From 0167b9c6fe4aebf8d676bd005f1b059f4fd62e64 Mon Sep 17 00:00:00 2001 From: walter Date: Mon, 5 Oct 2026 19:09:14 +0330 Subject: [PATCH] docs: complete P7.2 and P7.3 production validation --- docs/DECISIONS.md | 29 +++++----- docs/HANDOFF.md | 66 +++++++++++++--------- docs/MASTER-ROADMAP.md | 35 ++++++------ docs/PHASE_BREAKDOWN.md | 31 +++++----- docs/PROJECT_STATE.md | 84 +++++++++++++++------------- docs/operations/P7_2_P7_3_RUNBOOK.md | 51 ++++++++++++++--- 6 files changed, 175 insertions(+), 121 deletions(-) diff --git a/docs/DECISIONS.md b/docs/DECISIONS.md index bccf586..50e4b6b 100644 --- a/docs/DECISIONS.md +++ b/docs/DECISIONS.md @@ -1255,10 +1255,11 @@ new application table, public endpoint, provider lock-in, or multi-region HA. Status -Accepted for repository implementation. A-owned local/off-site backup and -isolated restore validation passed on 2026-10-05, but scheduled systemd backup -failed because Docker Compose attempted to read `/srv/wctm/.env` as `wctm`. -P7.3 production acceptance remains pending a successful live scheduler proof. +Accepted and production-validated on 2026-10-05. A-owned local/off-site backup +and isolated restore validation passed. After the first scheduled service start +failed because Docker Compose attempted to read `/srv/wctm/.env` as `wctm`, the +corrected service completed backup, off-site SHA-256 verification, and retention +as `wctm` with `SERVICE_RC=0`. The daily timer was enabled and is active. --- @@ -1270,15 +1271,13 @@ Date Decision -Proposed after P7.3 closure: P7.2 is production-complete, while P7.3 still -requires a successful scheduled-backup systemd proof on authoritative -`waltpack`. Once P7.3 passes, Phase 7 would remain incomplete and pause before -P7.4. P7.4–P7.8 would remain unstarted and available for later resumption when -merchant/pilot evidence justifies them; historical provenance review would -remain assigned to P7.8. Phase 6 remains deferred and unstarted. +P7.2 and P7.3 are production-complete on authoritative `waltpack`. Phase 7 +remains incomplete and is intentionally paused before P7.4. P7.4–P7.8 remain +unstarted and available for later resumption when merchant/pilot evidence +justifies them; historical provenance review remains assigned to P7.8. Phase 6 +remains deferred and unstarted. -Private Pilot Readiness is proposed as the next active initiative after P7.3 -closure. Its bounded sequence is +Private Pilot Readiness is the next active initiative. Its bounded sequence is privacy/data-flow audit and merchant-facing disclosures; licensing/legal baseline; WordPress connector admin UI polish; `wctm.walterbyte.com` onboarding and product-surface polish; focused security/quality QA; and a private merchant @@ -1288,14 +1287,14 @@ task requires separate authorization; this decision implements none of them. Reason -The deployment and recovery evidence can support a controlled private pilot -after the scheduled-backup path passes live validation. +The deployment, recovery, and scheduled-backup path passed live validation and +support preparation for a controlled private pilot. Real merchant usage and payment evidence should guide further infrastructure and product investment before resuming the remaining Phase 7 or Phase 6 work. Status -Proposed; not accepted until P7.3 scheduled-backup production proof passes. +Accepted on 2026-10-05 after P7.3 scheduled-backup production proof passed. --- diff --git a/docs/HANDOFF.md b/docs/HANDOFF.md index f16a080..e7e561a 100644 --- a/docs/HANDOFF.md +++ b/docs/HANDOFF.md @@ -79,7 +79,7 @@ n8n is **NOT** part of the production architecture (D-008, prototype only). | D-030 | P7.1 uses a temporary decrypt-only previous key, current-key-only writes, and a trusted-shell row-transactional rotation command for the exact five encrypted database fields | Accepted | | D-031 | P7.2 separates restricted backend runtime from an ephemeral explicit Prisma migration identity and defines revision-locked fail-fast deployment plus volume-preserving immutable data-service reconciliation | Accepted | | D-032 | P7.3 establishes atomic verified PostgreSQL backups, explicit retention, verified provider-neutral off-host copy, daily systemd scheduling, isolated guarded restore, DR dependencies, and target-only RPO/RTO | Accepted | -| D-033 | Proposed Phase 7 pause after P7.3 