teleo-infrastructure/docs/gcp-leoclean-nosend-preflight.md

GCP leoclean no-send staging preflight

Outcome

This slice checks whether the existing teleo-staging-1 target is ready for the separately reviewed no-send service package. It creates one revision-bound receipt and does not deploy the service.

The checker validates the exact project, VM, machine type, attached service account, exact e2-standard-4 machine type, boot-disk attachment and architecture, private-only VM attachment to teleo-staging-europe-west6 (10.60.0.0/20), Private Google Access, immutable Docker Artifact Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host architecture, Docker server, Docker storage floor, unused service/container names, and private TCP/5432 reachability from the VM.

Authority boundary

The control-plane commands are describe operations. The bounded remote probe runs through IAP/SSH and reads metadata, Docker, disk, systemd, container-name, and TCP state. It does not read Secret Manager, use a database credential, run a database query, install or pull software, create a container, write a unit, or start/restart a service.

gcloud compute ssh may register or refresh an SSH key. The checker therefore uses a maximum five-minute key lifetime and records that caveat explicitly; it does not claim that the access path or cloud credential metadata is mutation-free. The remote command itself does not change host runtime state.

Run

Run from the exact clean, tracked source revision with an already authenticated Google Cloud account that has the reviewed IAP/OS Login read path:

receipt_dir="$(mktemp -d "${TMPDIR:-/tmp}/livingip-leoclean-preflight.XXXXXX")"
chmod 0700 "$receipt_dir"
python3 ops/check_gcp_leoclean_nosend_preflight.py \
  --output "$receipt_dir/preflight.json"

The output parent must already exist, be owned by the operator, and have no group/other write permission. The output name must not exist. The checker creates it once with no-clobber/no-symlink semantics, keeps the same file and directory identity open through publication, writes mode 0600, and fsyncs the file and directory. It never removes or overwrites the output pathname; an ambiguous publication failure can therefore leave a private residue for operator inspection.

Authentication, permission, connection, and receipt-publication failures emit only a bounded category; command stderr and filesystem exception details are not copied into the receipt or stdout. The checker rejects an alternate repository root, an output path inside the source tree, untracked critical inputs, and source drift during the live observation.

Claim ceiling and rollback

A passing receipt proves only the listed control-plane observations and host-network private TCP reachability at one exact, clean Git revision. It does not prove Docker-bridge reachability, Artifact Registry pull authorization, secret access, database authentication, scoped PostgreSQL permissions, image publication, deployment, restart, rollback, model behavior, parity, traffic, or production readiness.

This slice changes no repository-independent service state beyond the stated possibility of a time-bounded SSH key. Its local rollback boundary is deletion of the branch/worktree; generated receipts and ambiguous private residues are operator-owned evidence and are not deleted automatically. Any time-bounded SSH key created by the access path expires after at most five minutes.