From e83c8751502ba7d9ae03a879744e8f0356905c52 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 18:24:44 +0200 Subject: [PATCH] docs: close production deployment and import gates Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834 --- ...ository-projection-rehearsal-2026-08-22.md | 9 +++ ...03-production-history-import-2026-08-22.md | 76 +++++++++++++++++++ workplans/SBOM-WP-0002-production-cutover.md | 31 +++++--- 3 files changed, 106 insertions(+), 10 deletions(-) create mode 100644 docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md diff --git a/docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md b/docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md index abaa871..3b05d71 100644 --- a/docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md +++ b/docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md @@ -39,6 +39,15 @@ never-attempted repositories, ordered deterministically by slug: Production apply remains gated on the dark PostgreSQL runtime in `SBOM-WP-0002-T01`. +## Production result + +After T01 became healthy, the same path synchronized all 120 projections into +the private PostgreSQL-backed runtime: 120 matched, with zero missing, +mismatched, or extra rows. The snapshot count remained zero. The bounded query +again selected exactly three of 116 active repositories. Full production and +history-import evidence is recorded in +`SBOM-WP-0002-T03-production-history-import-2026-08-22.md`. + ## Verification - `uv run ruff check src tests scripts`: pass diff --git a/docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md b/docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md new file mode 100644 index 0000000..64a641d --- /dev/null +++ b/docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md @@ -0,0 +1,76 @@ +# SBOM-WP-0002 T01–T03 production evidence — 2026-08-22 + +## Dark runtime + +SBOM Nexus is deployed privately in namespace `sbom-nexus` with no Ingress and +no admitted caller namespace. The live image is: + +`forgejo.coulomb.social/coulomb/sbom-nexus@sha256:62929abc91bd7ef2b141f6801171b4d5edae81b625ded4a133196f5da14228f4` + +Both runtime and migration ExternalSecrets report `SecretSynced=True`, Alembic +revision `0001` is at head, and `/state/health` reports connected PostgreSQL. +`rapp-sbom-nexus make verify-live` confirmed the digest, health, migration head, +and that no secret values were observed. + +The first deployment exposed a migration-ownership defect: objects were owned +by an expiring migration login, so runtime health failed with PostgreSQL +`permission denied for table repositories`. Because the target was new and had +no SBOM snapshots, the four objects were reassigned to the durable +`sbom_nexus_owner`, existing runtime grants were reconciled, and the product was +changed to issue `SET ROLE sbom_nexus_owner` before all future PostgreSQL +migrations. Nineteen tests pass with one conditional PostgreSQL skip. The fixed +image and package were published and redeployed before projection or history +data was loaded. + +During the attended OIDC operation, the first OpenBao CLI invocation printed a +platform-admin token despite the intended metadata-only flow. That token was +immediately revoked with `bao token revoke -self` before provisioning. A second +login used `-no-print`; only its `platform-admin`, renewable, and TTL metadata +was verified. No token value is retained in Git, State Hub, or this evidence. + +Database-owner receipt `6779250b-15a2-4a28-a5fa-7f1e37a97f73` confirms: + +- `platform-pg-2` 1/1 Ready with continuous archiving healthy; +- post-migration backup ID `20260822T160352` completed at WAL + `00000001000000000000000C`; +- scratch restore became Ready in 51 seconds and matched production schema + owner, all four relation owners, runtime SELECT privileges, Alembic revision, + row counts, statement timeout, idle transaction timeout, and search path; +- the actual dynamic runtime lease passed SELECT and denied CREATE TABLE with + SQLSTATE `42501`; +- the scratch namespace and copied credential were deleted after proof. + +## Repository projection + +The production projection-only sync selected explicit host id `bnt-lap001` and +reconciled exactly: + +| Measure | Result | +| --- | ---: | +| Source/target repositories | 120 / 120 | +| Active / inactive | 116 / 4 | +| Missing / mismatched / extra | 0 / 0 / 0 | +| Snapshots after projection sync | 0 | + +The production `limit=3` catch-up query selected exactly three repositories in +slug order. Checkout availability is false inside the cluster because the +workstation paths are projections and are not mounted into the private runtime; +future scanners must submit evidence or run where the checkout exists. + +## Historical import and reconciliation + +An empty-target backup existed before import. The read-only preview found 22 +snapshots across 18 repositories with 3,123 entries. The production import then +reported: + +- 22 imported snapshots; +- 22/22 legacy snapshot identifiers matched; +- 3,123/3,123 entries matched; +- zero missing or mismatched snapshots; +- all 19 licence groups matched; +- direct-production copyleft count 4 on both source and target. + +The importer was run a second time and returned `already_present=22` with the +same exact reconciliation, proving production idempotency. Sampled repository +views for `activity-core`, `markitect-tool`, and `railiance-cluster` returned +their imported latest snapshots. No caller route was switched during T01–T03. diff --git a/workplans/SBOM-WP-0002-production-cutover.md b/workplans/SBOM-WP-0002-production-cutover.md index fb7753c..7bd0776 100644 --- a/workplans/SBOM-WP-0002-production-cutover.md +++ b/workplans/SBOM-WP-0002-production-cutover.md @@ -35,10 +35,8 @@ bounded daily catch-up before retiring State Hub SBOM ownership. ```task id: SBOM-WP-0002-T01 -status: progress +status: done priority: high -needs_human: true -intervention_note: "Warden requires an attended founder act for the first platform-pg-2 OpenBao database connection, SBOM Nexus dynamic roles/policies, and renewable External Secrets parent token. The database owner must also repair the governed backup credential/policy after a live S3 HeadBucket 403." state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686" ``` @@ -47,15 +45,21 @@ deploy the API without callers, and capture health plus backup/restore evidence. Image publication, package rendering, family validation, and server-side dry-run are complete; see `docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`. -The overflow cell is now 1/1 Ready, but continuous archiving and its first base -backup fail closed on an S3 `HeadBucket` 403. Database-owner work is tracked by -`RAPP-POSTGRES-WP-0005`; no caller or Nexus runtime has been enabled. +The overflow cell initially failed closed on an S3 `HeadBucket` 403. The +database owner repaired that path under `RAPP-POSTGRES-WP-0005`; no caller was +enabled while the gate was open. + +Completed with the private runtime healthy on PostgreSQL at migration head, +dynamic runtime/migration credentials synchronized, a successful governed +backup, 51-second scratch restore, runtime DDL denial, and immutable image +verification. See +`docs/evidence/SBOM-WP-0002-T03-production-history-import-2026-08-22.md`. ## Synchronize repository projections ```task id: SBOM-WP-0002-T02 -status: progress +status: done priority: high state_hub_task_id: "22cbb75f-d82f-5b47-9fef-27bde3b410d5" ``` @@ -70,11 +74,14 @@ runtime from T01. The isolated rehearsal reconciled all 120 source projections and selected exactly the oldest three of 116 active repositories; see `docs/evidence/SBOM-WP-0002-T02-repository-projection-rehearsal-2026-08-22.md`. +Completed in production with 120/120 projections reconciled and zero snapshots +created by the projection operation. + ## Import and reconcile State Hub history ```task id: SBOM-WP-0002-T03 -status: wait +status: done priority: high state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171" ``` @@ -82,11 +89,15 @@ state_hub_task_id: "49bd74a5-d806-5d8e-9d75-0d465b380171" Depends on T01/T02. Back up the empty target, run the idempotent importer, and retain an exact reconciliation report before any caller switch. +Completed in production: 22 snapshots, 18 repositories, and 3,123 entries +reconciled exactly; licence groups and direct copyleft count matched; the second +run returned `already_present=22`. No caller was switched. + ## Cut over State Hub compatibility façade ```task id: SBOM-WP-0002-T04 -status: wait +status: todo priority: high state_hub_task_id: "e7681dce-e3b6-52d1-bf13-92595b082b09" ``` @@ -98,7 +109,7 @@ reversible flags; retarget dashboard, MCP, CLI, summary, DoI, and onboarding. ```task id: SBOM-WP-0002-T05 -status: wait +status: todo priority: medium state_hub_task_id: "59f83f01-13bc-5a63-bb0b-bf527047762e" ```