scheduled-backup proof, with Private Pilot Readiness next and Phase 6/P7.4–P7.8 deferred | Proposed | +| D-033 | Pause incomplete Phase 7 after production-validated P7.2/P7.3; make Private Pilot Readiness active while Phase 6/P7.4–P7.8 remain deferred | Accepted | Next decision number: **D-034**, if a future task produces a genuine architectural or product decision. @@ -1032,7 +1032,7 @@ Final closure evidence: --- -### Phase 7 — Production Readiness (P7.3 scheduler proof pending) +### Phase 7 — Production Readiness (paused after production-validated P7.3) #### P7.1 — Production Security Baseline (complete; production validated) @@ -1210,7 +1210,7 @@ migration and deployment path`. PostgreSQL/Redis and named volumes, `deployment path: PASS`, local/public health/readiness, and bounded functional smoke. P7.2 is complete. -#### P7.3 — Backup, Restore & Disaster Recovery (scheduled proof pending) +#### P7.3 — Backup, Restore & Disaster Recovery (production complete) - Implementation commit: `ddde3c705b249a29a131a3bfc96763f17b6e9cbc chore(ops): add production backup @@ -1244,17 +1244,28 @@ and recovery path`. 16 migrations), OneDrive three-artifact copy with streamed SHA-256 PASS, isolated network-none restore with 16 migrations/21 public tables and critical counts `tenants=7`, `users=6`, `stores=2`, `orders=54`, cleanup, - and clean final health/role/permission/secret scans. The live systemd service - then failed with `/srv/wctm/.env` permission denied as `wctm`; the timer was - not enabled. P7.3 remains open until the corrected scheduler passes live. - -This closure branch performs no VPS, production, secret, live database, -deployment, schema, migration, or product mutation. Phase 7 remains incomplete; -P7.4–P7.8 and Phase 6 remain deferred/unstarted. D-033 and Private Pilot -Readiness are proposed pending P7.3 closure. Scheduled backup now selects the -sole PostgreSQL container via Docker Compose labels without parsing the full -app `.env`; `RCLONE_CONFIG` remains in protected external configuration. This -repository correction has not run on production here. + and clean final health/role/permission/secret scans. The first live systemd + start failed on `/srv/wctm/.env` access as `wctm`; the corrected scheduler + then completed through `wctm-backup.service` with `SERVICE_RC=0`, 16 + migrations, OneDrive three-artifact transfer, streamed SHA-256 PASS, + `retention: PASS`, and a secret-safe journal. The one-shot service exited + successfully and the daily timer was enabled and active, with its initial + next invocation confirmed for `2026-10-06 02:18:28 UTC`. +- The scheduled backup `wctm-postgres-20261005T151246Z-unknown.dump` + (2,404,925 bytes) was + timestamped, checksum-valid and off-site verified. The `unknown` revision is + metadata-quality polish. Retention warned on some older manually/root-created + sets with relative checksum sidecars, but returned PASS and removed no set + incorrectly. These are future operational follow-ups, not P7.3 blockers. + +This documentation closure performs no VPS, production, secret, live database, +deployment, schema, migration, or product mutation. Phase 7 remains paused and +incomplete; P7.4–P7.8 and Phase 6 remain deferred/unstarted. D-033 is Accepted +and Private Pilot Readiness is active. Scheduled backup selects the sole +PostgreSQL container via Docker Compose labels without parsing the full +app `.env`; `RCLONE_CONFIG` remains in protected external configuration. A +installed and validated the repository correction on `waltpack`; the protected +`.env` remains inaccessible to the service account. ## 5. Current Repository Structure @@ -1270,23 +1281,26 @@ Current closure branch: `docs/p7.2-p7.3-production-closure` from main ## 6. Current Blockers -P7.3 scheduled-backup production proof remains open. Public launch also remains -gated by unstarted P7.4–P7.8 and a separate A decision. Historical provenance -remains unresolved and assigned to P7.8. Monitoring remains P7.4, DATE-001 -P7.5, network/runtime resilience P7.6, and AuditLog structural immutability -P7.7. +Public launch remains gated by unstarted P7.4–P7.8 and a separate A decision. +Historical provenance remains unresolved and assigned to P7.8. Monitoring +remains P7.4, DATE-001 P7.5, network/runtime resilience P7.6, and AuditLog +structural immutability P7.7. --- ## 7. Current