teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
teleo-infrastructure/docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.md
twentyOne2x 3351d2d886
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details
Harden Leo apply runbook regression gates
2026-07-10 03:22:17 +02:00

7.9 KiB
Raw Blame History

Working Leo Authorized Apply Runbook

Generated UTC: 2026-07-10T01:16:00.171472+00:00 Mode: operator_runbook_generation_only Status: ready_not_executed Ready for authorized operator: True Production apply executed: False Production apply authorization present: False

Authorization Boundary

Do not run apply commands unless the operator explicitly authorizes production DB apply for the integrated Working Leo packet set in dependency order.

Checks

  • readiness_passes: True
  • readiness_says_not_executed: True
  • readiness_says_not_authorized: True
  • apply_order_matches_manifest: True
  • rollback_order_matches_manifest: True
  • all_phase_files_exist: True
  • all_phase_files_non_empty: True
  • all_apply_and_rollback_sql_have_transactions: True
  • post_apply_regression_commands_present: True
  • production_apply_receipt_schema_present: True

Preflight Order

  1. mapped-rich-base -> production-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-preflight.sql
  2. cross-surface-anchor -> cross-surface-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-preflight.sql
  3. rio-strategy-context -> rio-strategy-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-preflight.sql
  4. governance-concept-schema -> governance-concept-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-preflight.sql
  5. helmer-7powers -> helmer-7powers-production-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-preflight.sql

Apply Order

  1. mapped-rich-base -> production-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-apply-authorized-commit.sql
  2. cross-surface-anchor -> cross-surface-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-apply-authorized-commit.sql
  3. rio-strategy-context -> rio-strategy-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-apply-authorized-commit.sql
  4. governance-concept-schema -> governance-concept-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-apply-authorized-commit.sql
  5. helmer-7powers -> helmer-7powers-production-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-apply-authorized-commit.sql

Postflight Order

  1. mapped-rich-base -> production-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-postflight.sql
  2. cross-surface-anchor -> cross-surface-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-postflight.sql
  3. rio-strategy-context -> rio-strategy-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-postflight.sql
  4. governance-concept-schema -> governance-concept-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-postflight.sql
  5. helmer-7powers -> helmer-7powers-production-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-postflight.sql

Rollback Order

  1. helmer-7powers -> helmer-7powers-production-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-delete-rollback.sql
  2. governance-concept-schema -> governance-concept-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-delete-rollback.sql
  3. rio-strategy-context -> rio-strategy-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-delete-rollback.sql
  4. cross-surface-anchor -> cross-surface-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-delete-rollback.sql
  5. mapped-rich-base -> production-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-delete-rollback.sql

Expected Counts After Apply

  • claim_concept_map_links: 1
  • claim_edges: 18
  • claim_evidence: 34
  • claim_governance_gate_links: 2
  • claims: 12
  • concept_maps: 1
  • cross_surface_anchor_updates: 1
  • helmer_ledger_rows_marked_applied: 1
  • reasoning_tools: 1
  • rio_strategy_anchors: 5
  • rio_strategy_nodes: 2
  • sources: 28

Post-Apply Required Actions

  • Run every postflight SQL file and retain output.
  • Run the post-apply regression command bundle and retain every artifact.
  • Record production apply receipt, row counts, service MainPID/NRestarts, and cleanup readback.

Post-Apply Regression Commands

  • direct_claim_handler_suite: Re-run the non-posting VPS GatewayRunner direct-claim suite after production postflight.
    • command: .venv/bin/python scripts/run_leo_direct_claim_handler_suite.py
    • artifact: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json
    • mutates production DB: False
    • posts to Telegram: False
  • direct_claim_strict_score: Strict-score the retained direct-claim replies; expected score is 6/6.
    • command: .venv/bin/python scripts/working_leo_open_ended_benchmark.py --results-json docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json --include-direct-claim-followups --out docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.json --markdown-out docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
    • artifact: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
    • mutates production DB: False
    • posts to Telegram: False
  • focused_local_regression_tests: Verify benchmark scoring, bridge skill surfaces, and runbook invariants after artifact refresh.
    • command: .venv/bin/python -m pytest tests/test_working_leo_open_ended_benchmark.py tests/test_hermes_leoclean_skill_surfaces.py tests/test_build_working_leo_authorized_apply_runbook.py -q
    • artifact: terminal pytest output
    • mutates production DB: False
    • posts to Telegram: False
  • gateway_service_readback: Read back the VPS Leo gateway service state after postflight and regressions.
    • command: systemctl show leoclean-gateway.service -p ActiveState -p SubState -p MainPID -p NRestarts -p ExecMainStartTimestamp --no-pager
    • artifact: retained service readback with ActiveState=active and NRestarts reviewed
    • mutates production DB: False
    • posts to Telegram: False

Production Apply Receipt Required Fields

  • explicit_authorization_record
  • operator_identity
  • git_commit_sha
  • preflight_output_paths
  • apply_output_paths
  • postflight_output_paths
  • expected_after_apply_counts
  • actual_after_apply_counts
  • telegram_or_handler_regression_paths
  • direct_claim_score_path
  • service_readback
  • cleanup_readback
  • rollback_packet_paths
  • known_residual_risks

Claim Ceiling

This runbook is proof that the authorized apply sequence is explicit and ordered. It does not execute SQL, does not mutate production, and does not replace explicit production apply authorization.