From e4348a0071f97e3962bdfbaf69a00b95b002df36 Mon Sep 17 00:00:00 2001 From: twentyOne2x Date: Wed, 15 Jul 2026 03:59:36 +0200 Subject: [PATCH] Record Observatory staging deployment gate (#156) --- .../gcp-staging-current-gate.json | 40 ++++++++++++++ .../gcp-staging-live-attempt-redacted.json | 55 +++++++++++++++++++ 2 files changed, 95 insertions(+) create mode 100644 docs/reports/observatory-read-adapter/gcp-staging-current-gate.json create mode 100644 docs/reports/observatory-read-adapter/gcp-staging-live-attempt-redacted.json diff --git a/docs/reports/observatory-read-adapter/gcp-staging-current-gate.json b/docs/reports/observatory-read-adapter/gcp-staging-current-gate.json new file mode 100644 index 0000000..f87f8cb --- /dev/null +++ b/docs/reports/observatory-read-adapter/gcp-staging-current-gate.json @@ -0,0 +1,40 @@ +{ + "schema": "livingip.observatoryReadAdapterCurrentGate.v1", + "current_canary": "Authenticated GET /v1/claims/sample in GCP staging returns a provenance-bearing teleo_canonical claim, anonymous GET returns 401, and authenticated POST returns 405.", + "permission_profile": "approval_policy_never_with_unrestricted_filesystem_and_network", + "attempted_routes": [ + { + "route": "merged GitHub Actions deployment with artifact-builder WIF", + "result": "image build, smoke, and push passed; deploy stopped because run.googleapis.com is disabled" + }, + { + "route": "local billy@livingip.xyz gcloud user credential", + "result": "token refresh and service enable both stop at noninteractive Google reauthentication" + }, + { + "route": "local application-default credential", + "result": "token refresh stops at noninteractive Google reauthentication" + }, + { + "route": "other locally authenticated Google accounts", + "result": "valid tokens but no access to project teleo-501523" + }, + { + "route": "fixed read-only GCP IAP status workflow", + "result": "WIF token exchange failed because the teleo-iap-operator provider target is missing or disabled" + }, + { + "route": "local browser or computer-use session", + "result": "no browser or computer-use tool is exposed to this task; no foreground takeover was attempted" + } + ], + "exact_gate": { + "first_infrastructure_gate": "Cloud Run Admin API run.googleapis.com is disabled in teleo-501523.", + "current_authorization_gate": "The only local account authorized for teleo-501523, billy@livingip.xyz, requires Google password or MFA reauthentication before project APIs and staging IAM resources can be changed.", + "alternate_private_operator_gate": "The read-only teleo-iap-operator WIF provider returns invalid_target and cannot reach its status operation." + }, + "why_autonomous_repair_stops": "Google password or MFA reauthentication is a human-only credential boundary, and no authenticated project-admin browser or computer-use surface is available in this task.", + "clear_CTA": "Run `gcloud auth login billy@livingip.xyz --update-adc`, complete Google password or MFA, and then report `GCP reauth complete`.", + "next_non_user_action": "Enable the required staging APIs; create or verify the runtime service account, API-key secret, Cloud SQL IAM database user, and exact read-only role grants; deploy the retained immutable image; capture authenticated GET, anonymous 401, authenticated POST 405, SQL write-denial, exact service/database identity, and cleanup receipts.", + "production_boundary": "Do not change Vercel, production routing, Cloud SQL network exposure, or any write endpoint." +} diff --git a/docs/reports/observatory-read-adapter/gcp-staging-live-attempt-redacted.json b/docs/reports/observatory-read-adapter/gcp-staging-live-attempt-redacted.json new file mode 100644 index 0000000..8c50ace --- /dev/null +++ b/docs/reports/observatory-read-adapter/gcp-staging-live-attempt-redacted.json @@ -0,0 +1,55 @@ +{ + "schema": "livingip.observatoryReadAdapterStagingReceipt.v1", + "status": "blocked_before_runtime_creation", + "required_runtime_tier": "T3_live_gcp_staging_api", + "current_runtime_tier": "below_T3_build_artifact_only", + "project_id": "teleo-501523", + "region": "europe-west6", + "service_name": "observatory-read-adapter-staging", + "database_name": "teleo_canonical", + "cloud_sql_instance": "teleo-501523:europe-west6:teleo-pgvector-standby", + "authorization_role": "kb_observatory_read", + "runtime_service_account": "sa-observatory-read-adapter@teleo-501523.iam.gserviceaccount.com", + "image": { + "revision": "53c8de0a1959a744e17888df1a70e935dfef0143", + "digest": "sha256:b5c9b2051559730cbb9003d74e5d8e577fa2f43f49b72577f251f2843a0650c5", + "artifact_registry_push": "pass", + "container_smoke": "pass", + "intentional_retained_resource": true + }, + "workflow": { + "run_id": 29382683335, + "url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29382683335", + "build_job": "success", + "deploy_job": "failure", + "failure_class": "SERVICE_DISABLED", + "failure_detail": "run.googleapis.com is disabled in teleo-501523", + "authenticated_as": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com" + }, + "live_receipts": { + "service_url": null, + "authenticated_get_sample": null, + "anonymous_get_401": null, + "authenticated_post_405": null, + "database_write_denial": null, + "database_identity": null + }, + "negative_claims": { + "cloud_run_service_created": false, + "cloud_sql_public_exposure_changed": false, + "production_or_vercel_routing_changed": false, + "credentials_logged": false + }, + "cleanup": { + "github_jobs_completed": true, + "local_observatory_test_containers": 0, + "local_observatory_test_images": 0, + "orphan_local_build_processes": 0, + "artifact_registry_image_retained_for_next_deploy": true + }, + "proof_paths": [ + "/private/tmp/observatory-read-adapter-run-29382683335/observatory-adapter-image/observatory-adapter-image.txt", + "/private/tmp/observatory-iap-status-29382844567/gcp-iap-operator-29382844567/result.json" + ], + "claim_ceiling": "The immutable staging image exists, but no live API or database query receipt exists. T3 is not complete." +}