Repository navigation
feat(deploy): adopt SMRT maintenance releases with durable migration phases #236
Description
Prepare Iolaus adoption of happyvertical/smrt#4305 and merged foundation happyvertical/smrt#4326. Owner selected Iolaus first in Codex session 01a175ce-14e7-7ad0-a42e-b19db4d0c49f; live rollout requires separate authorization.
This work belongs in Iolaus because its migration wrappers, entrypoints, image CI and application requirements cannot ship in the SMRT framework branch.
Current preparation baseline: Iolaus main b912a17 (public-profile API #237 merged), SMRT main 29e903af0e. Published SMRT 0.57.32 and SDK 0.108.0 prerequisites are available; chart 0.1.0 is public with receipt in happyvertical/smrt#4305 comment6423916524. The previous publication blockers are cleared. Adoption now needs an owning-SMRT chart capability update to preserve Iolaus pod/container hardening and explicit migration observation authority, plus the coherent dependency, durable executor, startup and inactive CI/GitOps preparation below. Active rollout remains held.
Acceptance:
- Consume a published coherent SMRT closure with durable API; frozen install/build and package provenance pass.
- Dedicated migration command preserves runtime/static schema guards and early integrity restoration. Stable IDs/checksums and durable schema/backfill/seed/verify outcomes; prove mutation/marker executor affinity and truthful reconciliation of external effects. No blind shell replay.
- Recheck all-writer exclusion before mutation, retain pinned migration lock, require platform fencing for external writers.
- Remove web/task/schedule/monitor migration initContainers only with qualified replacement and read-only runtime readiness. Separate migration/runtime/monitor credentials; preserve extractor and worker heartbeat/drain.
- Named workloads with immutable image and versioned Secret references; trusted app CI tests actual image/wrapper and emits source/tree/lock/toolchain/chart/configuration bindings. Qualify HTTP responses and workers.
- Review ownership transfer, complete rendered RBAC/admission requirements and protected executor in IaC. No live mutation during preparation.
- Focused failure/retry/atomicity tests, repository gates, independent high-risk review and ready PR.
Related #179 documents the empty-database initContainer failure. Do not declare bootstrap exercised without the real isolated empty-database test. Do not use unpublished worktree dependencies or manufacture validation receipts. Platform configuration ships in IaC; SMRT #4305 stays open for Work and actual install/upgrade acceptance. Publication and rollout retain their separate authorization boundaries.
Activity
willgriffin commentedon Oct 26, 2026
Claimed by codex · session
01a175ce-14e7-7ad0-a42e-b19db4d0c49f· branchcodex/236-maintenance-adoption· 2026-10-25Status: review — ready PR245 at4500662bcc8e04e9728b58ab16c413017f071218 fixes reproducible missingstaticsecretsauthority beforefirstDBread:4directcoherentpublished0.57.32dependencies,module-relativepublicmanifestexports+packageNamefailclosed,4freshprocessmetadataregressions. Normalparitysnapshotproducer changesdependency/digests only; allsurfacesbyte-equivalent.22focused,4metadata,allrootgates/frozeninstall/MCPfreshnessPASS. R13 Astra/Opus sources CLEAN/no materialfindings; optionalcoldcasetimingprobe0.95–1.04s vs5s fulfilled,CIstillrequired. Samecyclebudget8420090/30000000. Source tagadoption-236-4500662bcc8e pushed; imagepublication40735413241 +CI40735179672/40735190456/40735413419 running; actualcurrentKind auto follows ONLY verifiedsource/NEW d383lockpair. Earlieractualfed9Kind40729724457 passescleanmigration butwebdatabasecomponentfails; other3runtimesready,cleanupcompleted. No currentactualsuccess/merge/livegoahead. IaC2419inactiveallCIgreen,mergeapprovalpendingonce; do notinferreadiness.
Previous claim updates (historical)
Status: review — ready PR245 atfed9add3e84eff19c08d3b22a2072174f4c0e1c1 adds bounded allowlisted runtime failure diagnostics (no raw Pod names/spec/messages/logs,10s request bounds).22focused/redactioncases and all current root gates PASS; full advancedR12 Astra/Opus both CLEAN for new log boundary, samecyclebudget7808007/30000000. Pushed sourcetagadoption-236-fed9add3e84e; publication40728006822 and CI40727977176/40727984802/40728008409 running. Actual current-source qualification remains mandatory before authorized merge. Prioraa9 all3CI nowSUCCESS (branch/PRattempt2),actual40723774455 proves missing-schema/writerrefusal+cleanmigration then runtime-readinessFAIL/cleanup. No queue-test or deadline change in currentrevision. IaC2419 inactivefoundation allCIgreen/CLEAN, unmerged/unselected; separate newIaCmergeapproval question pending; no livegoahead.