Task -P7.1 and P7.2 are complete. A-owned P7.3 backup/off-site/restore checks passed -on authoritative `waltpack` at `/srv/wctm`, but the scheduled service failed -on `.env` access as `wctm` and its timer was not enabled. The earlier migration -from `hetz` succeeded; its WCTM deployment was removed and is not a rollback -host. P7.3 requires live scheduler proof. Phase 7 remains incomplete; -P7.4–P7.8 and Phase 6 are deferred/unstarted. D-033 proposes Private Pilot -Readiness next after P7.3 closure; no pilot implementation begins here. +P7.1–P7.3 are production-complete. A-owned backup/off-site/restore and corrected +scheduled service checks passed on authoritative `waltpack` at `/srv/wctm`; +the daily timer is enabled and active. The earlier migration from `hetz` +succeeded; its WCTM deployment was removed and is not a rollback host. Phase 7 +is intentionally paused/incomplete before P7.4; P7.4–P7.8 and Phase 6 remain +deferred/unstarted. Accepted D-033 makes Private Pilot Readiness the next active +initiative: privacy/data-flow audit and merchant disclosures, licensing/legal +baseline, WordPress connector admin UI polish, `wctm.walterbyte.com` +onboarding/product-surface polish, focused security/quality QA, and controlled +private merchant pilots. Engineering is frozen except for pilot-blocking +defects. No pilot implementation or broad public launch is authorized here. ### Last completed product milestone: M22 diff --git a/docs/MASTER-ROADMAP.md b/docs/MASTER-ROADMAP.md index c2b934e..fce223f 100644 --- a/docs/MASTER-ROADMAP.md +++ b/docs/MASTER-ROADMAP.md @@ -284,7 +284,7 @@ readiness work, or authorize unrestricted public launch. ## Phase 7 — Production Readiness Status: -🔵 In progress through P7.3; Phase 7 remains incomplete +⏸ Paused after P7.3; Phase 7 remains incomplete Phase 7 executes before Phase 6. It is production hardening and readiness only; it does not include pricing, billing, subscriptions, plan differentiation, @@ -295,29 +295,28 @@ Milestones, in order: - P7.1 — Production Security Baseline — ✅ Complete - P7.2 — Production Migration & Deployment Path — ✅ Complete / production validated -- P7.3 — Backup, Restore & Disaster Recovery — 🟡 Backup/off-site/restore - validated; scheduled systemd backup proof pending +- P7.3 — Backup, Restore & Disaster Recovery — ✅ Complete / production validated - P7.4 — Monitoring & Alerting — ⬜ Deferred / unstarted - P7.5 — Data & Time Correctness — ⬜ Deferred / unstarted - P7.6 — Network & Runtime Reliability — ⬜ Deferred / unstarted - P7.7 — Audit & Operational Integrity — ⬜ Deferred / unstarted - P7.8 — Final Launch Readiness Gate — ⬜ Deferred / unstarted -P7.1 and P7.2 are complete. P7.3 local/off-site backup and isolated restore -passed, but the scheduled service failed when Docker Compose attempted to read -`/srv/wctm/.env` as `wctm`. The corrected scheduler awaits live systemd proof; -the timer remains disabled. D-033 proposes pausing Phase 7 before P7.4 and -making Private Pilot Readiness next only after P7.3 closure. P7.4–P7.8 and -Phase 6 remain deferred/unstarted; historical provenance review stays assigned -to P7.8. No feature expansion or unrestricted public launch is authorized. - -## Private Pilot Readiness — Proposed Next Initiative - -Status: ⬜ Proposed under D-033, pending P7.3 scheduled-backup proof and a -separate acceptance. Its proposed scope remains privacy/data-flow and merchant -disclosures, legal/licensing baseline, connector admin UI and -`wctm.walterbyte.com` polish, focused QA, then a real-user private merchant -pilot. No pilot implementation begins in this branch. +P7.1–P7.3 are complete. P7.3 passed local/off-site backup, isolated restore, +and corrected scheduled systemd execution on `waltpack`; the daily timer is +enabled and active. D-033 accepts the Phase 7 pause before P7.4 and makes +Private Pilot Readiness the next active initiative. P7.4–P7.8 and Phase 6 +remain deferred/unstarted; historical provenance review stays assigned to P7.8. +No feature expansion or unrestricted public launch is authorized. + +## Private Pilot Readiness — Active Initiative + +Status: 🔵 Active under accepted D-033. Its bounded scope is privacy/data-flow +audit and merchant disclosures, licensing/legal baseline, WordPress connector +admin UI polish, `wctm.walterbyte.com` onboarding/product-surface