+ Every scenario below shares the same core check — scripts/smoke-selfhost.sh{" "}
+ boots one container against a fresh Redis on an isolated network, waits for it to become
+ healthy, and asserts on /health, /ready, /metrics,
+ and startup log events. What changes per scenario is the env you pass in and which events
+ you expect (or forbid).
+
+ No ORB_ENROLLMENT_SECRET — the container uses its own GitHub App private key.
+ Telemetry export is always-on in this mode too; a clean run produces no export error.
+
+ selfhost_orb_relay_register must NOT appear here — relay registration is
+ brokered-only and silently skips in direct mode (see{" "}
+ GitHub App and Orb).
+
+ ORB_ENROLLMENT_SECRET set — the container gets tokens from the central Orb
+ instead of its own App key. A working push-mode registration logs{" "}
+ selfhost_orb_relay_register; a broken one is fatal for push mode (logged at{" "}
+ error, not warn).
+
+ ORB_AIR_GAP=true disables the fleet-calibration export entirely. There is no
+ "air-gap confirmed" log event — the export function returns before doing anything, so
+ silence (no export error, no export attempt) is the signal. Confirm at the network level
+ too: no outbound request to the collector URL.
+
+ Each provider choice must log selfhost_ai_provider and must NOT log{" "}
+ selfhost_ai_cli_missing (a CLI-subscription provider whose binary isn't on{" "}
+ PATH silently produces no review output — this must be caught here, not in
+ production).
+
/ready (it probes the
+ configured AI provider). Where credentials aren't available for a given RC run, at minimum
+ confirm selfhost_ai_cli_missing does NOT appear — that alone catches the
+ release-blocking case (image built without INSTALL_AI_CLIS=true).
+
+ SQLite is the default — the base smoke command above already covers it (no{" "}
+ DATABASE_URL set). For Postgres, boot a Postgres container on the same network
+ first and point DATABASE_URL at it.
+
+ Redis is always-on in every scenario above (the base script already boots it) — confirm{" "}
+ selfhost_redis_ready appears with githubResponseCacheEnabled{" "}
+ matching whatever GITHUB_CACHE_TTL_SECONDS you set. For the optional Qdrant RAG
+ path, boot Qdrant on the same network and point QDRANT_URL at it.
+
+ After every applicable scenario passes, continue with the normal{" "} + upgrade flow to cut the tag and publish the + image. +
+X.Y.Z tag still moves{" "}
latest and publishes an unmarked (non-prerelease) GitHub Release.
+ orb-v* release or prerelease, run the{" "}
+ beta release checklist against the
+ built image — CI only smoke-tests the plain SQLite + Redis + direct-App default, not
+ brokered mode, air-gapped mode, or any AI provider.
+