diff --git a/docs/gcp-leoclean-nosend-preflight.md b/docs/gcp-leoclean-nosend-preflight.md index b7066c9..8444616 100644 --- a/docs/gcp-leoclean-nosend-preflight.md +++ b/docs/gcp-leoclean-nosend-preflight.md @@ -7,8 +7,9 @@ the separately reviewed no-send service package. It creates one revision-bound receipt and does not deploy the service. The checker validates the exact project, VM, machine type, attached service -account, exact boot-disk attachment and architecture, private-only VM -VPC/subnet attachment, Private Google Access, immutable Docker Artifact +account, exact `e2-standard-4` machine type, boot-disk attachment and +architecture, private-only VM attachment to `teleo-staging-europe-west6` +(`10.60.0.0/20`), Private Google Access, immutable Docker Artifact Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host architecture, Docker server, Docker storage floor, unused service/container names, and private TCP/5432 reachability from the VM. diff --git a/docs/workstreams/gcp-leoclean/goals.md b/docs/workstreams/gcp-leoclean/goals.md index 93ef22a..d4ce310 100644 --- a/docs/workstreams/gcp-leoclean/goals.md +++ b/docs/workstreams/gcp-leoclean/goals.md @@ -72,6 +72,14 @@ cut over safely and retire the VPS after soak. reading secrets, logging into PostgreSQL, deploying, or restarting. Its bounded IAP/SSH path uses a fixed remote command and a maximum five-minute key lifetime, but no live run is currently authorized. +- Historical only: the superseded preflight branch records an earlier live + observation of `e2-standard-4` on `teleo-staging-europe-west6` + (`10.60.0.0/20`) with an external IPv4 attachment. That observation is not + current-revision proof and has not been refreshed in this slice. The checker + intentionally fails while any public attachment remains. +- The older provisioning baseline names `e2-standard-2` and + `teleo-staging-subnet`; reconciling that declarative baseline is a separate + infrastructure change, not part of this preflight implementation. - Not yet live-proven: staging VM/container engine, IAM/Secret Manager, Cloud SQL effective identity, restart behavior, or model/database parity. diff --git a/ops/check_gcp_leoclean_nosend_preflight.py b/ops/check_gcp_leoclean_nosend_preflight.py index 48db655..4c52abb 100644 --- a/ops/check_gcp_leoclean_nosend_preflight.py +++ b/ops/check_gcp_leoclean_nosend_preflight.py @@ -32,14 +32,14 @@ CRITICAL_TRACKED_PATHS = ( "hermes-agent/leoclean-bin/cloudsql_memory_tool.py", ) REGION = package.ZONE.rsplit("-", 1)[0] -MACHINE_TYPE = "e2-standard-2" +MACHINE_TYPE = "e2-standard-4" MINIMUM_BOOT_DISK_GB = 80 MINIMUM_DOCKER_FREE_BYTES = 10 * 1024**3 MINIMUM_DOCKER_MAJOR = 24 SSH_KEY_LIFETIME = "5m" NETWORK = "teleo-staging-net" -SUBNET = "teleo-staging-subnet" -SUBNET_CIDR = ipaddress.ip_network("10.70.0.0/24") +SUBNET = "teleo-staging-europe-west6" +SUBNET_CIDR = ipaddress.ip_network("10.60.0.0/20") CLOUDSQL_INSTANCE = "teleo-pgvector-standby" ARTIFACT_REPOSITORY = "teleo" @@ -190,7 +190,7 @@ def _instance_readback(runner: Runner) -> dict[str, Any]: package.PROJECT, "--zone", package.ZONE, - "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)", + "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)", ], runner, ) diff --git a/tests/test_gcp_leoclean_nosend_preflight.py b/tests/test_gcp_leoclean_nosend_preflight.py index 515dcff..59aa584 100644 --- a/tests/test_gcp_leoclean_nosend_preflight.py +++ b/tests/test_gcp_leoclean_nosend_preflight.py @@ -27,7 +27,7 @@ def live_fixtures() -> dict[str, object]: "zone": "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a", "machineType": ( "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/" - "machineTypes/e2-standard-2" + "machineTypes/e2-standard-4" ), "cpuPlatform": "Intel Broadwell", "serviceAccounts": [ @@ -49,9 +49,9 @@ def live_fixtures() -> dict[str, object]: ), "subnetwork": ( "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6/" - "subnetworks/teleo-staging-subnet" + "subnetworks/teleo-staging-europe-west6" ), - "networkIP": "10.70.0.2", + "networkIP": "10.60.0.2", "accessConfigs": [], "ipv6AccessConfigs": [], "stackType": "IPV4_ONLY", @@ -71,10 +71,10 @@ def live_fixtures() -> dict[str, object]: ], }, "subnet": { - "name": "teleo-staging-subnet", + "name": "teleo-staging-europe-west6", "region": "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6", "network": "https://www.googleapis.com/compute/v1/projects/teleo-501523/global/networks/teleo-staging-net", - "ipCidrRange": "10.70.0.0/24", + "ipCidrRange": "10.60.0.0/20", "privateIpGoogleAccess": True, }, "artifact": { @@ -202,7 +202,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None: "teleo-501523", "--zone", "europe-west6-a", - "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)", + "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)", ], [ "gcloud", @@ -222,7 +222,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None: "networks", "subnets", "describe", - "teleo-staging-subnet", + "teleo-staging-europe-west6", "--project", "teleo-501523", "--region",