polish, +focused security/quality QA, and controlled private merchant pilots with real +users. Engineering remains frozen except for pilot-blocking defects. No pilot +implementation begins in this branch. --- diff --git a/docs/PHASE_BREAKDOWN.md b/docs/PHASE_BREAKDOWN.md index a75077b..e67ba56 100644 --- a/docs/PHASE_BREAKDOWN.md +++ b/docs/PHASE_BREAKDOWN.md @@ -715,11 +715,11 @@ M22 final decision: PASS. Phase 5 final decision: COMPLETE. M17–M22 and all approved MVP Telegram product features are complete, Persian/English manager UX and backend-authoritative entitlement enforcement are operational, and no open Phase-5 feature blocker remains. Phase 6 commercial SaaS work has not started; -Phase 7 production-readiness was started by D-029. P7.3 remains open pending -scheduled-backup proof, so the D-033 pause is proposed, not accepted; -unrestricted public launch is not approved. +Phase 7 production-readiness was started by D-029. P7.3 is production-complete; +accepted D-033 pauses Phase 7 before P7.4. Unrestricted public launch is not +approved. -## Phase 7 — Production Readiness 🔵 In progress / incomplete +## Phase 7 — Production Readiness ⏸ Paused / incomplete ### P7.1 — Production Security Baseline ✅ Complete / Production Validated @@ -779,7 +779,7 @@ rewrite and are still assigned to P7.8. volumes/data, corrected deployment PASS, local/public health/readiness, and bounded product smoke. P7.2 is production-complete. -### P7.3 — Backup, Restore & Disaster Recovery 🟡 Scheduled Proof Pending +### P7.3 — Backup, Restore & Disaster Recovery ✅ Complete / Production Validated - D-032 establishes atomic PostgreSQL custom-format backups, SHA-256 and readability verification, non-secret metadata, explicit 14-valid-set default @@ -794,14 +794,15 @@ rewrite and are still assigned to P7.8. - A-owned production validation passed: custom dump and local SHA-256, OneDrive three-artifact transfer with streamed remote SHA-256, isolated network-none restore with 16 migrations/21 public tables and checked critical counts, - cleanup, and healthy final service/security scans. Scheduled systemd backup - then failed because Docker Compose attempted to read `/srv/wctm/.env` as - `wctm`; the timer was not enabled. P7.3 remains open until the corrected - scheduler passes live proof. Scheduled off-site execution retains the - explicit protected `RCLONE_CONFIG` path. + cleanup, and healthy final service/security scans. After correction of the + initial Compose `.env` access failure, `wctm-backup.service` completed as + dedicated `wctm` with `SERVICE_RC=0`, verified remote SHA-256, and completed + retention. The daily timer is enabled and active. The protected `.env` remains + inaccessible to `wctm`; scheduled off-site execution retains the protected + writable `RCLONE_CONFIG` path. P7.3 is production-complete. -P7.4–P7.8 remain unstarted/deferred. Phase 7 is incomplete; D-033 proposes a -pause after P7.3 closure. Historical provenance review remains assigned to P7.8. +P7.4–P7.8 remain unstarted/deferred. Phase 7 is paused and incomplete under +accepted D-033. Historical provenance review remains assigned to P7.8. ### Approved Phase 7 order @@ -814,7 +815,7 @@ pause after P7.3 closure. Historical provenance review remains assigned to P7.8. 7. P7.7 — Audit & Operational Integrity 8. P7.8 — Final Launch Readiness Gate -## Private Pilot Readiness ⬜ Proposed next initiative +## Private Pilot Readiness 🔵 Active initiative - Privacy/data-flow audit and merchant-facing disclosures - Licensing/legal baseline @@ -823,8 +824,8 @@ pause after P7.3 closure. Historical provenance review remains assigned to P7.8. - Focused security/quality QA - Private merchant pilot with real users and usage/payment evidence -D-033 proposes the engineering freeze except for pilot-blocking defects after -P7.3 closes. No pilot implementation is authorized in this task. +Accepted D-033 freezes engineering except for pilot-blocking defects. Pilot +tasks require separate authorization; none is implemented in this branch. ## Phase 6 — SaaS Platform ⬜ Deferred / unstarted diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md index f63a716..6769ba2 100644 --- a/docs/PROJECT_STATE.md +++ b/docs/PROJECT_STATE.md @@ -12,13 +12,13 @@ operationally validated under accepted D-028. M17–M22 and all approved MVP Telegram product features