teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1
teleo-infrastructure/docs/reports/leo-working-state-20260709/working-leo-authorized-apply-runbook-current.md
twentyOne2x 0d70c09f6f
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details
Support VPS local preflight collection
2026-07-10 03:41:29 +02:00

9.3 KiB
Raw Blame History

Working Leo Authorized Apply Runbook

Generated UTC: 2026-07-10T01:41:16.353240+00:00 Mode: operator_runbook_generation_only Status: ready_not_executed Ready for authorized operator: True Production apply executed: False Production apply authorization present: False

Authorization Boundary

Do not run apply commands unless the operator explicitly authorizes production DB apply for the integrated Working Leo packet set in dependency order.

Checks

  • readiness_passes: True
  • readiness_says_not_executed: True
  • readiness_says_not_authorized: True
  • apply_order_matches_manifest: True
  • rollback_order_matches_manifest: True
  • all_phase_files_exist: True
  • all_phase_files_non_empty: True
  • all_apply_and_rollback_sql_have_transactions: True
  • post_apply_regression_commands_present: True
  • pre_apply_validation_commands_present: True
  • production_apply_receipt_schema_present: True

Preflight Order

  1. mapped-rich-base -> production-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-preflight.sql
  2. cross-surface-anchor -> cross-surface-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-preflight.sql
  3. rio-strategy-context -> rio-strategy-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-preflight.sql
  4. governance-concept-schema -> governance-concept-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-preflight.sql
  5. helmer-7powers -> helmer-7powers-production-preflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-preflight.sql

Apply Order

  1. mapped-rich-base -> production-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-apply-authorized-commit.sql
  2. cross-surface-anchor -> cross-surface-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-apply-authorized-commit.sql
  3. rio-strategy-context -> rio-strategy-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-apply-authorized-commit.sql
  4. governance-concept-schema -> governance-concept-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-apply-authorized-commit.sql
  5. helmer-7powers -> helmer-7powers-production-apply-authorized-commit.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-apply-authorized-commit.sql

Postflight Order

  1. mapped-rich-base -> production-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-postflight.sql
  2. cross-surface-anchor -> cross-surface-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-postflight.sql
  3. rio-strategy-context -> rio-strategy-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-postflight.sql
  4. governance-concept-schema -> governance-concept-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-postflight.sql
  5. helmer-7powers -> helmer-7powers-production-postflight.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-postflight.sql

Rollback Order

  1. helmer-7powers -> helmer-7powers-production-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/helmer-7powers-production-delete-rollback.sql
  2. governance-concept-schema -> governance-concept-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/governance-concept-delete-rollback.sql
  3. rio-strategy-context -> rio-strategy-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/rio-strategy-delete-rollback.sql
  4. cross-surface-anchor -> cross-surface-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/cross-surface-delete-rollback.sql
  5. mapped-rich-base -> production-delete-rollback.sql
    • psql "$TELEO_DATABASE_URL" -v ON_ERROR_STOP=1 -f docs/reports/leo-working-state-20260709/production-delete-rollback.sql

Expected Counts After Apply

  • claim_concept_map_links: 1
  • claim_edges: 18
  • claim_evidence: 34
  • claim_governance_gate_links: 2
  • claims: 12
  • concept_maps: 1
  • cross_surface_anchor_updates: 1
  • helmer_ledger_rows_marked_applied: 1
  • reasoning_tools: 1
  • rio_strategy_anchors: 5
  • rio_strategy_nodes: 2
  • sources: 28

Pre-Apply Validation Commands

  • readonly_production_preflight_collector: Collect a production baseline for every preflight SQL file through a read-only transaction wrapper. During an authorized apply window, still run each phase preflight again immediately before its phase. Use --transport local-docker when running this collector directly on the VPS.
    • command: .venv/bin/python scripts/collect_working_leo_production_preflight.py --execute --transport ssh --out docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.json --markdown-out docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.md
    • artifact: docs/reports/leo-working-state-20260709/working-leo-production-preflight-current.md
    • mutates production DB: False
    • applies production packet: False

Post-Apply Required Actions

  • Run every postflight SQL file and retain output.
  • Run the post-apply regression command bundle and retain every artifact.
  • Record production apply receipt, row counts, service MainPID/NRestarts, and cleanup readback.

Post-Apply Regression Commands

  • direct_claim_handler_suite: Re-run the non-posting VPS GatewayRunner direct-claim suite after production postflight.
    • command: .venv/bin/python scripts/run_leo_direct_claim_handler_suite.py
    • artifact: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json
    • mutates production DB: False
    • posts to Telegram: False
  • direct_claim_strict_score: Strict-score the retained direct-claim replies; expected score is 6/6.
    • command: .venv/bin/python scripts/working_leo_open_ended_benchmark.py --results-json docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-current.json --include-direct-claim-followups --out docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.json --markdown-out docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
    • artifact: docs/reports/leo-working-state-20260709/telegram-handler-direct-claim-suite-score-current.md
    • mutates production DB: False
    • posts to Telegram: False
  • focused_local_regression_tests: Verify benchmark scoring, bridge skill surfaces, and runbook invariants after artifact refresh.
    • command: .venv/bin/python -m pytest tests/test_working_leo_open_ended_benchmark.py tests/test_hermes_leoclean_skill_surfaces.py tests/test_build_working_leo_authorized_apply_runbook.py -q
    • artifact: terminal pytest output
    • mutates production DB: False
    • posts to Telegram: False
  • gateway_service_readback: Read back the VPS Leo gateway service state after postflight and regressions.
    • command: systemctl show leoclean-gateway.service -p ActiveState -p SubState -p MainPID -p NRestarts -p ExecMainStartTimestamp --no-pager
    • artifact: retained service readback with ActiveState=active and NRestarts reviewed
    • mutates production DB: False
    • posts to Telegram: False
  • production_receipt_validator: Validate the retained production-apply receipt against the authorized runbook requirements.
    • command: .venv/bin/python scripts/validate_working_leo_production_receipt.py --receipt docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-current.json
    • artifact: docs/reports/leo-working-state-20260709/working-leo-production-apply-receipt-validation-current.md
    • mutates production DB: False
    • posts to Telegram: False

Production Apply Receipt Required Fields

  • explicit_authorization_record
  • operator_identity
  • git_commit_sha
  • preflight_output_paths
  • apply_output_paths
  • postflight_output_paths
  • expected_after_apply_counts
  • actual_after_apply_counts
  • telegram_or_handler_regression_paths
  • direct_claim_score_path
  • service_readback
  • cleanup_readback
  • rollback_packet_paths
  • known_residual_risks

Claim Ceiling

This runbook is proof that the authorized apply sequence is explicit and ordered. It does not execute SQL, does not mutate production, and does not replace explicit production apply authorization.