# Release bridge (host watcher) — DEV ONLY

The dashboard "Release" page (Deploy to Staging) cuts a release candidate by asking the **host** to do the git
work, so the container never holds git credentials — the same isolation as the WireGuard bridge.

- `clusev-release.sh serve-request` — reads `run/release-request.json` (the dashboard wrote it),
  re-validates, bumps `config/clusev.php`, commits, tags `vX.Y.Z-rcN`, pushes to Gitea (token read
  host-side from `/home/nexxo/.env.gitea`), and writes `run/release-result-<id>.json` for the
  dashboard to poll. Roll back leaves no half-release if the push fails.
- `clusev-release-request.path` / `.service` — a systemd `.path` watcher that runs the handler when a
  request file appears.

## Enable on the dev box

These units are installed **only** when `CLUSEV_RELEASE_CONTROLS=true` is in the project `.env`
(`install.sh` gates them). To enable manually:

```bash
cd /home/nexxo/clusev
sudo install -m 0644 docker/release/clusev-release-request.service /etc/systemd/system/
sudo install -m 0644 docker/release/clusev-release-request.path    /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now clusev-release-request.path
```

The dev `docker-compose.yml` must bind-mount `./run` to the container's
`storage/app/restart-signal` (shared with the WireGuard/restart bridges) so the dashboard's request
lands where the watcher looks.

## Verify (manual gate)

This is the end-to-end gate (like the WireGuard runbook): with the watcher enabled and the flag on,
open `/release`, click a bump button, confirm, and check that `vX.Y.Z-rcN` lands on Gitea (and, via
the push-mirror, on GitHub-private). The handler never logs the Gitea token.