57 lines
2.6 KiB
Markdown
57 lines
2.6 KiB
Markdown
# GCP leoclean no-send staging preflight
|
|
|
|
## Outcome
|
|
|
|
This slice checks whether the existing `teleo-staging-1` target is ready for
|
|
the separately reviewed no-send service package. It creates one revision-bound
|
|
receipt and does not deploy the service.
|
|
|
|
The checker validates the exact project, VM, machine type, attached service
|
|
account, exact boot-disk attachment and architecture, private-only VM
|
|
VPC/subnet attachment, Private Google Access, immutable Docker Artifact
|
|
Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host
|
|
architecture, Docker server, Docker storage floor, unused service/container
|
|
names, and private TCP/5432 reachability from the VM.
|
|
|
|
## Authority boundary
|
|
|
|
The control-plane commands are `describe` operations. The bounded remote probe
|
|
runs through IAP/SSH and reads metadata, Docker, disk, systemd, container-name,
|
|
and TCP state. It does not read Secret Manager, use a database credential, run
|
|
a database query, install or pull software, create a container, write a unit,
|
|
or start/restart a service.
|
|
|
|
`gcloud compute ssh` may register or refresh an SSH key. The checker therefore
|
|
uses a maximum five-minute key lifetime and records that caveat explicitly; it
|
|
does not claim that the access path or cloud credential metadata is
|
|
mutation-free. The remote command itself does not change host runtime state.
|
|
|
|
## Run
|
|
|
|
Run from the exact clean, tracked source revision with an already authenticated Google
|
|
Cloud account that has the reviewed IAP/OS Login read path:
|
|
|
|
```bash
|
|
python3 ops/check_gcp_leoclean_nosend_preflight.py \
|
|
--output /tmp/leoclean-nosend-gcp-preflight.json
|
|
```
|
|
|
|
The output file is created with mode `0600`. Authentication, permission, and
|
|
connection failures emit only a bounded category; command stderr is not copied
|
|
into the receipt. The checker rejects an alternate repository root, an output
|
|
path inside the source tree, untracked critical inputs, and source drift during
|
|
the live observation.
|
|
|
|
## Claim ceiling and rollback
|
|
|
|
A passing receipt proves only the listed control-plane observations and
|
|
host-network private TCP reachability at one exact, clean Git revision. It does
|
|
not prove Docker-bridge reachability, Artifact Registry pull authorization,
|
|
secret access, database authentication, scoped PostgreSQL permissions, image
|
|
publication, deployment, restart, rollback, model behavior, parity, traffic,
|
|
or production readiness.
|
|
|
|
This slice changes no repository-independent service state. Its local rollback
|
|
boundary is deletion of the branch/worktree and any generated receipt. Any
|
|
time-bounded SSH key created by the access path expires after at most five
|
|
minutes.
|