are complete; Persian/English manager UX and backend- authoritative basic entitlement enforcement are operational. Phase 4 and M1–M16 remain complete and unchanged. D-029 advanced the project into Phase 7 — -Production Readiness before Phase 6. P7.1 and P7.2 — Production Migration & -Deployment Path are complete. P7.3 — Backup, Restore & Disaster Recovery has -passed live backup/off-site/restore validation but remains open after the -scheduled systemd backup failed to read `/srv/wctm/.env` through Docker Compose. -The timer was not enabled. D-033 and Private Pilot Readiness remain proposed -until the corrected scheduler passes live proof. Phase 7 is incomplete; -P7.4–P7.8 and Phase 6 remain deferred/unstarted. +Production Readiness before Phase 6. P7.1, P7.2 — Production Migration & +Deployment Path, and P7.3 — Backup, Restore & Disaster Recovery are complete +and production-validated. The corrected scheduled backup passed live systemd +execution on `waltpack`, and the daily timer is enabled. D-033 is Accepted: +Phase 7 is intentionally paused and incomplete before P7.4; P7.4–P7.8 and +Phase 6 remain deferred/unstarted. Private Pilot Readiness is the next active +initiative, with engineering frozen except for pilot-blocking defects. Unrestricted public launch is not approved. --- @@ -27,12 +27,12 @@ Current Task P7.2 production validation passed on authoritative `waltpack` at reviewed revision `034b2f565fd6b2fc50d6942ff1a40ca16598703c`. P7.3 backup, -OneDrive off-site SHA-256, and isolated restore passed, but the first live -systemd scheduler start failed with `.env` permission denied as `wctm`. The -timer was not enabled. This task removes the scheduled backup's unintended -Compose `.env` dependency in the repository; A-owned live scheduler proof is -still required before P7.3 or D-033 closes. The earlier migration from `hetz` -succeeded; its WCTM deployment was removed and is not a rollback host. +OneDrive off-site SHA-256, isolated restore, and corrected live scheduled +service all passed. `wctm-backup.service` completed as `wctm` with +`SERVICE_RC=0`; the daily timer is enabled and active. This documentation +closure records the accepted D-033 pivot to Private Pilot Readiness. The +earlier migration from `hetz` succeeded; its WCTM deployment was removed and +is not a rollback host. --- @@ -815,25 +815,24 @@ AuditLog immutability enforcement is deferred to a future approved task. Current Blockers -P7.3 scheduled-backup production proof remains open. Public launch also remains -gated by unstarted P7.4–P7.8 and a separate A decision. Four historical -implementation-provenance findings remain unresolved for A's separate history- -remediation decision and the P7.8 final release audit; current tracked content -is clean and Git history was not rewritten. +Public launch remains gated by unstarted P7.4–P7.8 and a separate A decision. +Four historical implementation-provenance findings remain unresolved for A's +separate history-remediation decision and the P7.8 final release audit; current +tracked content is clean and Git history was not rewritten. --- Next Milestone -The next gate is A-owned P7.3 systemd scheduler proof. D-033 proposes Private -Pilot Readiness afterward; P7.4–P7.8 remain deferred/unstarted. +Private Pilot Readiness is the next active initiative under accepted D-033. +P7.4–P7.8 remain deferred/unstarted and require a separate resumption decision. --- Last Completed -P7.2 — Production Migration & Deployment Path is production-complete. P7.3 and -Phase 7 remain incomplete. +P7.2 — Production Migration & Deployment Path and P7.3 — Backup, Restore & +Disaster Recovery are production-complete. Phase 7 remains paused/incomplete. --- @@ -885,8 +884,8 @@ P7.1 Closure State - A has formally accepted D-030. Its staged architecture and history remain unchanged. A completed the protected production execution and validation; P7.1 is closed. -- D-029 remains Accepted. D-033 proposes a Phase 7 pause and Private Pilot - Readiness after P7.3 scheduler proof; P7.4 and later remain unstarted. +- D-029 remains Accepted. D-033 accepts the Phase 7 pause before P7.4 and + makes Private Pilot Readiness active; P7.4 and later remain unstarted. - Production configuration rejects committed development and test secret placeholders, short bot service credentials, pilot