Record Observatory staging deployment gate (#156)
Some checks are pending
CI / lint-and-test (push) Waiting to run
Some checks are pending
CI / lint-and-test (push) Waiting to run
This commit is contained in:
twentyOne2x
GitHub
parent
53c8de0a19
commit
e4348a0071
2 changed files with 95 additions and 0 deletions
|
|
@ -0,0 +1,40 @@
|
||||||
|
{
|
||||||
|
"schema": "livingip.observatoryReadAdapterCurrentGate.v1",
|
||||||
|
"current_canary": "Authenticated GET /v1/claims/sample in GCP staging returns a provenance-bearing teleo_canonical claim, anonymous GET returns 401, and authenticated POST returns 405.",
|
||||||
|
"permission_profile": "approval_policy_never_with_unrestricted_filesystem_and_network",
|
||||||
|
"attempted_routes": [
|
||||||
|
{
|
||||||
|
"route": "merged GitHub Actions deployment with artifact-builder WIF",
|
||||||
|
"result": "image build, smoke, and push passed; deploy stopped because run.googleapis.com is disabled"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"route": "local billy@livingip.xyz gcloud user credential",
|
||||||
|
"result": "token refresh and service enable both stop at noninteractive Google reauthentication"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"route": "local application-default credential",
|
||||||
|
"result": "token refresh stops at noninteractive Google reauthentication"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"route": "other locally authenticated Google accounts",
|
||||||
|
"result": "valid tokens but no access to project teleo-501523"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"route": "fixed read-only GCP IAP status workflow",
|
||||||
|
"result": "WIF token exchange failed because the teleo-iap-operator provider target is missing or disabled"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"route": "local browser or computer-use session",
|
||||||
|
"result": "no browser or computer-use tool is exposed to this task; no foreground takeover was attempted"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"exact_gate": {
|
||||||
|
"first_infrastructure_gate": "Cloud Run Admin API run.googleapis.com is disabled in teleo-501523.",
|
||||||
|
"current_authorization_gate": "The only local account authorized for teleo-501523, billy@livingip.xyz, requires Google password or MFA reauthentication before project APIs and staging IAM resources can be changed.",
|
||||||
|
"alternate_private_operator_gate": "The read-only teleo-iap-operator WIF provider returns invalid_target and cannot reach its status operation."
|
||||||
|
},
|
||||||
|
"why_autonomous_repair_stops": "Google password or MFA reauthentication is a human-only credential boundary, and no authenticated project-admin browser or computer-use surface is available in this task.",
|
||||||
|
"clear_CTA": "Run `gcloud auth login billy@livingip.xyz --update-adc`, complete Google password or MFA, and then report `GCP reauth complete`.",
|
||||||
|
"next_non_user_action": "Enable the required staging APIs; create or verify the runtime service account, API-key secret, Cloud SQL IAM database user, and exact read-only role grants; deploy the retained immutable image; capture authenticated GET, anonymous 401, authenticated POST 405, SQL write-denial, exact service/database identity, and cleanup receipts.",
|
||||||
|
"production_boundary": "Do not change Vercel, production routing, Cloud SQL network exposure, or any write endpoint."
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,55 @@
|
||||||
|
{
|
||||||
|
"schema": "livingip.observatoryReadAdapterStagingReceipt.v1",
|
||||||
|
"status": "blocked_before_runtime_creation",
|
||||||
|
"required_runtime_tier": "T3_live_gcp_staging_api",
|
||||||
|
"current_runtime_tier": "below_T3_build_artifact_only",
|
||||||
|
"project_id": "teleo-501523",
|
||||||
|
"region": "europe-west6",
|
||||||
|
"service_name": "observatory-read-adapter-staging",
|
||||||
|
"database_name": "teleo_canonical",
|
||||||
|
"cloud_sql_instance": "teleo-501523:europe-west6:teleo-pgvector-standby",
|
||||||
|
"authorization_role": "kb_observatory_read",
|
||||||
|
"runtime_service_account": "sa-observatory-read-adapter@teleo-501523.iam.gserviceaccount.com",
|
||||||
|
"image": {
|
||||||
|
"revision": "53c8de0a1959a744e17888df1a70e935dfef0143",
|
||||||
|
"digest": "sha256:b5c9b2051559730cbb9003d74e5d8e577fa2f43f49b72577f251f2843a0650c5",
|
||||||
|
"artifact_registry_push": "pass",
|
||||||
|
"container_smoke": "pass",
|
||||||
|
"intentional_retained_resource": true
|
||||||
|
},
|
||||||
|
"workflow": {
|
||||||
|
"run_id": 29382683335,
|
||||||
|
"url": "https://github.com/living-ip/teleo-infrastructure/actions/runs/29382683335",
|
||||||
|
"build_job": "success",
|
||||||
|
"deploy_job": "failure",
|
||||||
|
"failure_class": "SERVICE_DISABLED",
|
||||||
|
"failure_detail": "run.googleapis.com is disabled in teleo-501523",
|
||||||
|
"authenticated_as": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com"
|
||||||
|
},
|
||||||
|
"live_receipts": {
|
||||||
|
"service_url": null,
|
||||||
|
"authenticated_get_sample": null,
|
||||||
|
"anonymous_get_401": null,
|
||||||
|
"authenticated_post_405": null,
|
||||||
|
"database_write_denial": null,
|
||||||
|
"database_identity": null
|
||||||
|
},
|
||||||
|
"negative_claims": {
|
||||||
|
"cloud_run_service_created": false,
|
||||||
|
"cloud_sql_public_exposure_changed": false,
|
||||||
|
"production_or_vercel_routing_changed": false,
|
||||||
|
"credentials_logged": false
|
||||||
|
},
|
||||||
|
"cleanup": {
|
||||||
|
"github_jobs_completed": true,
|
||||||
|
"local_observatory_test_containers": 0,
|
||||||
|
"local_observatory_test_images": 0,
|
||||||
|
"orphan_local_build_processes": 0,
|
||||||
|
"artifact_registry_image_retained_for_next_deploy": true
|
||||||
|
},
|
||||||
|
"proof_paths": [
|
||||||
|
"/private/tmp/observatory-read-adapter-run-29382683335/observatory-adapter-image/observatory-adapter-image.txt",
|
||||||
|
"/private/tmp/observatory-iap-status-29382844567/gcp-iap-operator-29382844567/result.json"
|
||||||
|
],
|
||||||
|
"claim_ceiling": "The immutable staging image exists, but no live API or database query receipt exists. T3 is not complete."
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue