s3gc 0.8.0

Adds --collectdatabase/S3GC_COLLECTDATABASE to qualify the auxiliary and
run-log tables' database explicitly. Every phase now checks, before its first
DDL, that all replicas of a Replicated auxiliary database are active, instead
of hanging on distributed_ddl_task_timeout and failing with IncompleteRead.
Credentials are redacted from the connection log, the debug parameter dump
and --listoptions.

See CHANGELOG.md [0.8.0] for the reasoning.

s3gc 0.7.0

A safety release. --useage now defaults to 24 hours with a hard floor, enforced
in both s3gc.py and render.py: the previous default of 0 emitted no age
predicate at all, so the dangerous configuration was also the out-of-the-box
one.

Adds a durable run log in ClickHouse that outlives the Job and its pod logs,
re-checks cluster topology before every sample, quotes --useafter as a SQL
string literal, sets PYTHONUNBUFFERED=1 in the image, and pins the deletion
scope with regression tests that catch all eleven mutation-testing breakages.

See CHANGELOG.md [0.7.0] for the reasoning.

s3gc 0.6.0

Fix SESSION_IS_LOCKED in the delete phase: tombstone writes now use a
separate ClickHouse client, so they never share a session with the open
anti-join stream. Expose USETOTAL in the Kubernetes Job template so a
first delete can be bounded.

First release published by CI.

Feature/kubernetes job runner (#3)

* S3 auth via AWS profile / boto3 credential chain

Add --s3auth=aws and --s3profile so s3gc can resolve temporary
session-token credentials (e.g. from AWS SSO) instead of static keys;
--s3-session-token for explicit temporary credentials

* WIP: kubernetes deployment

* Added Pytest instead of UnitTest and some README info

* kubernetes info update

* Added s3gc:dev-automation-check

* README updated

* README: added IAM role explanation

* Fix boolean env parsing and --age; publish public multi-arch images to GHCR

Found while using s3gc to reclaim 164.50 TiB across three customer clusters,
including the Kubernetes Job runner's first production run.

Boolean options were unusable from the environment. jsonargparse populates
action="store_true" flags from env as the RAW STRING, and every non-empty
string is truthy, so S3GC_S3USEIAM=false meant *true*: a Job selected the IAM
credential provider instead of its static keys and hung indefinitely in the
IMDS loop with no error, no exception and no log line, until
activeDeadlineSeconds killed it. Thirteen flags shared the defect and four are
set by job.yaml.tmpl; S3GC_S3SECURE_FLAG=false would likewise have stayed TLS.
Coerce all boolean options once after parsing, reusing the existing strtobool
helper, so true/false, yes/no, on/off, 1/0, empty and unset all behave. Bare
CLI flags keep working, which the container entrypoint depends on. Retires the
--order-by-objpath-flag twin that worked around this for one flag.

--age was silently wrong for anything older than a day: timedelta.seconds is
the sub-day remainder, so computed age never exceeded 23 h and --age 24
collected nothing, leaving an empty aux table and a dry-run reporting a clean
bucket.

Also:
- --usecollected against a missing/empty aux table raised no error and exited
  0, which reads as success. It is what a load-balanced CHHOST produces, since
  the aux table is node-local. It now fails loudly and says why.
- Warn when --samples disagrees with the aux table's PARTITION BY; the
  mismatch loses partition pruning (measured ~26 min vs ~2 min per sample).
- The final tally counted only the current attempt, understating one resumed
  run by 16.61 TiB. Say "in this attempt" and log the cumulative tombstones.
- Detect GCS endpoints and fall back to per-object deletes, since GCS has no
  batch DeleteObjects.

Images now publish publicly to ghcr.io/altinity/s3gc via the automatic
GITHUB_TOKEN, matching altinity-mcp and altinity-sql-browser. A private image
forced operators to copy a registry credential into the customer's namespace
as an imagePullSecret and delete it afterwards; a public one removes that step.
IMAGE_PULL_SECRET is now optional and the renderer omits the block when empty.
Both architectures stay mandatory: one customer node pool is 5x arm64 + 1x
amd64, where an amd64-only image cannot schedule.

