fix 1.23.6: mon pages only from remote suite tip

Host-agent must fetch/reset to origin/main and refuse if HEAD lags.
Refresh suite-overlay from tip after update; do not re-apply stale overlay
over Forgejo by default (was regenerating mon HTML with old site-gen).

VERSION

@@ -1 +1 @@
-1.23.5
+1.23.6

VERSIONS.md

@@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre
 
 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.23.6** | 2026-07-22 | **Strict suite tip for mon pages:** every host-agent run must `fetch`+`reset` to `origin/main` and **refuse** if HEAD ≠ remote tip (`SUITE_REQUIRE_REMOTE_TIP=1`). Overlay is refreshed **from** the tip after update (never re-applied over tip by default — was publishing stale site-gen). `git clean` after reset. Mon HTML still embeds that COMMIT in sticky/meta. |
 | **v1.23.5** | 2026-07-22 | **Bugfix / host-agent:** multi-agent shared `/var/www/monitoring-sites` — stop full-tree `rsync --delete` (wiped sibling pages e.g. `/monitoring-max-ladder/` after main/surface/aptdeploy runs). Publish **only this job’s** `HTML_OK_DIR`/`HTML_ERR_DIR` per host; `apply-monitoring-live.sh` merges without tree-delete. |
 | **v1.23.4** | 2026-07-19 | **Bugfix / mon:** shared **normalize_taler_uri** (strip taler:// host :443/:80); ladder/e2e/pay use it. **urls** scans bank+exchange+merchant intros + demo-withdraw/auto-account/stats for default ports (**ERROR** on GOA). Unit test tests/test_normalize_taler_uri.sh. |
 | **v1.23.3** | 2026-07-19 | **Bugfix:** payments stale because max-ladder never got coins — root cause on koopa was **taler-wallet-cli missing** (all mint-OK → SKIP_ACCEPT). Hard-fail ladder prereq if CLI/helper missing; settle keeps polling after transfer_done + short run-pending; pay wait default 180s; max-ladder wrapper sets PATH/WALLET_CLI. |

host-agent/README.md

@@ -4,8 +4,9 @@
 
 | Behaviour | Default |
 |-----------|---------|
-| Suite refresh | **`update-suite.sh` every run** → `git fetch --tags` + hard reset to `origin/main` |
+| Suite refresh | **`update-suite.sh` every run** → `git fetch --tags` + hard reset to `origin/main` + clean; **HEAD must equal remote tip** (`SUITE_REQUIRE_REMOTE_TIP=1`) before mon HTML is generated |
 | Update strict | `SUITE_UPDATE_STRICT=1` (default): **abort** if fetch/reset fails — no silent old tree |
+| Overlay | After tip reset, suite-overlay is **copied from** remote tip (not applied over it). Emergency only: `SUITE_ALLOW_STALE_OVERLAY=1` |
 | Wall clock | `RUN_TIMEOUT=600` |
 | Log | line-buffered `run-*.log` (continuous write) |
 | HTML | always (first run / empty tree too) + commit URL; **bootstrap install stubs are monpages ERROR** |

host-agent/run-host-report.sh

@@ -152,25 +152,38 @@ UPD_LOG="$LOG_DIR/suite-update-${STAMP}.log"
 : >"$LOG"
 
 # --- suite auto-upgrade BEFORE the HTML log (git noise must not pollute mon pages) ---
+# Always download newest taler-monitoring from Forgejo first. Mon HTML landing pages
+# embed COMMIT/VERSION from this tree — never generate pages from a lagging clone.
 OVERLAY_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/taler-monitoring/suite-overlay"
-if [ -f "$AGENT_MON/taler-monitoring.sh" ]; then
-  mkdir -p "$OVERLAY_DIR"
-  rsync -a \
-    --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
-    --exclude 'android-test/out*' --exclude '__pycache__' \
-    "$AGENT_MON/" "$OVERLAY_DIR/" 2>/dev/null || true
-fi
 
+# Prefer update-suite from the live suite tree if present (may itself be slightly
+# old until fetch); fall back to agent-bundled copy.
+_upd_src="$AGENT_DIR/update-suite.sh"
+if [ -f "${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh" ]; then
+  _upd_src="${SUITE_DIR:-$HOME/src/taler-monitoring}/host-agent/update-suite.sh"
+fi
 # shellcheck source=update-suite.sh
-if ! source "$AGENT_DIR/update-suite.sh" >"$UPD_LOG" 2>&1; then
+if ! source "$_upd_src" >"$UPD_LOG" 2>&1; then
   echo "ERROR: suite auto-update failed — refusing to run with stale tree" >&2
   echo "       detail: $UPD_LOG" >&2
   tail -n 30 "$UPD_LOG" >&2 || true
   echo "       fix git/network or set SUITE_UPDATE_STRICT=0 only as emergency" >&2
   exit 1
 fi
+unset _upd_src
 if [ -d "${SUITE_DIR:-}/host-agent" ]; then
   AGENT_DIR="${SUITE_DIR}/host-agent"
+  AGENT_MON="${SUITE_DIR}"
+fi
+# After tip reset: refresh suite-overlay FROM remote tip (never the reverse by default).
+# Old behaviour rsynced local agent → overlay *before* fetch, then could re-apply a
+# stale overlay over a fresh Forgejo tree and publish outdated mon-page generators.
+if [ -f "${SUITE_DIR}/taler-monitoring.sh" ]; then
+  mkdir -p "$OVERLAY_DIR"
+  rsync -a --delete \
+    --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
+    --exclude 'android-test/out*' --exclude '__pycache__' \
+    "${SUITE_DIR}/" "$OVERLAY_DIR/" 2>/dev/null || true
 fi
 
