tegwick
8e13cb7b0e
Some checks failed
Use-case regression gate / usecase-regressions (push) Failing after 2m1s
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a11538-05ea-7b63-b3c7-a2df5f38898d
185 lines
11 KiB
Markdown
185 lines
11 KiB
Markdown
# Authenticated space and page visuals — release review
|
|
|
|
CSOC-WP-0008-T05. **Current Helm revision 15**, including Spaces-list previews;
|
|
user review pending. Original private-image delivery deployed as revision14.
|
|
Exact live decision: `3f959ed2-4163-4fa5-9f88-f80b2a3d1b89` (founder approved).
|
|
|
|
## User-visible behavior
|
|
|
|
Imported space and page covers render from the local content volume. Markdown
|
|
image/link references beginning `assets/`, `./assets/` or `../assets/` use the
|
|
same authenticated image route. The stored Markdown and existing rich/plain
|
|
clipboard payloads remain unchanged; private app images are not automatically
|
|
embedded in external email messages.
|
|
|
|
Space owners and viewers can read those images. Login, existing authorization
|
|
and exact tenant/membership checks run on every image request; outsiders,
|
|
cross-tenant grants, revoked members and archived spaces cannot read them.
|
|
Images are not public static files and responses use `private, no-store`.
|
|
|
|
The route accepts PNG, JPEG, GIF and WebP with matching file signatures. It
|
|
rejects SVG/HTML, unsupported formats, path traversal, symlinks and special files.
|
|
No remote image proxy or image upload is introduced. External cover references
|
|
remain metadata rather than triggering new remote requests. Existing body URLs
|
|
and the original clipboard export retain their previous behavior.
|
|
|
|
Visual duplication copies a regular file only from the source space's assets.
|
|
It refuses unsafe paths, symlinks and destination asset overwrite. Source notes
|
|
and covers remain intact. Cross-space body-linked asset copying, incoming-link
|
|
rewriting, content revisions/concurrency and tenant-keyed directories remain
|
|
open T04/T05 work. Ambiguous same-slug database rows fail closed for image reads
|
|
until that storage work is complete; this is not a multi-tenant storage claim.
|
|
|
|
## Immutable artifact and validation
|
|
|
|
- Source, committed and pushed:
|
|
`017b917e2158330889c3efd744cf4523105bd546`.
|
|
- Published image:
|
|
`forgejo.coulomb.social/coulomb/coulomb-social@sha256:0e235abc33a1c5613c0e2c9a0f767c871d0fbed6695973ae17cfdcb2dedaaafa`.
|
|
- `make check`: **129 passed**, full Ruff and mandatory UC-008 browser coverage.
|
|
Protected fast tests verify image bytes/access denial. Browser checks load a
|
|
synthetic one-pixel Visual before and after duplication and for the reader;
|
|
an outsider's direct image request returns 404. Existing edit/rename/reopen
|
|
and exact rich/plain/fallback clipboard tests still pass.
|
|
- Packaged image smoke: non-root UID10001, read-only root, temporary synthetic
|
|
content/database and disabled network; authenticated exact image bytes match.
|
|
- Owning Helm chart lint passes. Parsed comparison of live release manifests
|
|
against the proposed render finds exactly the app container image change,
|
|
across the same three resources. Cluster UID verified:
|
|
`a553c742-0115-43d4-99a4-a5ca56fe0786`. Server dry-run accepts the proposal.
|
|
- Read-only live inspection: previous digest
|
|
`sha256:dbeaeda1a03622a91683f8db3c1f498e8bf43417cdb077ec740c56f0489baff6`,
|
|
one configured/available replica; 37 local JPEG assets, zero unsupported or
|
|
mismatched signatures and zero ambiguous space slugs. No private file names,
|
|
bodies, images or account data emitted into this receipt.
|
|
|
|
Temporary local review manifests:
|
|
`/tmp/csoc-private-visual-release-x5la6gi7/{previous,proposed}.yaml`.
|
|
No owner repository configuration or live runtime was changed during preparation.