Documents the per-replica CHHOST requirement, the minimum grant set, the
collect sharding recipe, and the per-cluster values that bite when wrong.

30 regression tests cover the boolean matrix, the age filter, the fail-loud
path, the samples warning, GCS fallback and the renderer.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Added AGENTS and CLAUDE instructions

* Add CHANGELOG.md recording what changed and why

Development history was only reconstructable from commit messages and a
customer support ticket, which mixes two audiences: the ticket tracks a
customer engagement, while this repository needs the engineering history.

CHANGELOG.md separates them. It records the reasoning and the evidence behind
defects found by running the tool against real clusters — the measurements are
the expensive part to reconstruct, and without them a later reader cannot tell
a deliberate design decision from an accident. Per CLAUDE.md rule 3 it carries
no customer names, cluster identifiers or credentials; findings are described
in terms of the behaviour they expose.

Documents the unreleased work on this branch (boolean environment parsing,
--age, fail-loud on a missing auxiliary table, GCS fallback, samples warning,
cumulative tally, public multi-arch GHCR images, optional pull secret) plus the
known gaps: collect still has no resume, and the GHCR package must be marked
public once after the first publish.

README's history section now points here; CLAUDE.md lists the file in the
repository map and asks for it to be updated alongside behaviour, safety and
deployment changes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Correct the boolean defect's scope; route twins through coerce_bool

Verifying the fix against a development cluster showed the original scope claim
was wrong. The codebase already paired each action="store_true" flag with a
type=bool twin sharing the same dest, and eleven of the thirteen boolean flags
had one and behaved correctly. Only --s3useiam and --listoptions lacked a twin,
so the practical defect was --s3useiam alone. A dev cluster log from the earlier
image proves the point: S3GC_S3SECURE_FLAG=false produced secure=False, a real
bool, not the truthy string.

Restores the --order-by-objpath-flag twin removed in 61b0ad2, since dropping it
was an unnecessary command-line break, and routes all eleven surviving twins
through coerce_bool instead of bool. type=bool rejects 0, 1 and empty values
with an ArgumentError; coerce_bool accepts them, so the environment and the
command line now agree on what a boolean looks like.

The post-parse coercion stays as the uniform safety net: the twin pattern is
easy to forget when adding a flag, which is exactly how --s3useiam broke.

Adds migration notes for pull secrets being registry-scoped (a Docker Hub secret
does not apply to ghcr.io, which surfaces as ImagePullBackOff with a 401 on the
anonymous token), the one-time package visibility flip, and the changed meaning
of S3GC_S3USEIAM=false.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* CHANGELOG: record the env-file migration and the dev validation

Two omissions from the merge entry.

The rendering env file is a breaking change that was not written down: the Job
template no longer emits S3GC_S3USEIAM and render.py now requires S3AUTH and
S3PROFILE, so an env file saved before this change fails with "missing required
values: S3AUTH, S3PROFILE". Encountered while re-testing with an env file from
the previous session, which is exactly how an operator will meet it. The note
distinguishes the rendering key from the S3GC_S3USEIAM environment variable,
which the script still honours as a deprecated alias, so an already-deployed
Job manifest keeps working.

Adds a Verified section so the entries above are provenance rather than claims:
all three phases ran end to end against a development cluster with the image
built from this branch, pulled anonymously with no imagePullSecret, and
auth=iam confirms workload identity still resolves after the credential
rewrite. States plainly that the GCS per-object fallback remains unit-tested
only, pending a real endpoint.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Remove S3GC_S3USEIAM

* Splitted CHANGELOG WIP to TODO and updated agents to take this into account

* TDD approach for AI agents

* use Kubeconform for CICD tet validation

---------

Co-authored-by: Maciej Bąk <realyota@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: realyota <realyota@users.noreply.github.com>

Update README.md

Added entry to changelog

useage parameter, object last modified in auxiliary table