From 01fb7ecdda08b44ec1b6ea05e4e76ec357fe36e4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 15:05:23 +0200 Subject: [PATCH] docs: record dark deployment preflight Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834 --- ...01-dark-deployment-preflight-2026-08-22.md | 74 +++++++++++++++++++ docs/production-cutover-plan.md | 13 ++++ workplans/SBOM-WP-0002-production-cutover.md | 5 ++ 3 files changed, 92 insertions(+) create mode 100644 docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md diff --git a/docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md b/docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md new file mode 100644 index 0000000..5ed360b --- /dev/null +++ b/docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md @@ -0,0 +1,74 @@ +# Dark deployment preflight — 2026-08-22 + +Evidence for `SBOM-WP-0002-T01`. This preflight made no caller switch and did +not create a production database, credential, namespace, workload, or Service. + +## Product artifact + +- Product commit: `0941a2e` (`feat: package dark deployment runtime`). +- Forgejo Actions: `image.yaml #1`, status `Success`, duration 54 seconds. +- Published image: + `forgejo.coulomb.social/coulomb/sbom-nexus@sha256:85245c395edc123cad9ad58f2b3d2443137e2dee132628b62307072e82d868dd`. +- Local product verification: Ruff passed; 13 tests passed and the conditional + PostgreSQL test skipped without its opt-in DSN. +- The image contains `alembic.ini` plus migration sources and successfully ran + `alembic upgrade head` as the image's non-root user. + +## Placement decision + +Read-only live inspection found four declarations on `platform-pg`: +`audit-core`, `core-hub`, `isolation-probe`, and `tenant-engine`. That is the +accepted cell ceiling. The dark deployment therefore targets the reviewed +`platform-pg-2` overflow cell. It does not request a ceiling exception. + +`apps-pg` has two of three declared consumer slots and healthy daily backups, +but its documented consumer path still uses static application credentials. +SBOM Nexus requires separate short-lived runtime and migration leases through +the canonical OpenBao database broker, so the package follows the +`rapp-postgres` declaration path instead. + +## Runtime package + +Repo Manager's canonical wrap flow produced `/home/worsch/rapp-sbom-nexus`. +The reviewed local package commit is `5749b81` and includes: + +- private Deployment and ClusterIP Service with no Ingress; +- immutable image digest pin; +- real `/state/health` startup/readiness/liveness probes; +- mounted `SBOM_NEXUS_DATABASE_URL_FILE`, never a DSN in Git; +- separate OpenBao runtime and migration ExternalSecrets; +- one-shot Alembic migration job for revision `0001`; +- default-deny plus DNS/PostgreSQL-only egress policies; +- PostgreSQL handoff for `platform-pg-2`, 12 runtime and 2 migration + connections, bounded timeouts, and 30-day retention; +- digest, PostgreSQL health, and migration-head live verification. + +Verification results: + +- package tests: 4 passed; +- family declaration: 14 declarations, 0 errors, one unrelated derived reef + projection warning; +- PostgreSQL consumer rendering: passed; +- Railiance01 server-side dry-run: all 11 resources admitted, with the dry-run + stream using the existing `default` namespace because a dry-run Namespace is + not persisted for later documents; +- no cluster resources were applied. + +## Governed gates + +Warden returned `founder_required` for both first-time operations: + +1. operator OIDC/MFA to create `coulomb/rapp-sbom-nexus` in Forgejo; +2. one-time secret provisioning for the `platform-pg-2` bootstrap and the + exact-scope SBOM Nexus OpenBao/External Secrets credential lane. + +No bypass was attempted and no credential value was printed, stored, or +written to a repository. State Hub handoffs: + +| Owner | Message | Requested result | +| --- | --- | --- | +| `rapp-postgres` | `bc19f295-84dd-43bb-a648-1f7baa85087b` | admit the overflow consumer, database/roles, backup, OpenBao roles and exact-scope token | +| `repo-manager` | `c24b56f4-90be-4d2e-bca8-4100ab4cc9e6` | publish and register the verified managed workload package after OIDC/MFA | + +`T01` remains in progress until those gates are satisfied, the dark workload is +healthy on PostgreSQL, and a restore is verified against the deployed topology. diff --git a/docs/production-cutover-plan.md b/docs/production-cutover-plan.md index 83a239b..567ede2 100644 --- a/docs/production-cutover-plan.md +++ b/docs/production-cutover-plan.md @@ -26,6 +26,19 @@ State Hub rows. | 6. Stabilize | Nexus | two successful daily fires and one Monday with weekly flood at zero | return façade flags to State Hub | | 7. Retire | Nexus | retention decision and final backup | restore retained State Hub snapshot store during window | +## Dark deployment placement + +The application is packaged separately as `rapp-sbom-nexus` and remains a +private `rail-kubernetes` workload on `reef-railiance`. The application image +is built from this repository and pinned by digest in the package. + +`platform-pg` is at its declared four-consumer ceiling. The reviewed database +handoff therefore targets the named `platform-pg-2` overflow cell rather than +quietly exceeding that ceiling. `apps-pg` still has one declared slot, but its +current consumer flow uses static application credentials; SBOM Nexus requires +the canonical OpenBao runtime/migration lease split. The database owner must +admit and provision the overflow consumer before the dark apply. + ## Contract ownership ### SBOM Nexus diff --git a/workplans/SBOM-WP-0002-production-cutover.md b/workplans/SBOM-WP-0002-production-cutover.md index bd09e72..61d4369 100644 --- a/workplans/SBOM-WP-0002-production-cutover.md +++ b/workplans/SBOM-WP-0002-production-cutover.md @@ -37,11 +37,16 @@ bounded daily catch-up before retiring State Hub SBOM ownership. id: SBOM-WP-0002-T01 status: progress priority: high +needs_human: true +intervention_note: "Warden requires operator OIDC/MFA for first rapp-sbom-nexus Forgejo repository creation and one-time secret provisioning for platform-pg-2/OpenBao." state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686" ``` Provision database credentials through the governed route, migrate schema, deploy the API without callers, and capture health plus backup/restore evidence. +Image publication, package rendering, family validation, and server-side dry-run +are complete; see +`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`. ## Synchronize repository projections