 # Now open the public HTML log (clean agent header + suite summary only)
@@ -215,9 +228,11 @@ if [ -f "$OVERLAY_DIR/host-agent/run-host-report.sh" ] \
   && grep -q '_wrap_keys\|_WRAP_SET_' "$OVERLAY_DIR/host-agent/run-host-report.sh" 2>/dev/null; then
   _need_overlay=1
 fi
-if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
+# Default: never re-apply overlay over a just-fetched remote tip (v1.23.6+).
-  echo "WARN: Forgejo @ ${COMMIT_SHORT:-?} lagging local suite-overlay (phases=[$PHASES])" >&2
+# Emergency only: SUITE_ALLOW_STALE_OVERLAY=1 restores old "overlay wins" path.
-  echo "      re-applying suite-overlay → $SUITE_MON" >&2
+if [ "$_need_overlay" = "1" ] && [ "${SUITE_ALLOW_STALE_OVERLAY:-0}" = "1" ] \
+  && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
+  echo "WARN: SUITE_ALLOW_STALE_OVERLAY=1 — re-applying suite-overlay over ${COMMIT_SHORT:-?}" >&2
   mkdir -p "$SUITE_MON"
   rsync -a \
     --exclude secrets.env --exclude 'android-test/artifacts' --exclude 'android-test/apks' \
@@ -225,11 +240,12 @@ if [ "$_need_overlay" = "1" ] && [ -f "$OVERLAY_DIR/taler-monitoring.sh" ]; then
     "$OVERLAY_DIR/" "$SUITE_MON/"
   ROOT="$SUITE_MON"
 elif [ "$_need_overlay" = "1" ]; then
-  echo "WARN: Forgejo missing features and no suite-overlay — using agent mon $AGENT_MON" >&2
+  echo "WARN: suite @ ${COMMIT_SHORT:-?} may lack phase files for [$PHASES] — using remote tip anyway (push missing features; set SUITE_ALLOW_STALE_OVERLAY=1 only as emergency)" >&2
-  ROOT="$AGENT_MON"
+  ROOT="$SUITE_MON"
+  echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT"
 else
   echo "using suite mon @ ${COMMIT_SHORT:-?} · $ROOT"
-  # Do NOT rsync suite-overlay over a fresh Forgejo tree — that reintroduced
+  # Never rsync suite-overlay over a fresh Forgejo tree — that reintroduced
   # stale site-gen/host-agent (bootstrap sticky, old monpages) on stage/betel.
 fi
 unset _need_overlay

host-agent/update-suite.sh

@@ -76,6 +76,9 @@ case "$SUITE_UPDATE_MODE" in
             && ! git reset --hard FETCH_HEAD; then
             _upd_die "git reset --hard origin/$SUITE_GIT_REF failed"
           fi
+          # Drop untracked junk that could shadow suite files (never secrets).
+          git clean -fd -e secrets.env -e 'android-test/artifacts' -e 'android-test/apks' \
+            -e 'android-test/out*' 2>/dev/null || true
           ;;
         pull)
           if ! git pull --ff-only origin "$SUITE_GIT_REF" 2>&1; then
@@ -98,6 +101,23 @@ SOURCE_REPO_WEB="${SOURCE_REPO_WEB:-https://git.hacktivism.ch/hernani/taler-moni
 COMMIT_URL="${SOURCE_REPO_WEB}/src/commit/${COMMIT}"
 export COMMIT COMMIT_SHORT COMMIT_URL SOURCE_REPO_WEB
 
+# Strict tip check (default): mon pages must be generated from remote tip, not a lagging clone.
+# SUITE_REQUIRE_REMOTE_TIP=0 only for emergency offline/dev.
+: "${SUITE_REQUIRE_REMOTE_TIP:=1}"
+if [ "${SUITE_UPDATE_MODE}" != "keep" ] && [ "${SUITE_UPDATE_MODE}" != "skip" ] \
+  && [ "${SUITE_UPDATE_MODE}" != "off" ] && [ "${SUITE_UPDATE_MODE}" != "none" ] \
+  && [ "${SUITE_REQUIRE_REMOTE_TIP}" = "1" ]; then
+  _remote=$(git rev-parse "origin/${SUITE_GIT_REF}" 2>/dev/null || git rev-parse FETCH_HEAD 2>/dev/null || true)
+  if [ -z "$_remote" ]; then
+    _upd_die "cannot resolve origin/${SUITE_GIT_REF} after fetch — refuse mon-page generate on unknown tip"
+  elif [ "$COMMIT" != "$_remote" ]; then
+    _upd_die "suite HEAD ${COMMIT_SHORT} != origin/${SUITE_GIT_REF} $(git rev-parse --short=12 "$_remote" 2>/dev/null) — refuse stale mon pages"
+  else
+    echo "  remote tip OK: HEAD == origin/${SUITE_GIT_REF} (${COMMIT_SHORT})"
+  fi
+  unset _remote
+fi
+
 # Release tag for sticky bar (exact tag if HEAD is tagged, else nearest)
 SUITE_VERSION=""
 if command -v git >/dev/null 2>&1; then