why a tag is a production act, and the _tRee mapping: which branch or pin each component installs from — _BRANCH_BOA/_BRANCH_PRN ship as AUTO (barracuda.sh.cnf:1313-1314) and are resolved to 5.x-${_tRee} by the wrapper's sed pass (barracuda:872-906); hostmaster, hosting and eldir clone at 5.x-${_tRee} and provision at ${_BRANCH_PRN} (master.sh.inc:576-578,688).
• Serials & the fetch pipeline — the _fetch_versioned contract in full (stamp naming, --guard never-clobber, move-aside/restore on empty fetch, symlink integrity), the three serial axes (fNN per tool, counts down; _bTs 5103vNN run-once function gate, counts up within a release; _xSrl per release, invalidates all stamps), why _update_boa_tools and _update_agents intentionally duplicate ~30 fetches and why their serials must be bumped in both call sites together (BOA.sh.txt:3590-3598), autoupboa's crontab writer, the weekly-system wrapper (including the ICU/PHP 7.4 intl bootstrap, autoupboa:24-76), and every opt-out and lock gate.

The consumer end of an upgrade — what BARRACUDA.sh.txt actually does once the wrapper hands off (sourcing the tuned /var/backups/barracuda.sh.cnf, BARRACUDA.sh.txt:250-251, then the thirteen-include _FL function set helper dns system sql valkey redis nginx php solr master xtra firewall hotfix, BARRACUDA.sh.txt:275-278) — belongs to the Install & staged-setup internals topic, indexed from the guide front page.

Reference

• Variables and Commands — consolidated _VAR and CLI tables, including the barracuda/octopus/boa upgrade verbs cited here.
• Discontinued features — retired shipping mechanics (e.g. the pre-_fetch_versioned bulk curl loop) land there, not here.