Previous claim updates (historical)
Status: review — ready PR245 ataa9e924999fd20c78e8be5d343dcc0e31bbfc8d8 repairs explicit rendered-chart namespace binding; JSON multi-namespace fixture argv unchanged. Executed old-callback/current-argument regression and all documented root gates PASS (21focused); fullR10 coverage plus two CLEAN balanced R11 codexsol/Sonnet delta reviews. Cycle iolaus-236-6406194324 budget7602688/30000000 unchanged. Pushed source tagadoption-236-aa9e924999fd, current image publication40722259623 and branch/PR/tagCI running; actual current-source Kind follows and remains mandatory before authorized merge. Prior74bf allCI/imagepair PASS but actual40720467481 failed namespace readiness and cleaned up. Live adoption held; new IaC2418 inert identity/observer foundation is preparing reviewed source only, no selection.
Previous claim updates (historical)
Status: active — exact74bf610 all branch/PR/tag CI and matching image publication40718663068 PASS. Actual Kind40720467481 passes image identity/Postgres/maintenance rendering and cleans up, but fails immediately at fixture-maintenance-ready. Source inspection finds rendered chart resources omit metadata.namespace and generic apply supplies no namespace, so they land in default while the next read targets the isolated qualification namespace. Preparing explicit namespace binding for rendered chart applies only; multi-namespace explicit JSON fixtures retain their own namespaces. No timeout/assertion relaxation; same review cycle/budget and owner further-review/qualified-merge authorization.
Previous claim updates (historical)
Status: review — ready PR245 updated at74bf610060711f5e1649337458de2265ab8fae2e with verified published chart0.2.1/runner pins and normally integrated main5f95d9f. Frozen install,20focused,actionlint,yamllint,all documented root gates and MCP freshness PASS; fresh full round10 gpt6astra/Opus both CLEAN, cycle iolaus-236-6406194324 budget7520826/30000000 unchanged. Persistent coverage/review evidence /Users/will/.codex/evidence/iolaus-236-recovery/review. Watching current-head CI40718618655/40718634460; matching source-tag image publication/actual Kind qualification follow and MUST pass before already-authorized merge. No live go-ahead; metadata-only current platform still lacks dedicated SAs/versioned actor Secrets and retains migrate initContainer.
Previous claim updates (historical)
Status: active — user reiterated see-through authorization; upstream4433 merged and chart0.2.1 publication40715450610 running. Integrated current main5f95d9f (public assistant/voice and released manifest cwd fix) normally at786c0aa before new final-source validation. Workflow chart selection prep remains uncommitted; actual new pins await verified publication. Same review cycle/budget, further reviews and qualified245merge already authorized; live readiness gates retained.
Previous claim updates (historical)
Status: active — owner approved queue/publication of reviewed upstream SMRT4433/chart0.2.1 and resumed qualification. All4433checks passed, but normal ReleaseAdmission is drained while owned package batch40553305839 publishes; no queue bypass. Preparing Iolaus workflow to derive chart version/archive path from its validated prerequisite record while awaiting the actual new publication receipt. Existing verified0.2.0 pins will remain until real0.2.1 OCI/package/source identities are available; no invented digests or qualification success. Currentbranch codex/236-private-image-qualification, HEAD59a2a446b1e40ac0d5b7ce8492df9bdbf2e4a150. Existing conditional245merge/furtherreview authorization applies after fresh CI/actualqualification; live readiness hold remains. Same cycle iolaus-236-6406194324, recovered ledger in /Users/will/.codex/evidence/iolaus-236-recovery/review; no reset.
Previous claim updates (historical)
Status: blocked — #245 exacthead59a2a446b1e40ac0d5b7ce8492df9bdbf2e4a150 has CLEAN independent round9 reviews, all branch/PR/tag CI green and immutable pair published40536478724. Actual Kind40538228141 passed image identity, cluster and PostgreSQL setup, then failed fixture-maintenance-render; cleanup-completed. Exact packaged chart0.2.0 local reproduction reports blanket SMRT_ migration environment rejection for required SMRT_RUNTIME_PROFILE/SMRT_APP_ID. Upstream repair is ready SMRT#4433 (034956247); independent review/local gates and actual Kind/Flux chart CI pass, final PG and new upstream merge/publication authorization pending; do not work around the chart or claim qualification succeeded. Next: reviewed upstream chartfix/publication, verified newpins and source images, actual qualification. #245 remains ready/unmerged and live adoption held; platform gaps comment6446907356 also apply. Power loss cleared /tmp evidence; immutable code and GitHub logs/artifacts survive, ledger recovered unchanged under /Users/will/.codex/evidence/iolaus-236-recovery/review (cycle iolaus-236-6406194324 round9,7053603/30000000). Lost coverage artifacts require fresh full coverage before further delivery.
Previous claim updates (historical)
Status: active — owner authorized further reviews and qualified merge of #245. Round8 independent reviewers both CLEAN at9acc704; branch Validate40532343893 and tag Validate40532538940 green, matching immutable pair published40532539062. PR Validate40532353453 failed the existing3s queue-revocation wait; actual Kind40534242281 verified image identity and cluster creation but failed at fixture-setup, with cleanup-completed. No success receipt or adoption live go-ahead. Preparing one batched repair: native revocation fixture identity lookup before dispatch (deletion and fresh authority check remain inside handler; same assertions/deadline), TCP-only PostgreSQL fixture readiness, bounded fixed substage markers. Full local checks running; same cycle iolaus-236-6406194324, existing30M ledger, round9 next after validation. Actual current-source Kind and allCI remain mandatory before merge.
Previous claim updates (historical)
Status: active — user explicitly authorized necessary reviews beyond six passes and merge of the prepared private-image qualification repair after independent review, CI and actual qualification pass. Same cycle iolaus-236-6406194324 and30M token cap; no policy-file change or budget reset. Current branch codex/236-private-image-qualification, HEAD c43c321, base da5fe11. All local gates green; starting full high-risk round7 for the new ephemeral CI-to-Kubelet read-credential boundary.
Previous claim updates (historical)
Status: blocked — #242 merged at da5fe11; matching candidate pair published successfully (run40516517450 attempt2). GHCR site package is private and anonymous auth returns401; visibility preserved. Prepared seven-file private-image repair at local commit
c43c32181707476eebb1d9c61207535370f99bc0, branchcodex/236-private-image-qualification, checkout/Users/will/.codex/worktrees/4019/iolaus. All local root gates,18 focused tests,YAML/actionlint/MCP freshness pass. Patch/tmp/iolaus-236-prep/private-image-qualification/private-image-qualification.patch; full planned review packet/evidence round7 preflight passes. No reviewer dispatched and no push/PR for unreviewed repair. Next: user authorization to exceed local AGENTS six-review limit (question pending in coordinating chat), then review, CI, repaired-source candidate images and actual Kind qualification. Same cycle iolaus-236-6406194324, budget6240188/30000000 unchanged. Source da5 main Validate40516407061 attempts1+2 retain unchanged3s SQLite permission-fence queue timeout; exact-source tag Validate40516517986 passes, six focused Node26.10 suites pass and current repair whole root passes; no timeout/assertion changes. Live chart adoption remains unqualified: provider/inflight and platform ownership mapping (extra source-crawl CronJob/static-site inventory) still required; independent v0.7.2 healthy.Previous claim updates (historical)
Status: active — #242 merged and exact-source candidate images published. Qualification found that the existing site image package is private (extractor public); anonymous registry pull returns401. Preserve package confidentiality and prepare bounded ephemeral packages:read authentication for disposable Kind only on branch
codex/236-private-image-qualification. No package visibility or live deployment change. Same #236 claim, review cycle and ledger retained; source repair will need review beyond completed round6 under local AGENTS policy before publication. Existing public chart/runner pins unchanged.Previous claim updates (historical)
Status: active — user explicitly authorized #242 merge and candidate publication/qualification. PR #242 merged at
da5fe11ce80a9a9429202b991597e4390d1baf01, exact reviewed tree60ef4cf22beac9a0c4d6e902737af14e4c6be280; all six prior-head CI jobs and both reviews green. Manual workflow now registered. Next: isolated exact-merged-source candidate image pair, actual Kind wrapper/operator qualification, then provider/inflight/platform/ownership readiness. No chart-adoption live go-ahead or live mutation has occurred. Existing cycle/budget retained.Previous claim updates (historical)
Status: blocked — updated ready PR #242 at
3799579bdeab37994323eedd08ce87508e57b92ebinds the public chart0.2.0/runner pins and preserves shared installation operators after integrating main #244. Both original advanced reviewers CLEAN; all local documented gates and regression/actual auth guard suites pass. All push/PR workspace/PostgreSQL, browser and candidate-image CI is SUCCESS; GitHub MERGEABLE/CLEAN, no unresolved threads; committed test-merge tree equals reviewed tree. Next external action: explicit #242 merge authorization after CI passes, so GitHub can register the new manual qualification workflow; then publish matching final-source candidate image pair and run actual Kind wrapper qualification. Independent v0.7.2 has its conditional go-ahead and jobgeni.us confirms healthy deployment; it excludes #242. Chart adoption is not yet qualified for live rollout. Current review cycle iolaus-236-6406194324 round6; budget6240188/30000000, current-head two recalls673124tokens, unknown0. Receipt #242 (comment) .Previous claim updates (historical)
Status: active — user authorized the #242 verified chart0.2.0/runner pin update and continued adoption qualification on 2026-10-27. Same codex session and branch; existing review cycle iolaus-236-6406194324 and ledger retained. Coordinate with jobgeni.us; conditional live go-ahead only after actual-image qualification and platform/ownership/provider prerequisites are established. No rollout has occurred.
Previous claim updates (historical)
Status: blocked — PR #242 source preparation remains ready and unmerged. SMRT #4414 has now merged; chart0.2.0 is public and independently verified. Immutable OCI/package/public-runner pins. The prior publication blocker is resolved. Next action: reviewed pin update to the inactive prerequisites, matching public final-source image pair, then actual-image wrapper qualification. The currently committed null pins still fail closed. Live Iolaus rollout remains separately held. No live rollout, migration, grants, ownership transfer or active image/promotion changes occurred.
Previous claim updates (historical)
Status: blocked — source preparation is independently reviewed and ready as PR #242 (#242), exact head
670dd20e2af4ce436b7ac4fec57e3653a5412a84. Next external action: authorize the already-green SMRT PR #4414 merge through its required queue and chart0.2.0 protected publication; then review exact OCI/package/public-runner pins and matching public final-source images before executing actual Iolaus wrapper qualification. Live rollout remains separately held. No active base/production/promotion/authorization-policy edits or live migrations/grants occurred.Prepared coherent57identity SMRT0.57.32/SDK0.108.0 closure; durable pinned-session migration catalog; fresh native TLS observer; explicitly selected strict readiness preserving legacy owner/local startup; physical PK/FK/index+column-unique attestation; narrowly verified completed-tombstone cleanup/export; inactive per-actor/auth-explicit candidate and fail-closed actual-image CI. Root gates passed with the existing two-worker Vitest execution cap, unchanged assertions/timeouts; final bounded guard fix has fresh affected checks and realPG regression. Real native PostgreSQL and SQLite test evidence retained; default-parallelism timing failures recorded rather than erased. All push and PR CI jobs are green; GitHub reports MERGEABLE/CLEAN with no unresolved threads or required reviews. The operator-role PR #240 advanced main to20b8cfc during creation; both original reviewers checked its interactions CLEAN, and the actual committed combined tree88ff5fc passed focused auth/seed/runtime tests plus full types.
Independent high-risk full review and accepted-fix recalls: gpt-6-astra, claude-opus-5-5; original startup opt-in/native API-list fixes resolved, final column-unique fix CLEAN. Cycle
iolaus-236-6406194324, round4, no unresolved accepted findings. Coverage/tmp/iolaus-236-prep/review/coverage-current.json; retained issue-mirrored budget/ledger4522573/30000000, current-head recalls3/942012 tokens and no unknown usage. Docs/test matrix in PR state the unexecuted actual-image/provider/inflight/ownership-transfer/live gates explicitly; no fabricated receipt or full live bootstrap claim.Dedicated local fixture compose
codex-236-maintenance-adoptionwas stopped and removed; compose inventory confirms no owned project remains. Source checkout/Users/will/.codex/worktrees/4019/iolausremains clean. jobgeni.us coordination confirmed this preparation stays separate from its operator/source-permission work and current deployment.Hindsight retention was attempted but the service remains offline; validated contracts and the test-design lesson remain in canonical docs/PR evidence, not a guessed memory entry.
Previous claim updates (historical)
Status: active — user explicitly selected implementation coordinated in this chat. The user authorized adoption preparation, direct jobgeni.us coordination and continued live-rollout hold. The foreman skill requires a separate visible execution chat for this multi-item/two-repository plan, while the app requires explicit authorization to create it. Pending question offers a gpt-6.1-sol foreman or explicit instruction to keep implementation in this chat. No source edits or PR yet.
Concrete execution plan: #236 (comment). Upstream chart prerequisite: happyvertical/smrt#4305 (comment). Fresh Iolaus base b912a17 contains API#237, no open Iolaus PRs at scope check. Isolated checkout /Users/will/.codex/worktrees/4019/iolaus is clean. Normal frozen install, full build, knowledge check and six focused migration/startup suites (36/36 cases) PASS. MCP reflection/architecture workflow called; Hindsight remains offline. No live DB, app, image-pin or infrastructure mutation.
Next: act on the user's execution-chat choice, hand off/claim deliberately, then prepare the owning-SMRT security/observer/scratch chart capability PR and Iolaus coherent dependency/durable migration/read-only startup/inactive CI work under the test matrix. Preserve all data, disabled legacy personal imports, existing operator/public-search deployment and live rollout hold. Iolaus review identity iolaus-236-6406194324; no paid review run yet. Local brief/evidence /tmp/iolaus-236-prep is convenience only; portable plan is linked above.
Execution choice received: keep implementation in this chat. This explicitly overrides foreman separate-chat step only; retain scoped balanced workers, distinct repository branches/PRs/releases, test matrix, integrated validation and independent review. No new chat, merge, publication, active pin update or live rollout authorization inferred.
Status: active — actualaa9 Kind40723774455 proves maintenance readiness, missing-schema refusal, unknown-writer refusal before writes and clean migration, then runtime readiness times out180s and cleanup completes. Preparing bounded allowlisted Pod-state/log-category diagnostics without raw child output to diagnose this actual blocker. Branch/PR attempt1 hit same3s native revocation timeout; identical-source tag40722260649 allCI succeeds, failed-job reruns are in progress. Native identity-collection initialization may be separated from counted handler while fresh data reads/deletion/permission fence stay inside; assertions/deadlines preserved. Existing cycle/cap and owner authorization retained, no merge/livegoahead.
Status: active — actual4500662 Kind40736931167 passes all runtime readiness, HTTP and operator checks, then fails worker-and-monitor with successful cleanup. Adding fixed worker/monitor substage markers and existing bounded allowlisted monitor Pod/log diagnostics; no timeout, authority or success-assertion relaxation. Same cycle iolaus-236-6406194324 and existing further-review/qualified-merge authorization; no live go-ahead.
Status: review — currenta87a01628a45 pushed/tagged, all localgates/MCP PASS, balancedR14 sol/Sonnet CLEAN with continuousR13 coverage; cycle8490965/30M. Matching source imagepublication/currentCI/actualKind remain mandatory before authorized245merge. No livegoahead.
Status: active — exacta87a all3CI/publicationPASS, actual40740452558 passes migration/readiness/HTTP/operator/both idleSIGTERM checks, then monitor Pod OOMKilled exit137 at256Mi; cleanup-completed. Correcting inactive candidate monitor budget to512Mi matching existing reviewed production overlay, preserve250mCPU/256Mirequest/restrictedrole/allassertions/timeouts. Samecycle/cap and existing furtherreview/qualifiedmergeauthorization. No livegoahead.
Status: review — currente845807c4321 pushed/tagged with onlycandidate512Milimit/docsdelta,allrootgates/MCPpass,twoR15balancedsol/SonnetCLEAN,continuouscoverage/cycle8553454/30M. Sourcepublication40742432530/currentCIrunning;actualsourceKindincludingmonitorcompletion/cleanupmustpassbeforeauthorized245merge. Prior a87actualmonitorOOM137successfullydiagnosed,allpriorchecks/cleanupPASS. No livegoahead.
Status: active — exacte845all3CI/publicationPASS, actual40744066432nowpassescount-onlymonitorwith512Mi andallpriorchecks, thenfails source-and-extractor in1s, cleanup-completed. Sourceinspection shows adoptionworkflowomits existingnormalCI prepare-parity-isolation.sh requiredbyhostreviewed-inventory unshare boundary. Addsamefail-closedprerequisite andboundedfixedchildparitystage diagnostics plusseparatestaticparity/extractorcheckpoints. Existingassertions/timeouts/privileges/networkdenial remain. Samecycle8553454/30M,noreset,existingqualifiedmerge/furtherreviewauth;no livegoahead.
Status: review — PR #245 now at d7fd6f9, pushed and tagged. All 11 local gates and MCP freshness pass; round16 sol/Sonnet independently CLEAN, continuous prior coverage retained. Stable cycle budget8,661,358/30M. Current source image publication40746088479 and all three CI runs are running; the pipeline will verify the official pair and dispatch actual Kind once. Monitor completion and all earlier stages passed at e845; final parity remains unqualified until this source passes host isolation, parity, extractor and cleanup. Existing conditional #245 merge authorization applies. Live adoption remains held.
Status: blocked — source preparation is merged and qualified: PR #245 at c2686bd, exact merged/qualified tree equivalence, all nine actual checks + cleanup and all three CI runs pass. Receipt: #236 (comment). Remaining adoption requires platform readiness: pending explicit IaC #2419 merge authorization; versioned actor credentials, DB privilege/populated rehearsal, protected executor/fences/admission, complete ownership and approved real-provider/inflight tests. No live go-ahead. Next: resolve pending foundation approval and complete reviewed platform gates; preserve this qualified source/image receipt and existing claim/review identity.
Status: active — source qualification #245 is complete; owner authorized finishing remaining platform qualification and conditional go-ahead. Published chart needs a strict continuous static class to preserve legal-site availability, with app-owned observer verification rather than unknown-Pod exceptions. Preparing that observer boundary on codex/236-continuous-static-observer from current main, preserving this claim/review cycle and current normal release coordination. No live adoption activation.
Status: blocked — awaiting human authorization.
Application source
dcb4ef3d63146417a297293c255bf6d255137180in ready PR #275 has all six exact-commit CI runs green and two advanced independent reviews clear. Overall adoption qualification remains held for the consolidated prerequisite approval, final SMRT/chart and platform publication/qualification, and the separate GPU/OCR decision. Supporting real mail/AI/drain evidence is recorded under the controlled budget; no additional provider/mail/OCR calls or live rollout go-ahead. Resume under the same claim/cycle and verify every actual readiness gate before authorizing jobgeni.us rollout.willgriffin commentedon Oct 26, 2026
Adoption design checkpoint (read-only discovery)
Source: Iolaus
9c2a5a7, SMRTe4a97858cb. No application code or manifests changed; no live rollout. Independent Work adoption remains outside this preparation.Implementation order and boundaries
vendor/release/published-closure.json). Verify the installed public migrations export, not only registry version metadata. Current latest 0.57.30 tarball conclusively lacksDeploymentPhaseTracker.withSmrtDatabaseMigrationLockinapps/site/scripts/db-common.tscurrently pins only the advisory-lock session and gives the callback the pooled database; do not claim marker/work affinity for that callback. Raw SQL steps can use the durable transaction handle only after helpers accept that executor.backfill-smrt-native.ts,backfill-resume-admin.tsandbackfill-resume-source.tsresolve collections independently; resume-admin additionally writes asset files. Give those operations actual completion inspectors/idempotency or explicit needs-repair handling, not a wrapper receipt.apps/site/scripts/jobs-worker.tscallsensureSourceScheduleTable(db)before starting; inspect schedule entrypoint and nested runtime helpers too. Normal queue processing/recovery remains runtime work after schema readiness. Local SQLite onboarding remains supported independently; the durable deployment API is PostgreSQL-only.scripts/check-self-hosted-manifests.mjswith the topology: it currently requires migration initContainers and their Secret.Behavior-to-test contract (planned; execution pending released dependency)
All deployed mutation rows use the migration principal, complete writer-exclusion proof and PostgreSQL; local SQLite compatibility is a separate nondeployment row. Each listed command is required future evidence, not a pass claim.
node scripts/verify-published-closure.mjs; frozen install/buildpnpm deploy:self-hosted:checkRequired repository completion gates:
pnpm format-check,pnpm lint,pnpm check,pnpm test,pnpm build,pnpm knowledge:check; database-sensitivepnpm --filter @willgriffin/iolaus-site db:migrateanddb:statusagainst an isolated DB. High-risk trigger: deployment lifecycle and persistent data mutation; independent high-risk review required before a ready PR. Actual base/head regression evidence required for startup DDL removal; fixture or source-string assertions alone do not prove packaged startup safety.Current prerequisite evidence
charts/smrt-appentry in successful paginated HappyVertical container package inventory.smrt-chart-publicationabsent (only copilot, github-pages and release present); do not dispatch publication into an implicitly created unprotected environment.willgriffin commentedon Oct 26, 2026
Concurrent-session boundary
Owner flagged the active
jobgeni.uschat on 2026-10-25. Read-only inspection confirms it initiated foreman chat01a175d0-4bcf-7d13-9b14-2855f074b4a1, implementing epic #234 / API #235 and preparing willgriffin/jobgeni#22 plus happyvertical/iac#2404. Its new willgriffin.dev site remains local pending owner design review; current JobGenius publications/data/domain behavior must be preserved.This #4305/#236 session has made no Iolaus source, dependency, image-pin or live manifest edits. Keep this session on reusable SMRT deployment/publication prerequisites for now. #236 records deployment-contract adoption, not ownership of the public-profile API, site design, API release image promotion or domain cutover. Coordinate the eventual dependency/CI/migration changes against that foreman's current main/PRs before editing overlapping application files. Neither chat's authorization implies permission to deploy or cut over the other chat's target. No cross-chat prompt has been sent by this session.
willgriffin commentedon Oct 26, 2026
Upstream prerequisite update — 2026-10-26
smrt-chart-publicationnow exists with required reviewer willgriffin and main-only deployment policy.Continue actual app adoption from the recorded executor/reconciliation/startup test matrix after coordinating the published dependency bump with jobgeni.us. This update does not claim adoption or bootstrap/upgrade acceptance.
willgriffin commentedon Oct 26, 2026
Publication prerequisites delivered — adoption still separate
SMRT PR #4394 merged through the required queue. The protected main publication succeeded: https://github.com/happyvertical/smrt/actions/runs/40374058221. Chart smrt-app0.1.0 is public and anonymously pullable from
oci://ghcr.io/happyvertical/charts/smrt-app.sha256:54805dd0e03c701ba6901ca3e2285a34c7d17708d0de33903966f7479c0afc1a1d8051424d14e6038c69505040ac6f5d4a62f3e32e0620a4122dc9ddb93b8996Portable receipt and remaining acceptance: happyvertical/smrt#4305 (comment). Prior package/chart-publication blockers are cleared; release this issue's blocked label for separately coordinated adoption preparation. No active implementation claim is held. Do not confuse available artifacts with completed app adoption: the executor/reconciliation/startup/CI matrix still needs implementation and actual representative install/upgrade evidence.
Direct completion receipts sent to jobgeni.us and its foreman. Its independently authorized current release remains separate. No Iolaus source/dependency/image-pin or live rollout changes were made by the SMRT publication session; this task's Iolaus deployment-contract rollout remains held until separate user authorization.
willgriffin commentedon Oct 27, 2026
Iolaus #236 adoption preparation — execution brief
Authority and outcome
User authorized Iolaus #236 adoption preparation and direct coordination with the jobgeni.us chat. Live Iolaus chart rollout is explicitly HELD until separate authorization. Deliver reviewable upstream and downstream code/PRs with honest validation and dependency gates. No merge, new publication, image promotion, active GitOps pin change, live migration, production probe mutation, shared-storage/controller changes or domain cutover is authorized by this prep request. Prior authorization to merge SMRT #4394 and publish chart0.1.0 was fulfilled; do not reuse it as blanket merge permission.