|
|
|
|
## Exact rollout and rollback
|
|
|
|
WP-0008-T01 requires founder approval of the exact live change,
|
|
ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED. This packet is
|
|
the concrete image-only proposal for that gate.
|
|
|
|
After approval, recheck the current release, cluster identity, PVC and headroom;
|
|
take a fresh paired database/content snapshot with paused writers and resume
|
|
the app. The existing snapshot helper is pinned to the current old image and
|
|
must refuse unexpected runtime drift. Preserve artifact hashes privately and
|
|
verify the pair before proceeding.
|
|
|
|
Fold the new source tag/digest into the owning railiance-apps values file, repeat
|
|
server dry-run and parsed image-only comparison, then use the existing atomic,
|
|
waited Helm upgrade under single-writer Recreate. Expect a brief app interruption;
|
|
no issuer/mailbox restart, schema migration, content edit or grant change is
|
|
included. Snapshot custody/retention remains T02 work.
|
|
|
|
Verify health, immutable running image, authenticated space/page covers and
|
|
viewer/outsider denial through synthetic or read-only checks; compare stored
|
|
file hashes with the paired point. Do not alter productive protocols for tests.
|
|
If rollout/read checks fail, restore the prior image and confirm health; retain
|
|
the paired recovery point without restoring production data automatically.
|
|
|
|
After successful rollout, the founder reviews imported cover/body-image display
|
|
and duplicate/reopen behavior on app.coulomb.social. Local browser/image success
|
|
does not mark T05/T09 transfer accepted or authorize Bubble retirement.
|
|
|
|
## Approved deployment receipt
|
|
|
|
Founder explicitly approved: “I approve, go on please.” The decision is
|
|
resolved for the exact image, paired backup and brief single-writer upgrade.
|
|
Fresh preflight confirms the old image, one available replica, Bound retained
|
|
PVC, Recreate, pinned cluster identity and Ready node without pressure. CPU
|
|
requests 3455m/4000m; memory requests 9440Mi (59%).
|
|
|
|
Paired capture started 2026-10-07T10:43:30Z with writers paused; took 57.74
|
|
seconds and resumed the app. Database archive 50087 bytes SHA256
|
|
`8906abccf35b2ae8de66d7c9b6ee77b8341e90a2d1a1e57623e815e610b9c40d`;
|
|
content archive 2001238 bytes SHA256
|
|
`ef9f4c85d2257486666adb1e2d01fc601ad9ae809af5e05f40919e5f9dd2231d`.
|
|
Both artifact hashes verified after private transfer. Node/workstation temporary
|
|
custody remains a T02 retention/scheduling gap, not durable backup acceptance.
|
|
|
|
This actual production pair restored into isolated Docker PostgreSQL on an
|
|
internal network with no published ports: 13 tables, 104 rows, sequence state
|
|
and all 75 content hashes match; measured restore 4.23 seconds. The new image
|
|
renders all 38 restored pages and serves all 38 cover references with matching
|
|
bytes. Synthetic viewer image reads pass, viewer writes are denied, and outsider
|
|
page/image reads are denied. Private restored files retain mode0640 under the
|
|
workstation UID1000; the isolated check uses that non-root file owner. This
|
|
does not change production UID10001 or ownership. Rehearsal database/network
|
|
removed afterward; private artifacts/restore receipt retained for T02 custody.
|
|
|
|
Owning railiance-apps commit `2e95944` pins tag `017b917e2158` and the approved
|
|
digest; the tag is published with that same digest. Its reviewed source archive
|
|
was staged on the node. Fresh live-manifest parsed comparison, pinned cluster
|
|
identity, kubectl server dry-run and Helm server dry-run passed. All 75 content
|
|
files still matched the paired point immediately before upgrade.
|
|
|
|
Node Helm atomic/wait upgrade completed as revision **14**, status deployed,
|
|
one available replica and exact approved digest; measured upgrade 20.66 seconds.
|
|
The prior image remains available for rollback. No rollback, production data
|
|
restore, schema, Secret, issuer, mailbox, PVC, grant or content change occurred.
|
|
|
|
Read-only in-pod checks through the deployed views verify the existing owner's
|
|
38 cover references, rendered cover template and unchanged single owner grant.
