# GCP leoclean no-send staging preflight

## Outcome

This slice checks whether the existing `teleo-staging-1` target is ready for
the separately reviewed no-send service package. It creates one revision-bound
receipt and does not deploy the service.

The checker validates the exact project, VM, machine type, attached service
account, exact `e2-standard-4` machine type, boot-disk attachment and
architecture, private-only VM attachment to `teleo-staging-europe-west6`
(`10.60.0.0/20`), Private Google Access, immutable Docker Artifact
Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host
architecture, Docker server, Docker storage floor, unused service/container
names, and private TCP/5432 reachability from the VM. Before the first Docker
client command, it requires `docker.service` to be loaded, active, and running;
after the final client command it requires unchanged service state, `MainPID`,
and restart count. This prevents a read probe from activating Docker through
`docker.socket` or silently accepting a daemon restart.

## Authority boundary

The control-plane commands are `describe` operations. The bounded remote probe
runs through IAP/SSH and reads metadata, Docker, disk, systemd, container-name,
and TCP state. It does not read Secret Manager, use a database credential, run
a database query, install or pull software, create a container, write a unit,
or start/restart a service.

`gcloud compute ssh` may register or refresh an SSH key. The checker therefore
uses a maximum five-minute key lifetime and records that caveat explicitly; it
does not claim that the access path or cloud credential metadata is
mutation-free. The remote command itself does not change host runtime state.

## Run

Run from the exact clean, tracked source revision with an already authenticated Google
Cloud account that has the reviewed IAP/OS Login read path:

```bash
receipt_dir="$(mktemp -d "${TMPDIR:-/tmp}/livingip-leoclean-preflight.XXXXXX")"
chmod 0700 "$receipt_dir"
python3 ops/check_gcp_leoclean_nosend_preflight.py \
  --output "$receipt_dir/preflight.json"
```

The output parent must already exist, be owned by the operator, and have no
group/other write permission. The output name must not exist. The checker
creates it once with no-clobber/no-symlink semantics, keeps the same file and
directory identity open through publication, writes and fsyncs a mode-`0600`
private staged inode, and only then hard-links that complete inode to the
canonical output name without replacement. The retained staged and canonical
names are two links to the same inode; they are never removed automatically.
A pre-publication failure therefore leaves only the private staged residue,
not a valid-looking canonical pass receipt. A later ambiguous publication
failure preserves the exact retained inode for operator inspection.

Authentication, permission, connection, and receipt-publication failures emit
only a bounded category; command stderr and filesystem exception details are
not copied into the receipt or stdout. The checker rejects an alternate
repository root, an output path inside the source tree, untracked critical
inputs, and source drift during the live observation.

## Claim ceiling and rollback

A passing receipt proves only the listed control-plane observations and
host-network private TCP reachability at one exact, clean Git revision. It does
not prove Docker-bridge reachability, Artifact Registry pull authorization,
secret access, database authentication, scoped PostgreSQL permissions, image
publication, deployment, restart, rollback, model behavior, parity, traffic,
or production readiness.

This slice changes no repository-independent service state beyond the stated
possibility of a time-bounded SSH key. Its local rollback boundary is deletion
of the branch/worktree; generated receipts and ambiguous private residues are
operator-owned evidence and are not deleted automatically. Any time-bounded
SSH key created by the access path expires after at most five minutes.