coulomb/canned-prompts
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CANP-WP-0006 T06: container image and smoke checks

Browse source 
Two-stage python:3.12-slim build with no toolchain in the runtime layer,
running non-root (uid 10001) and writing nothing to disk — its state is the
database. reference/ is a real build input, because the service delegates
validation to it so the two cannot disagree about what a valid package is.

Migrations deliberately do not run at start-up. A schema change is a deployment
step with its own rollback, not something that races between replicas.

tools/smoke.py asserts what can be known about a running service: liveness,
readiness, fleet health shape, migration revision, and that the index and
registry are queryable. stdlib only, so it runs inside the runtime image;
non-zero exit, so a deployment gate can call it directly.

Verified by running it, not by inspection: the container starts, all six checks
pass against it, the reference CLI installs a package from it over HTTP, and
the checks fail correctly against a wrong --expect-migration — so
migration-at-head is a real check rather than a decorative one. Without
--expect-migration the check can only confirm the schema is stamped at all, and
says so rather than implying it verified the head.

Cluster-level checks a rapp contract also names — NetworkPolicies present,
external secrets ready, private-Service-only, live image digest match — are
properties of the deployment and belong to rapp-canned-prompts.

The digest rapp.yaml would pin does not exist yet. The image was built locally
and verified, but never pushed; that digest exists only once the image is
published to the fleet registry, which needs credentials and is outward-facing
enough not to do unasked. The follow-on sequence for rapp-canned-prompts is
recorded in the workplan.

CANP-WP-0006 is finished. Service tests 33, reference 105.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
This commit is contained in:
tegwick 2026-09-06 21:25:48 +02:00
parent 39b499bcec
commit f41d1b705f
6 changed files with 260 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

42
service/README.md
View file

@ -119,12 +119,42 @@ it cannot be attributed among several publishers. Until per-publisher identity
exists, a claim's `owner` is documentation rather than an access decision, and
the code says so where it matters.
## Image and smoke
```bash
make image # builds from the repo root; reference/ is a real dependency
make smoke BASE=http://... # service-level checks, exits non-zero on failure
```
The image is a two-stage `python:3.12-slim` build carrying no build toolchain,
running as a non-root user, writing nothing to disk — its state is the database.
It deliberately does **not** run migrations on start-up: a schema change is a
deployment step with its own rollback, not something that races between replicas.
`tools/smoke.py` asserts what can be known about a *running service*: liveness,
readiness, fleet health shape, the migration revision, and that the index and
registry are queryable. It is stdlib-only so it runs inside the runtime image,
and it exits non-zero so a deployment gate can call it directly.
Cluster-level checks a `rapp` contract also names — NetworkPolicies present,
external secrets ready, private-Service-only, live image digest match — are
properties of the deployment rather than of this process, and belong to
`rapp-canned-prompts`.
`--expect-migration` matters: without it the check can only confirm the schema
is stamped at all, and it says so rather than implying it verified the head.
## Status
`CANP-WP-0006` T01–T04 are done: skeleton, health surface, tenant-keyed schema
(migrations `0001`–`0002`), and the read and publish APIs. The HTTP registry
client in the CLI and the container image (T05–T06) are not built yet. T06
produces the image digest that `rapp-canned-prompts` needs to pin.
`CANP-WP-0006` is complete: skeleton and health surface, tenant-keyed schema
(migrations `0001`–`0002`), read and publish APIs, HTTP registries in the
reference CLI, and a verified container image with smoke checks.
Per-publisher identity is deferred, and is the main thing standing between this
and a service that several people can publish to.
**Not done, and needed before `rapp-canned-prompts`:** the image has been built
and verified locally but never pushed. `rapp.yaml` pins
`upstream_components.version` to a digest from the fleet's registry, and that
digest only exists once the image is published — an operator action needing
registry credentials.
**Per-publisher identity** remains deferred, and is the main thing between this
and a registry several people can publish to.