69 lines
3.4 KiB
Markdown
69 lines
3.4 KiB
Markdown
# GCP leoclean no-send staging preflight
|
|
|
|
## Outcome
|
|
|
|
This slice checks whether the existing `teleo-staging-1` target is ready for
|
|
the separately reviewed no-send service package. It creates one revision-bound
|
|
receipt and does not deploy the service.
|
|
|
|
The checker validates the exact project, VM, machine type, attached service
|
|
account, exact `e2-standard-4` machine type, boot-disk attachment and
|
|
architecture, private-only VM attachment to `teleo-staging-europe-west6`
|
|
(`10.60.0.0/20`), Private Google Access, immutable Docker Artifact
|
|
Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host
|
|
architecture, Docker server, Docker storage floor, unused service/container
|
|
names, and private TCP/5432 reachability from the VM.
|
|
|
|
## Authority boundary
|
|
|
|
The control-plane commands are `describe` operations. The bounded remote probe
|
|
runs through IAP/SSH and reads metadata, Docker, disk, systemd, container-name,
|
|
and TCP state. It does not read Secret Manager, use a database credential, run
|
|
a database query, install or pull software, create a container, write a unit,
|
|
or start/restart a service.
|
|
|
|
`gcloud compute ssh` may register or refresh an SSH key. The checker therefore
|
|
uses a maximum five-minute key lifetime and records that caveat explicitly; it
|
|
does not claim that the access path or cloud credential metadata is
|
|
mutation-free. The remote command itself does not change host runtime state.
|
|
|
|
## Run
|
|
|
|
Run from the exact clean, tracked source revision with an already authenticated Google
|
|
Cloud account that has the reviewed IAP/OS Login read path:
|
|
|
|
```bash
|
|
receipt_dir="$(mktemp -d "${TMPDIR:-/tmp}/livingip-leoclean-preflight.XXXXXX")"
|
|
chmod 0700 "$receipt_dir"
|
|
python3 ops/check_gcp_leoclean_nosend_preflight.py \
|
|
--output "$receipt_dir/preflight.json"
|
|
```
|
|
|
|
The output parent must already exist, be owned by the operator, and have no
|
|
group/other write permission. The output name must not exist. The checker
|
|
creates it once with no-clobber/no-symlink semantics, keeps the same file and
|
|
directory identity open through publication, writes mode `0600`, and fsyncs
|
|
the file and directory. It never removes or overwrites the output pathname;
|
|
an ambiguous publication failure can therefore leave a private residue for
|
|
operator inspection.
|
|
|
|
Authentication, permission, connection, and receipt-publication failures emit
|
|
only a bounded category; command stderr and filesystem exception details are
|
|
not copied into the receipt or stdout. The checker rejects an alternate
|
|
repository root, an output path inside the source tree, untracked critical
|
|
inputs, and source drift during the live observation.
|
|
|
|
## Claim ceiling and rollback
|
|
|
|
A passing receipt proves only the listed control-plane observations and
|
|
host-network private TCP reachability at one exact, clean Git revision. It does
|
|
not prove Docker-bridge reachability, Artifact Registry pull authorization,
|
|
secret access, database authentication, scoped PostgreSQL permissions, image
|
|
publication, deployment, restart, rollback, model behavior, parity, traffic,
|
|
or production readiness.
|
|
|
|
This slice changes no repository-independent service state beyond the stated
|
|
possibility of a time-bounded SSH key. Its local rollback boundary is deletion
|
|
of the branch/worktree; generated receipts and ambiguous private residues are
|
|
operator-owned evidence and are not deleted automatically. Any time-bounded
|
|
SSH key created by the access path expires after at most five minutes.
|