[shockalotti]

Follow-up to #102 and #135, from a code review of the NS8 packaging.

1. Module image was single-arch (high). The app image builds amd64+arm64 with qemu; the module image did not. NS8 runs modules as rootless containers on the node, so an arm64 node could not install Calnode. build-images.sh now honours TARGETARCH and pushes only per-arch :build-<arch> tags; new push-manifest.sh assembles the public tags. Publishing an assembled tag only, after every arch landed, means an interrupted release cannot ship a single-arch image under a version tag.

2. The exec-bit guard failed open (medium). The awk added in #135 exits 0 on empty input, so a pathspec that stopped matching would pass vacuously and silently reintroduce the non-executable-script bug that made configure a no-op. Now asserts non-empty first. Verified three ways: passes on the real tree, fails loudly on an empty pathspec, fails on a 100644 entry.

3-6. timeout-minutes on both jobs; permissions: contents: read on validate; GITHUB_TOKEN/actor/event_name moved into env: instead of being interpolated into run:; ui/node_modules cached like upstream NS8 (every PR was re-downloading the whole Vue/Carbon tree).

7. Stale step-4 comment in 20configure.

Also aligned actions/checkout (v7) and setup-qemu-action (v4) with the rest of the repo instead of diverging.

Not verified: no buildah on the dev machine, so the multi-arch manifest path could not be smoke-tested locally. Needs one CI run to confirm before release. The exec-bit guard, schemas, shell and YAML all validated locally.

[shockalotti]

Closing this and reopening correctly. This PR was created with the wrong head content: the branch packaging/ns8-review-fixes on the remote holds the scheduling-invitations work (already tracked by #129), not the review fixes described below. The branch itself is left untouched. Correct PR follows on packaging/ns8-review-hardening-ocr.

[pullfrog]

Important

This PR does not contain the NS8 packaging changes its title and body describe. The head branch is 63 files of the externally delivered scheduling-invitations feature (issue #92), and git diff --stat --merge-base origin/main -- packaging .github is empty. The description's multi-arch module image, push-manifest.sh, exec-bit guard fix and workflow hardening are all absent.

Reviewed changes

Reviewed the full diff at 9b93d3e (63 files, 19 commits) before the branch was closed. The diff is entirely the scheduling-invitations feature:

• Issuance and tokens. Owner-scoped POST/GET /v1/scheduling-invitations with single-use 32-byte bearer tokens (sha256 at rest) and owner-scoped cancel/list/read.
• Public booking and management. /s/{token}, /v1/schedule/{token}/slots|book, and /manage/{token}/slots, all no-store with strict CSP, no-referrer, noindex, same-origin image gating and log-path redaction.
• Atomic claim and constraints. The token is claimed inside the booking transaction, the retained snapshot is re-validated in-tx, and external-calendar checks run before the transaction.
• Reschedule. Manage, admin REST and MCP all route through rescheduleBooking/RescheduleValidated with a transaction recheck; reassignment is blocked.
• Duration policy. Optional min/max/increment on event types, with omission-vs-null tracking and invitation-time validation.
• Lifecycle webhooks. A transactional outbox (migration 00072 triggers/view) drained by the worker, plus invitation correlation merged into booking events and creator-scoped delivery.
• Member deletion. 409 for invitation creators, retained hosts and referenced event-type owners.
• Migrations and tests. 00071/00072, with up/down, lifecycle, locale, race, correlation and security coverage.

The invitation implementation reads coherently and I found no blocking defect in it. Targeted go test for internal/slots, internal/handler, internal/webhook and internal/db passes.

⚠️ The described NS8 packaging work is absent

Technical details

# PR content does not match its title and body

## Affected sites
- `packaging/ns8/build-images.sh` — unchanged from `main`: still `buildah commit` to `:build` with no `TARGETARCH`, no per-arch tags and no manifest assembly.
- `packaging/ns8/push-manifest.sh` — does not exist.
- `.github/workflows/ns8-module.yml` — unchanged: `validate` has no `permissions: contents: read`, neither job has `timeout-minutes`, the exec-bit `awk` still exits 0 on empty input, `${{ secrets.GITHUB_TOKEN }}` / `${{ github.actor }}` / `${{ github.event_name }}` are still interpolated into `run:`, and there is no `ui/node_modules` cache.
- `packaging/ns8/imageroot/actions/configure-module/20configure` — the stale step-4 comment described in the PR body is still present.
- `git diff --stat --merge-base origin/main -- packaging .github` — empty.

## Required outcome
- Repoint the PR to the branch/commits that actually carry the NS8 packaging work, or
- Retitle and rewrite the PR body to describe the scheduling-invitations feature, and split the packaging follow-up into its own PR.

The branch was closed and its head ref deleted, so this is recorded for the next attempt: whatever is reopened should have title, body and diff aligned.

## Open questions for the human
- Is the invitation feature intended to be reviewed here, or was the wrong branch pushed to `packaging/ns8-review-fixes`?

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash ｜ 𝕏}