mode, debug/verbose log levels, and unrelated cross-boundary secret reuse without reporting values. @@ -978,8 +977,8 @@ P7.1 Closure State Redis reconciliation while retaining `wctm_runtime` for backend runtime. D-032 provides verified custom-format backup, retention, off-host transfer, daily scheduling templates, isolated restore, and DR procedures. Its live - backup/off-site/restore gates passed, but scheduled systemd execution failed - on `.env` access and P7.3 remains pending. + backup/off-site/restore gates and corrected scheduled systemd execution passed; + P7.3 is production-complete. - P7.4–P7.8, Phase 6, and product expansion remain deferred/unstarted. Monitoring stays P7.4, DATE-001 P7.5, network/runtime resilience P7.6, AuditLog structural immutability P7.7, and historical provenance/final launch gate P7.8. The @@ -987,7 +986,7 @@ P7.1 Closure State --- -P7.2 Closed / P7.3 Scheduled Proof Pending +P7.2 and P7.3 Production-Validated / Phase 7 Paused - P7.2 implementation commit: `91e16fd5933ffa4e6386d649f21f9e2592833ed5 chore(ops): establish production @@ -995,9 +994,8 @@ migration and deployment path`. - P7.3 implementation commit: `ddde3c705b249a29a131a3bfc96763f17b6e9cbc chore(ops): add production backup and recovery path`. -- D-031/P7.2 are production-validated. D-032 remains accepted for repository - implementation while P7.3 awaits scheduler proof. D-029/D-030 remain - accepted; D-033 is proposed, not accepted. +- D-031/P7.2 and D-032/P7.3 are production-validated. D-029/D-030 remain + accepted; D-033 is Accepted after the live scheduler proof. - `migrate` is an operations-profile Compose service built from a dedicated backend Dockerfile target. It runs non-root/read-only, contains the exact checked-out Prisma CLI/migrations, accepts a distinct credential only for one @@ -1034,21 +1032,31 @@ and recovery path`. credential, restricted `wctm_runtime` verification, all-PASS config audit, immutable PostgreSQL/Redis references and preserved named volumes/data, `deployment path: PASS`, local/public health/readiness, and bounded product - smoke. P7.3 partial evidence: verified 2,392,191-byte custom dump + smoke. P7.3 evidence: verified 2,392,191-byte custom dump `wctm-postgres-20261005T133652Z-034b2f565fd6.dump`, OneDrive three-artifact copy with streamed remote SHA-256 PASS, isolated network-none restore with 16 migrations/21 tables and checked critical counts, cleanup, and clean final - service/security scans. The live systemd service start then failed when - Docker Compose attempted to read `/srv/wctm/.env` as `wctm`; the timer was not - enabled. Exact evidence is in the combined operations runbook. + service/security scans. The initial live systemd start failed when Docker + Compose attempted to read `/srv/wctm/.env` as `wctm`. After the repository + scheduler correction, the service completed with `SERVICE_RC=0`, streamed + OneDrive SHA-256 verification, `retention: PASS`, and secret-safe journal. + The daily timer was enabled and active. Exact evidence is in the combined + operations runbook. - Scheduled backup now discovers the sole running PostgreSQL container through reviewed Compose labels with Docker directly, then passes its ID to the existing backup script. Protected external configuration supplies only the non-secret project label, backup path/retention, off-site destination, and - `RCLONE_CONFIG` path. This repository correction was not run on production by C. -- P7.2 is complete; P7.3 remains pending live scheduler proof. Phase 7 remains - incomplete, P7.4–P7.8 and Phase 6 remain deferred, and D-033/Private Pilot - Readiness remain proposed. + `RCLONE_CONFIG` path. A installed and validated this correction on production; + C made no production change. The protected `.env` remains inaccessible to + `wctm`. +- The scheduled backup `wctm-postgres-20261005T151246Z-unknown.dump` was + 2,404,925 bytes and its three artifacts were verified off-site. The `unknown` + revision is metadata-quality polish. Retention warned on some older + manually/root-created sets with relative checksum sidecars but returned PASS + and removed no set incorrectly. Neither observation reopens P7.3. +- P7.2 and P7.3 are complete. Phase 7 remains paused/incomplete; P7.4–P7.8 and + Phase 6 remain deferred; D-033 is Accepted and Private Pilot Readiness is + active. No public-launch