teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
783 commits 38 branches 1 tag 20 MiB
Commit graph

109 commits

Author SHA1 Message Date
fwazb
7e1d57ef6f Drop staging function before create instead of replace
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
Cloud SQL's postgres (cloudsqlsuperuser) cannot CREATE OR REPLACE a
function owned by another role. Drop both overloads first so a plain
CREATE works regardless of prior ownership state.

Also removes the dynamic ACL normalization block — a freshly created
function has no stale ACLs to scan and revoke.
 2026-07-24 10:25:48 -07:00
fwazb
eece69cd70 Fix Cloud SQL staging-function provisioning order 
Cloud SQL's postgres role is cloudsqlsuperuser, not a true superuser.
After ALTER FUNCTION ... OWNER TO leoclean_kb_stage_owner, it can no
longer revoke ACLs on the transferred function:

  ERROR: permission denied for function stage_leoclean_proposal

Reorder so ACL normalization and the runtime GRANT happen while postgres
still owns the function, then transfer ownership. Identical end state.

Observed on teleo-pgvector-standby during M2 Step 4 provisioning
(BOOTSTRAP_EXIT=3 at SQL line 800).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-07-23 22:41:24 -07:00
fwazb
75ee585814 Normalize Cloud SQL identity addresses 2026-07-23 18:56:39 -07:00
fwazb
e5a5cc0ca2 Converge leoclean no-send installation state 2026-07-23 16:25:17 -07:00
fwazb
445ffdc9fc Preserve no-send IAP failure receipts 2026-07-23 14:29:47 -07:00
fwazb
d0e8286636 Handle canonical Docker capability names 2026-07-23 13:27:38 -07:00
fwazb
4df77c7c6e Expose bounded container contract failures 2026-07-23 13:01:55 -07:00
fwazb
a1a1aea16f Report no-send verifier startup failures 2026-07-23 12:06:35 -07:00
fwazb
f0719613b6 Harden leoclean first-start readiness 2026-07-23 10:41:40 -07:00
fwazb
73d0e30175 Handle systemd 252 absent command properties 2026-07-23 00:52:00 -07:00
fwazb
77ab46b956 Handle systemd 252 EnvironmentFiles readback 2026-07-22 23:19:13 -07:00
fwazb
605aa6c36d Preserve IAP request member modes 2026-07-22 22:26:45 -07:00
fwazb
963ab34584 Harden leoclean runtime authority checks 2026-07-22 20:15:53 -07:00
fwazb
b9081a537c Add fail-closed GCP no-send IAP runner 2026-07-22 18:24:17 -07:00
fwazb
6d7ea14bfb Bind no-send database proof to container identity 2026-07-22 15:24:54 -07:00
fwazb
be002d67b0 Normalize empty release context directories 2026-07-22 14:06:38 -07:00
fwazb
e03488ba0b Preserve scoped runtime ACLs across prerequisite reruns 2026-07-22 12:52:52 -07:00
twentyOne2x
7aabfa4ab8 fix: make no-send release publication repeatable 2026-07-22 06:07:24 +02:00
fwazb
508e1bdb28 Handle Cloud SQL provider database residuals 2026-07-21 19:01:34 -07:00
twentyOne2x
083bd747be Merge final Cloud SQL boundary into source-first V3 integration 2026-07-22 03:21:50 +02:00
twentyOne2x
6e4287987a Pin reviewed Leoclean runtime SQL source 2026-07-22 03:16:58 +02:00
fwazb
87580c219f Fail closed on leoclean runtime SQL 2026-07-21 17:56:06 -07:00
twentyOne2x
0c275b4bbb Merge current main into source-first V3 integration 2026-07-22 02:47:56 +02:00
fwazb
a8a1e7958b Merge current main into PR 221 2026-07-21 17:04:38 -07:00
fwazb
699edb935f Merge current main into PR 219 2026-07-21 16:50:43 -07:00
twentyOne2x
a03c6bc2f5 Harden V3 transition replay across timezones 2026-07-22 01:10:14 +02:00
fwazb
e850f0e6bd Harden Cloud SQL staging runtime boundary 2026-07-21 13:44:43 -07:00
fwazb
832f0c3f47 Support Cloud SQL scoped role provisioning
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details
2026-07-21 12:58:07 -07:00
twentyOne2x
5b103285ee Harden staging image push authority on current main 2026-07-21 21:44:54 +02:00
twentyOne2x
0b72b3cbce Integrate hardened source-first V3 rebuild foundation 2026-07-21 21:41:30 +02:00
fwazb
a0fabc3072 Add fail-closed leoclean staging installer
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details
2026-07-21 10:58:36 -07:00
fwazb
2f6cfeaaa4 Close staging preflight review gaps 2026-07-20 23:43:10 -07:00
fwazb
16b32193f7 Harden staging preflight receipt publication 2026-07-20 23:30:14 -07:00
fwazb
7bafcb4314 Reconcile staging preflight inventory 2026-07-20 23:11:08 -07:00
fwazb
544b2f615d Add GCP no-send staging preflight 2026-07-20 23:10:25 -07:00
fwazb
ac4bf5f01f Bind staging image push to a verified receipt 2026-07-20 22:52:13 -07:00
twentyOne2x
d2ad4f7c96 Remove destructive Docker cache cleanup 2026-07-21 07:00:13 +02:00
twentyOne2x
c7b4abc347 Retain inspected digest references in shared Docker caches 2026-07-21 05:47:01 +02:00
fwazb
e42d635523 Bind no-send releases to inspected images 2026-07-20 19:47:59 -07:00
twentyOne2x
ffe170007d Accept exact qemu PID 1 wrappers 2026-07-21 03:17:36 +02:00
fwazb
270bc9563e Bind no-send package to reviewed sources 2026-07-20 18:03:55 -07:00
fwazb
63b09bbacb Harden leoclean no-send package verification 2026-07-20 18:03:55 -07:00
fwazb
1e5c67738f Package leoclean no-send GCP staging service 2026-07-20 18:03:55 -07:00
Fawaz
77e1336c0f
Restrict leoclean runtime reads to queried columns (#179)
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details 
* Restrict leoclean runtime reads to queried columns

* Repair leoclean runtime authority review findings

* Harden leoclean query and CI permission contracts
 2026-07-17 06:31:37 -04:00
twentyOne2x
de9696a6e1 fix: partition drift probe failures 2026-07-16 12:56:30 +02:00
twentyOne2x
4ecc38cd7f Merge remote-tracking branch 'origin/main' into codex/leo-vps-gcp-drift-w2-20260715 2026-07-16 12:46:24 +02:00
twentyOne2x
6b3114e95f fix: harden source drift detector receipts 2026-07-16 12:35:45 +02:00
twentyOne2x
78e9ff07a5 Merge remote-tracking branch 'origin/main' into codex/leo-gcp-data-parity-acl-preflight-20260715 2026-07-16 12:32:10 +02:00
twentyOne2x
4c4b3eb82f Replay PostgreSQL role and ACL parity 2026-07-16 12:32:02 +02:00
twentyOne2x
21b2fdfcd1 Merge remote-tracking branch 'origin/main' into codex/pr162-integration-20260716 2026-07-16 12:13:48 +02:00