Use implement, claim-issue, test-design-contract, capture-project-memory, review-cycle and ship, plus current repository instructions. Use balanced Codex target from current model map (resolved gpt-6.1-sol/medium at planning), explicit models for any workers; advanced only for genuine lifecycle/architecture reasoning and required high-risk review. Foreman has a fresh separate user-visible chat; planner remains coordinator and can read status. No unnecessary new qualification environment or bespoke provisioning framework. Disposable in-process tests first; only integration may start one branch-named compose stack, always down before handoff.
Current repositories/branches and ownership
Coordination and hard holds
Parent jobgeni.us chat01a1186f-7799-7a52-bbe1-a754589423dc confirmed this work is separate from its completed operator/public-search deployment. Its foreman01a175d0-4bcf-7d13-9b14-2855f074b4a1 is idle at latest snapshot. No open Iolaus PRs at planning. Coordinate dependency/startup/CI ownership directly as user-authorized; do not repurpose the public-profile foreman or override its independent user constraints. Existing public-profile API behavior/data and current release remain intact. Refresh remote main/claims/instructions before editing.
Available published prerequisites
SMRT0.57.32 minimum contains DeploymentPhaseTracker from @happyvertical/smrt-core/migrations; public consumer import and core/config/scanner/types closure verified. Core requires standard SDK packages ^0.108.0; Iolaus currently pins standard SDK0.103.5 and SMRT0.55.19. Registry latest standard sql/ai/files0.108.0 confirmed. Independently versioned PDF/OCR are not standard SDK version numbers; retain unless evidence requires upgrade and qualify the coordinated published override policy. Do not force the old SDK below SMRT's declared minimum, use unpublished worktrees or fabricate registry integrity.
Chart smrt-app0.1.0 is PUBLIC: oci://ghcr.io/happyvertical/charts/smrt-app; OCI digest sha256:54805dd0e03c701ba6901ca3e2285a34c7d17708d0de33903966f7479c0afc1a; tar SHA2561d8051424d14e6038c69505040ac6f5d4a62f3e32e0620a4122dc9ddb93b8996. Portable receipt happyvertical/smrt#4305 (comment). Do not overwrite0.1.0. Any new capability consumes a newly versioned published chart after its separate reviewed delivery, not a silently modified0.1.0 artifact.
Discovered upstream chart gap — resolve in SMRT first
Chart0.1.0 templates/_helpers.tpl and templates/migration.yaml disable automatic SA tokens and do not render pod/container security contexts. Migration also has no scratch mounts or explicit observer SA/token projection. Iolaus's existing workload envelope requires non-root10001, seccomp RuntimeDefault, no escalation, all capabilities dropped, read-only root and /tmp scratch. Its migration safety callback needs fresh real writer-exclusion evidence. Do not weaken scripts/check-self-hosted-manifests.mjs or substitute an unverified passed flag.
Prepare a bounded additive chart/runner contract for explicit pod/container hardening, migration scratch, pre-existing migration observer SA and optional short-lived projected API token/CA/namespace access. Runtime API token mounting stays disabled. Prefer narrow typed fields, reject unsafe/unknown fields; no raw PodSpec, host paths, privileged containers or generic escape hatches. Preserve old fixture compatibility where safe, document intentional security constraints and choose a new chart version (proposed0.2.0, finalize according to actual compatibility).
Read charts/smrt-app/values.schema.json, templates/_helpers.tpl, migration.yaml, runtime.yaml, scripts/deployment/live.mjs, release.mjs, README and tests together. Extend complete resource/ConfigMap/SA authorization/admission preflight and immutable identity observation for every new declared field. Existing pull-secret inheritance/default SA requirements must be verified, not guessed. Token projection should use bounded native TokenRequest semantics and root CA; never long-lived env-token shortcuts, TLS verification disablement or app cluster-admin. Platform owns pre-existing SA/RBAC/credential delivery. Prepare requirements, do not apply live grants.
Tests: valid/invalid security fields, runtime token non-exposure, migration identity/scratch preservation, missing SA/RBAC/CA and unexpected fields failing preflight, altered identity blocked, actual container execution under hardened envelope in existing disposable exercise. Focused chart/runner suite first, then owning documented gates/review; no root application-suite rerun solely because this workstation differs. Reuse prior broad evidence only with explicit unchanged-input provenance and owner affected-only direction, never call unrelated stale logs current.
Iolaus implementation order
Validation and test contract
Use the full behavior-to-test matrix at #236 comment6406214634, updated for new reachable boundaries and disabled legacy effects. Every row names trigger, positive/negative, actor/context, executor/transaction, runtime/dialect, external edge, level and exact command. Migration actor is the dedicated maintenance principal; runtime/monitor roles are separate and must fail DDL. Deployed durable pipeline PostgreSQL-only; local compatibility SQLite separate. A fake in-memory ledger is not real atomicity evidence.
