127 lines
5.4 KiB
Markdown
127 lines
5.4 KiB
Markdown
---
|
|
name: teleo-gcp-parity-ops
|
|
description: Use for Teleo GCP control-plane inventory, Cloud SQL read-only parity, authenticated Chrome routing, VM/runtime comparison, and exact GCP access gates without collapsing VPS proof into GCP proof.
|
|
---
|
|
|
|
# Teleo GCP Parity Ops
|
|
|
|
## Working Target
|
|
|
|
Prove the real GCP resource, database, runtime, and Cory-answer paths separately.
|
|
Control-plane inventory alone is not database or Leo parity.
|
|
|
|
## Current Verified Inventory
|
|
|
|
- Project: `teleo-501523` (`Teleo`).
|
|
- Authenticated Console account: redacted `b***@livingip.xyz` via `authuser=5`.
|
|
- VM: `teleo-prod-1`, running in `europe-west6-a`.
|
|
- VM shape: Debian 12, `e2-standard-4`, 4 vCPU, 16 GB; OS Login metadata is
|
|
present. Treat the displayed API scope as metadata, not IAM authorization.
|
|
- Cloud SQL: exactly one instance, `teleo-pgvector-standby`.
|
|
- Database engine: PostgreSQL `16.14`, Enterprise.
|
|
- Region/zone: `europe-west6` / `europe-west6-c`, single-zone.
|
|
- Network: private-only `teleo-staging-net`; public IP disabled.
|
|
- Connection name: `teleo-501523:europe-west6:teleo-pgvector-standby`.
|
|
- Cloud SQL Studio loads, but the observed session exposes no enabled existing
|
|
IAM DB principal and selects built-in password authentication.
|
|
- Cloud Logging has guest/platform logs but zero seven-day entries matching
|
|
`leoclean`, `hermes`, `gateway`, `postgres`, or `teleo-kb`; Ops Agent is not
|
|
installed.
|
|
- Read-only serial output is current through `2026-07-10T15:57:54Z`. It proves
|
|
recurring successful `leoclean-cloudsql-memory-sync.service` cycles. The last
|
|
exact `leoclean-gcp-prod-parallel.service` lifecycle event in the retained
|
|
buffer is a Hermes start on July 9 with no later exact stop/failure. This is
|
|
not a current PID, process, or deployed-SHA readback.
|
|
|
|
Read these before refreshing:
|
|
|
|
- `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.json`
|
|
- `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.json`
|
|
- `docs/reports/leo-working-state-20260709/gcp-parallel-delegation-current.json`
|
|
- `docs/reports/leo-working-state-20260709/gcp-leo-runtime-observability-current.json`
|
|
|
|
## Browser Rule
|
|
|
|
Use authenticated Chrome/Computer Use for Console-only facts when CLI auth is
|
|
stale. Never use AppleScript, `osascript`, JXA, `open`, System Events, or a
|
|
focus-stealing fallback. Do not inspect cookies, tokens, saved passwords, or
|
|
secret values.
|
|
|
|
## Required Parity Rows
|
|
|
|
Track each independently:
|
|
|
|
1. control-plane project/VM/Cloud SQL inventory;
|
|
2. database name, principal, transaction-read-only proof, schema, counts, and
|
|
selected row identities;
|
|
3. VM process/service/repo/profile/model/bot configuration;
|
|
4. no-post `DC-01` through `DC-06` replies and score;
|
|
5. cleanup and no-mutation readback.
|
|
|
|
## Canonical Restore Rule
|
|
|
|
The canonical Leo database is VPS Docker Postgres `teleo-pg/teleo`. The
|
|
SQLite `pipeline.db` to `teleo_kb.teleo_restore` drill is a separate legacy
|
|
pipeline-memory proof and never satisfies canonical Leo parity.
|
|
|
|
Use:
|
|
|
|
- `ops/capture_vps_canonical_postgres_snapshot.py` for one exported read-only
|
|
snapshot shared by `pg_dump` and the source manifest;
|
|
- `ops/postgres_parity_manifest.sql` for complete row/catalog/role/performance
|
|
readback;
|
|
- `ops/verify_postgres_parity_manifest.py --scope gcp_staging` for exact parity
|
|
plus a staging-compute private-connectivity receipt.
|
|
|
|
The 2026-07-11 local preflight restored all `39` canonical tables and `52,164`
|
|
rows with zero row-hash, catalog-hash, role, or performance mismatches. That is
|
|
local restore proof only. GCP import, private connectivity, and Cory replay are
|
|
still unproven.
|
|
|
|
## Cloud SQL Read-Only Query
|
|
|
|
Only after Studio is already authenticated with an existing principal:
|
|
|
|
```sql
|
|
begin transaction read only;
|
|
select current_database(), current_user,
|
|
current_setting('transaction_read_only');
|
|
select count(*) from public.claims;
|
|
select count(*) from public.sources;
|
|
select count(*) from public.claim_evidence;
|
|
select count(*) from public.claim_edges;
|
|
select count(*) from kb_stage.kb_proposals;
|
|
rollback;
|
|
```
|
|
|
|
Do not submit a raw password, create a user, change IAM, enable a flag, open
|
|
browser SSH that creates a key, or mutate infrastructure under this read-only
|
|
skill.
|
|
|
|
## Exact Current Gate
|
|
|
|
Database parity is unproven because the privileged gcloud/Console account now
|
|
requires password reauthentication, while both planned WIF identities
|
|
`sa-teleo-readiness` and `sa-teleo-restore-drill` are absent. The only proven
|
|
WIF identity is intentionally Artifact Registry-only. The clear CTA is:
|
|
|
|
```text
|
|
Run gcloud auth login billy@livingip.xyz --force, enter the Google password
|
|
yourself, and tell Codex: GCP CLI reauthenticated.
|
|
```
|
|
|
|
Otherwise route the reviewed IAM split to a separately authorized admin window.
|
|
Once authenticated, create only a generated clone database, import the retained
|
|
canonical dump, run full parity/private-connectivity/Cory replay, and clean up.
|
|
|
|
For the narrower read-only Studio route, an operator may instead authenticate
|
|
an already-existing database principal and report `GCP Studio authenticated`;
|
|
that permits SQL readback but does not authorize the clone/import replay.
|
|
|
|
## Claim Ceiling
|
|
|
|
Current proof covers the GCP project, VM, Cloud SQL instance, health, version,
|
|
private routing surface, and bounded serial unit activity. It does not prove
|
|
current gateway PID/restarts, deployed SHA, profile, model/auth, Telegram bot
|
|
identity, selected canonical DB, DB contents, VPS-vs-GCP schema/row parity,
|
|
safe no-post Cory answers, or cutover.
|