|
|
An unsaved in-memory same-tenant outsider gets image404; no production identity,
|
|
session or grant is created for the probe. Production UID10001 reads each image
|
|
with private/no-store and matching bytes. All 75 stored file hashes match the
|
|
paired point. Anonymous public image access redirects to login302; public
|
|
health/static200 and served clipboard JavaScript equals tested source.
|
|
|
|
The snapshot helper now pins this live digest: seven focused snapshot/restore
|
|
safety tests pass and its fresh server dry-run succeeds without pausing writers.
|
|
Original full release gate:129passed including actual browser Visual loading,
|
|
duplication/edit/rename/clipboard and reader/outsider denial. T01/T02/T04/T05/T09
|
|
remain open for their broader requirements and interactive user acceptance.
|
|
|
|
## Founder review and Spaces-list correction
|
|
|
|
Founder reports: “The visual shows on the page itself but not in the spaces
|
|
list entries.” Page Visual visibility is confirmed; the list preview remained
|
|
a concrete T05/T09 gap. Correct that omitted rendering within the already
|
|
approved private-Visual image-only upgrade scope and this direct founder review.
|
|
|
|
The Spaces list now renders each visible space's local cover in its existing
|
|
entry, using the same private image URL and membership-filtered query. The
|
|
underlying space metadata, stored content, clipboard and image access policy
|
|
remain in use. Broader UI framework work is not part of this correction.
|
|
|
|
Source `881a61d10798`, owning pin `f5fc9ea`, published digest
|
|
`sha256:91673ba7625f905c7a4d0c3d52b45ccc7e7746f387d1e84aab331d68994c5df9`.
|
|
Full `make check`:129passed, including writer/viewer Spaces-list image loading
|
|
and outsider exclusion. Parallel cover requests exposed the live-test server's
|
|
shared in-memory SQLite cursor race; the isolated test database is now a
|
|
temporary file per run/worker with separate request connections. Fast streaming
|
|
tests consume Django Client's closing iterator once rather than calling close
|
|
again. No regression check is skipped, disabled or serialized. The staged
|
|
commit preceded inspection of one failed run; all fixes and the complete passing
|
|
gate were in place before this image was built, published or deployed.
|
|
|
|
Fresh paired capture started2026-10-07T11:56:43Z, took56.03seconds, app resumed.
|
|
Database archive50087bytes SHA256
|
|
`72ee616dc1d5375e0c48100c89697aad15c15cef9c3b7c9f4f3208b8ac96c5a0`;
|
|
content archive2001238bytes SHA256
|
|
`f5edb609db9fe4feb6e81f4e73ee97ab8040502f561b285391ce3a926dadd6ed`.
|
|
Private copied artifacts hash-match. Isolated restore13tables/104rows/sequences/
|
|
75files match, measured4.14seconds. New packaged image renders the actual
|
|
restored space cover in owner and synthetic viewer list entries; image reads
|
|
pass and outsider list excludes it. Isolated internal network has no published
|
|
ports; rehearsal DB/network removed afterward. Temporary backup custody remains T02.
|
|
|
|
Reviewed owner source archive staged on node; fresh cluster/image/readiness and
|
|
pressure checks, exact parsed image-only manifest comparison, kubectl/Helm
|
|
server dry-run and all75pre-upgrade file hashes pass. Helm atomic/wait revision15
|
|
completed20.58seconds, app1/1 at the exact new digest. No rollback required.
|
|
|
|
Read-only deployed core view verifies owner list preview and its route; private
|
|
preview bytes match the stored space Visual. An unsaved same-tenant outsider's
|
|
list has no preview/URL. Production UID10001, single explicit owner grant and
|
|
all75file hashes unchanged; no production probe identities/sessions/grants
|
|
created. Public health/static200; served clipboard JavaScript unchanged.
|
|
Snapshot-helper pin follows this release;7focused recovery tests and fresh
|
|
server dry-run pass. User list-preview confirmation remains T09; no complete
|
|
workflow acceptance, durable backup closure or Bubble retirement inferred.
|