Required real PostgreSQL cases: clean bootstrap, existing schema/data upgrade, sentinel retention, failure-before-write guard, transaction rollback+marker atomicity, lost COMMIT response/retry, concurrent migrators, changed checksum refusal, ambiguous interrupted reconciled step needs-repair, completed-step skip with fresh safety recheck, runtime role startup without DDL, missing-table refusal, restricted monitor. Use isolated synthetic fixtures, no production data/credentials. SQL errors/logs redacted. No failure injection on live target.
Worker tests include SIGTERM drain and unknown/terminating writer refusal. Chart/CI cases include malformed/missing/unknown config, missing refs/RBAC, wrong image/architecture/HTTP500, exact identities and no active deployment wiring.
Iolaus full completion gates once integrated: pnpm format-check; pnpm lint; pnpm check; pnpm test; pnpm build; pnpm knowledge:check. For DB changes run documented site db:migrate and db:status against isolated fixture DB only. MCP reflect-domain-knowledge and build-domain-architecture-context were called; use smrt-review/get-agent-skill plus knowledge freshness per AGENTS before independent review. High risk: deployment lifecycle, credentials, persistent data. Exactly two independent advanced reviewers on exact committed revision, then only accepted blockers and affected retests/targeted recalls; retain stable coverage/budget.
Current baseline evidence and next checkpoint
Iolaus b912a17 normal frozen install and full build PASSED. Hindsight is offline; don't block on unrelated service repair or retain guesses. MCP reflection and architecture bundle called against this root. Full source inspection found disabled personal backfills and upstream chart integration gaps above. No app/chart source edits or live mutations yet. Local evidence /tmp/iolaus-236-prep is convenience, not uploaded portable proof.
First execution checkpoint is the concrete upstream chart contract patch/tests and ready PR. Do not infer merge/publication authority; once reviewable request only that concrete delivery approval if needed. Iolaus may progress independent published-dependency and executor work, but cannot claim a qualified installable chart integration until its required new chart version is released. Keep PRs ready with precise blocked handoff where an external release/approval prevents completion. Iolaus rollout remains held even after source PRs merge.
36 remaining items
fix(deploy): locate monitor qualification failures safely
fix(deploy): size monitor for actual Node runtime
fix(deploy): prepare isolated parity executor in adoption CI
willgriffin commentedon Oct 28, 2026
Source adoption qualification is complete and PR #245 merged at
c2686bd9348b109d4181e4b1f35a5e8b0eaea42b. The merged tree is byte-for-byte the reviewed/qualified treecf712c397587e526462b514065612098bbbf40eafrom sourced7fd6f95bde4c3fc76f94ef2c74d9ead137459aa.Actual qualification40747710103 succeeded, including host-isolation preflight and cleanup. The retained receipt verifies all nine checks: missing-schema refusal without DDL; unknown-writer refusal before mutation; projected-observer clean bootstrap; ephemeral read-only registry pulls without app credential projection; HTTP/private denial; operator revalidation; both idle worker SIGTERM/restart; column-restricted monitor; source byte-parity and actual extractor envelope. All three exact-head CI runs40746089471/40746084137/40746072993 and image publication40746088479 succeeded.
Verified chart0.2.1 OCI
sha256:ef21ebf62855e8934718d361a8b3c8851c59816ddcbe1cc7bd6bfbe3f986a605, packageSHAf3f226c404e96a02ddbf4188bb72d7cc1e7ca9dff239b10924005f7f2828f425, runner0049ed89f822f11207b5885049b7a1c8b91f282f; lockSHAd3831e1c67837e74326118b05520b6966fa079e4d1baa8682ebded2ff0107ecc.Qualified Linux/amd64 platform images:
ghcr.io/willgriffin/iolaus/site@sha256:5c9c403e8bbf4316c1d588be87fd3b75a2f84e259e108e731bb84fbcee21308cghcr.io/willgriffin/iolaus/resume-import-extraction@sha256:cf59496bcb5baf498b650f0f7f4ec6d5a42419932380dcd0d20cec4505470c14Independent full high-risk and targeted review coverage reaches this exact source, cycle
iolaus-236-6406194324, budget8,661,358/30,000,000. Persistent receipt/verification/merge-equivalence evidence:/Users/will/.codex/evidence/iolaus-236-recovery/parity-prerequisite/.Live rollout remains held; #236 remains open. This receipt is explicitly synthetic Kind qualification, with real vendor effects unqualified. Platform foundation happyvertical/iac#2419 is reviewed/CI-green but unmerged/unselected, with its explicit merge-authorization question pending. Production still needs versioned actor bindings, DB privilege/ownership attestation and populated restore/upgrade rehearsal, protected executor/admission/writer fencing, complete Flux-to-Helm ownership including static/crawl workloads, and approved real-provider/inflight evidence. No live go-ahead or production mutation is implied by this merge.
fix(deployment): verify dormant legacy ReplicaSet ancestry