fed5cb0805
- Normalize rich proposals into atomic reviewed canonical graph bundles with exact row verification. - Harden reviewer/apply roles, upgrade ACLs, and prove generic plus Helmer lifecycles in isolated PostgreSQL. - Publish repo-native VPS/GCP/Cory skills and live-readonly GCP inventory without changing the live VPS runtime. `.agents/skills/crabbox/SKILL.md` `.agents/skills/teleo-gcp-parity-ops/SKILL.md` `.agents/skills/teleo-kb-db-change-workflow/SKILL.md` `.agents/skills/teleo-leo-onboarding/SKILL.md` `.agents/skills/teleo-vps-runtime-ops/SKILL.md` `.agents/skills/working-leo-cory-outcomes/SKILL.md` `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.json` `docs/reports/leo-working-state-20260709/approve-claim-clone-canary-current.md` `docs/reports/leo-working-state-20260709/current-truth-index.md` `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.json` `docs/reports/leo-working-state-20260709/gcp-cloud-sql-t3-live-readonly-current.md` `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.json` `docs/reports/leo-working-state-20260709/gcp-cloudsql-studio-parity-gate-current.md` `docs/reports/leo-working-state-20260709/gcp-parallel-delegation-current.json` `docs/reports/leo-working-state-20260709/helmer-approve-claim-clone-canary-current.json` `docs/reports/leo-working-state-20260709/helmer-approve-claim-normalization-current.json` `docs/reports/leo-working-state-20260709/skill-pack-manifest.json` `docs/reports/leo-working-state-20260709/skill-pack-readme.md` `docs/reports/leo-working-state-20260709/working-leo-current-state-20260709.md` `docs/reports/leo-working-state-20260709/working-leo-definition-20260709.md` `docs/reports/leo-working-state-20260709/working-leo-execution-plan-current.md` `scripts/apply_proposal.py` `scripts/apply_worker.py` `scripts/approve_proposal.py` `scripts/kb_apply_prereqs.sql` `scripts/kb_proposal_normalize.py` `scripts/probe_gcp_db_parity.py` `scripts/run_approve_claim_clone_canary.py` `scripts/run_approve_claim_isolated_container_canary.sh` `tests/test_apply_proposal.py` `tests/test_apply_worker.py` `tests/test_approve_proposal.py` `tests/test_kb_apply_prereqs.py` `tests/test_kb_proposal_normalize.py` `tests/test_kb_proposal_routes.py` `tests/test_probe_gcp_db_parity.py` `tests/test_repo_skill_pack.py`
46 lines
2.2 KiB
Markdown
46 lines
2.2 KiB
Markdown
# Cloud SQL Studio parity gate
|
|
|
|
Captured UTC: `2026-07-10T06:57:22.085Z`
|
|
|
|
## Outcome
|
|
|
|
Cloud SQL Studio opened successfully for `teleo-pgvector-standby` under the authenticated `b***@livingip.xyz` Console session. The database login dialog did not provide an enabled existing IAM principal: IAM database authentication was disabled in the dialog, built-in authentication was selected, and that path required a password credential.
|
|
|
|
The lane stopped before authentication. No database session was established and no SQL ran.
|
|
|
|
- Required tier: `T3_live_readonly`
|
|
- Current database-parity tier: `T0_spec`
|
|
- Live gate evidence: `T3_live_readonly`
|
|
- Status: `blocked_with_artifact`
|
|
|
|
## Target verified from the live control-plane evidence
|
|
|
|
- Project: `teleo-501523`
|
|
- Instance: `teleo-pgvector-standby`
|
|
- Connection: `teleo-501523:europe-west6:teleo-pgvector-standby`
|
|
- Engine: PostgreSQL 16.14
|
|
- Endpoint: private-only `10.61.0.3:5432`
|
|
- Network: `teleo-staging-net`
|
|
- Instance flag: `cloudsql.iam_authentication=on`
|
|
|
|
## Exact gate
|
|
|
|
The Studio login surface exposed no enabled existing IAM database principal for this Console session. The selected built-in authentication route requires a raw database password. Using that password, creating a database user, changing IAM, or granting access is outside this lane's hard ceiling.
|
|
|
|
An operator can complete Studio login independently with an already-existing authorized principal, without sharing credentials with Codex, and then tell Codex the SQL editor is authenticated. Otherwise, IAM/user enablement must be handled by a separately authorized write lane.
|
|
|
|
## Not proven
|
|
|
|
No current database name, principal identity, transaction-read-only result, schema presence, table counts, proposal IDs/statuses, selected row identities, or GCP-versus-VPS comparison was read.
|
|
|
|
The planned `BEGIN TRANSACTION READ ONLY` query was not executed and therefore is not counted as evidence.
|
|
|
|
## Cleanup
|
|
|
|
- `Authenticate` was not clicked.
|
|
- No browser SSH was opened.
|
|
- Chrome was finalized and the agent-created Studio tab was closed.
|
|
- No database session or transaction remains open.
|
|
- No GCP, database, IAM, credential, key, service, deploy, or Telegram mutation occurred.
|
|
|
|
Machine-readable evidence: `gcp-cloudsql-studio-parity-gate-current.json`.
|