Feature

Updates that undo themselves

in this fork since v2.7.0

Upstream promotes a new image the moment it boots, which proves the kernel started and nothing else. Here an image boots on trial and is kept only if the board answers properly afterwards.

26updates taken on this board

1rolled back by the board itself

0trips to the rack

the board's own bmcd_firmware_promotion_total counter, 2026-09-12.

See it in the demo →The Firmware page, answering from a real board's data.Do it on your board →Install this firmware, and what to read first.The evidence →Every decision the gate has made here, read off the board.Pick a version, from anywhere →Where the image the gate judges comes from.

The Firmware page: the running slot, the image it can fall back to, and when the gate last promoted one.

The argument

The gate asks three questions after a new image boots, not one. Two images this fork built would have passed "did it boot" while being broken, and one of them cut all four compute modules off the network. The one rollback on record was deliberate: an image with its staged note tampered to claim an older version, refused in about 35 seconds.

The full argument, with every measurement →