claim or pilot implementation is made here. --- diff --git a/docs/operations/P7_2_P7_3_RUNBOOK.md b/docs/operations/P7_2_P7_3_RUNBOOK.md index cc1497c..2cb1d0a 100644 --- a/docs/operations/P7_2_P7_3_RUNBOOK.md +++ b/docs/operations/P7_2_P7_3_RUNBOOK.md @@ -1,10 +1,12 @@ # P7.2/P7.3 Production Operations Runbook -Status: P7.2 production validation PASS on authoritative `waltpack` at reviewed -revision `034b2f565fd6b2fc50d6942ff1a40ca16598703c` (2026-10-05). P7.3 -backup/off-site/restore checks passed, but its scheduled systemd service failed; -P7.3 remains open pending a successful live scheduler proof. D-033 is proposed, -not accepted. Phase 7 remains incomplete. +Status: P7.2 and P7.3 production validation PASS on authoritative `waltpack` +(2026-10-05). P7.2 deployed reviewed revision +`034b2f565fd6b2fc50d6942ff1a40ca16598703c`. P7.3 passed backup, +off-site verification, isolated restore, and corrected live scheduled service +execution; the daily timer is enabled. D-033 is Accepted. Phase 7 is paused +before P7.4 and remains incomplete; Private Pilot Readiness is the next active +initiative. ## Production validation record @@ -34,9 +36,37 @@ health/readiness, restricted role, backend/bot, PostgreSQL/Redis, and synchroniz pattern log scans were clean. The first live `systemctl start wctm-backup.service` failed with `open /srv/wctm/.env: permission denied`: Docker Compose tried to parse the entire application environment as service -user `wctm`. That account could read/write its rclone config, write the backup -directory, and access Docker. The timer was not enabled. The repository -scheduler correction below still requires live proof; P7.3 is not complete. +user `wctm`. The timer was not enabled at that point. The corrected scheduled +path was then installed and passed live validation: + +- Service-account prerequisites passed: `wctm` could read and write its + protected rclone config, write the backup directory, and access Docker. + `/srv/wctm/.env` remained inaccessible to that account. +- `wctm-backup.service` completed with `SERVICE_RC=0` and + `scheduled backup: PASS`. The journal recorded a custom-format production + backup with 16 migrations, successful OneDrive transfer of all three + artifacts, remote content SHA-256 PASS via `streamed-sha256`, and + `retention: PASS`. The service exited successfully; inactive/dead afterward + is expected for its `Type=oneshot` configuration. +- The scheduled backup `wctm-postgres-20261005T151246Z-unknown.dump` + (2,404,925 bytes) was verified. Its + `.dump`, `.dump.json`, and `.dump.sha256` artifacts were present in OneDrive + and content SHA-256 verification passed. A journal secret-pattern scan had + no findings; no production application secret was exposed. +- `wctm-backup.timer` was enabled and active (waiting), with a future + invocation confirmed. The initial next invocation was + `2026-10-06 02:18:28 UTC` under the reviewed daily schedule with randomized + delay. + +Operational follow-ups, neither a P7.3 integrity or closure blocker: the +scheduled filename's revision component was `unknown` because hardened systemd +execution did not resolve Git revision metadata. The backup remained valid, +checksummed, timestamped, custom-format, and off-site verified. Retention +warned while inspecting some older manually/root-created sets whose relative +checksum sidecars differed from the retention validation context; the new +scheduled backup was valid, retention returned PASS, and no set was incorrectly +removed. Revision metadata and legacy-set cleanup can be considered in a +separately approved operational task. The earlier real `hetz` to `waltpack` server migration also showed successful custom-format PostgreSQL restore, Redis state transfer, separate recreation of @@ -282,7 +312,10 @@ systemctl list-timers wctm-backup.timer journalctl -u wctm-backup.service ``` -These are instructions for A; C does not install or enable them. The unit +This sequence passed on `waltpack` on 2026-10-05; the commands remain the +procedure for future reinstalls or recovery. + +These are instructions for A; C did not install or enable them. The unit contains no secret. `/etc/wctm/backup.conf` holds paths and the optional remote name; `RCLONE_CONFIG` is a path only. Provider credentials remain in the operator's protected rclone configuration.