Skip to content

ops: reconcile hosted configuration presence #1271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BigSimmo merged 6 commits into from
Jul 27, 2026
Merged

ops: reconcile hosted configuration presence #1271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
4400f59
ops: reconcile hosted configuration presence
BigSimmo Jul 27, 2026
e904174
docs: record configuration reconciliation review
BigSimmo Jul 27, 2026
ada836d
fix: persist cross-worktree local secret fills
BigSimmo Jul 27, 2026
8d81e31
docs: record configuration review follow-up
BigSimmo Jul 27, 2026
3321c1e
fix: validate local presence fill targets
BigSimmo Jul 27, 2026
2d698f8
docs: record local fill review follow-up
BigSimmo Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docs/branch-review-ledger.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1110,3 +1110,6 @@ This file is append-only. Never rewrite or delete an existing review record; app
| 2026-07-27 | `codex/phone-bottom-band-root-20260727` | `a8a72a43d` | CI follow-up review of calculator dock hide lifecycle | APPROVE. Hosted production Chromium exposed a fast-close race where effect cleanup could cancel the queued focus-latch reset, plus a paint-contract journey coupled to natural short-page geometry. The reset now survives rapid sheet teardown, actual input focus is asserted before hide, and explicit runway isolates the paint contract from the anti-clamp boundary tests. No P0-P3 finding remains. | Exact locked Next 16.2.11 / Playwright 1.61.1 production Chromium repeat PASS (20/20); `verify:cheap` PASS (393 files; 3519 passed / 2 skipped); no provider-backed checks. |
| 2026-07-27 | `codex/phone-bottom-band-root-20260727` | `cc63ee90928d402eb9c5dd241e411ed88cc01f27` | Hosted Applications search hydration follow-up review | APPROVE. The final hosted Chromium failure was a test synchronization race: server-rendered content was visible before the controlled global-search input had its React onChange handler, so hydration could discard an immediate fill. Both shared-search tests now wait for the React handler and assert the accepted value before checking filtering. No product behavior changed and no P0-P3 finding remains. | Exact locked Next 16.2.11 / Playwright 1.61.1 production Chromium repeat PASS (20/20); `verify:cheap` PASS (25 gates; 393 files; 3519 passed / 2 skipped); no non-GitHub provider-backed checks. |
| 2026-07-27 | `codex/phone-bottom-band-root-20260727` | `a4802b9373404a00549a3479d86340398e978cc8` | Automated review follow-up for phone viewport fallback layering | APPROVE. Verified the review finding and separated the baseline 100vh declarations from the supported 100svh override, while retaining the later 100dvh override as the preferred dynamic viewport size. This removes duplicate properties without changing the intended fallback order. The ledger date remains the Australia/Perth task completion date. No P0-P3 finding remains. | Focused viewport-shell static contract PASS (8/8); `git diff --check` PASS; prior full `verify:cheap` and hosted required CI were green before this CSS-only declaration-layering follow-up; no non-GitHub provider-backed checks. |
| 2026-07-27 | `codex/config-reconciliation-current-20260727` | `4400f59730fbd24efc5f4c54adda828506f3835b` | Protected-main review of #054 production configuration reconciliation | APPROVE. GitHub reads are repository-pinned; Railway reads are pinned to the live project, production environment and explicit app/worker services; each provider call has a 30-second bound; output is names-only even though Railway JSON is reduced from values in memory. Multiline Zod and `.env.example` drift are guarded. The correct primary checkout received only three generated gitignored local HMAC/probe values. No P0-P3 finding remains. Residual staging, webhook activation and legal/ZDR work remain #056, #025 and #053 rather than being overstated as complete. | Focused parity/local-presence 22/22 PASS; `verify:cheap` PASS (25 gates; 393 files; 3523 passed / 2 skipped); `verify:pr-local` PASS (same unit matrix + 36 offline RAG fixtures; build correctly skipped as unaffected); production-readiness READY (8 PASS, 2 checkout-file-location warnings); exact provider names-only GitHub/Railway parity PASS; Ops Digest active + latest schedule SUCCESS; Railway app/worker latest deploy SUCCESS; Supabase read-only cron/Vault-name proof; no OpenAI request or live RAG evaluation. |
| 2026-07-27 | PR #1271 / `codex/config-reconciliation-current-20260727` | `ada836d167f6a03f2a6514d56d3aee6304c6276c` | Automated-review follow-up for cross-worktree local fill persistence | APPROVE. The P2 was valid: caller-only process secrets could hide missing target-file values during `--root --fill`. Fill mode now computes persistent gaps from target env files while project identity still uses the merged file/process view; report mode retains its existing process override behavior. A dedicated contract proves all caller-only fillable values remain target-file gaps. No other P0-P3 finding remains. | Focused `tests/local-presence.test.ts` PASS (10/10); exact primary `check:local-presence -- --root C:\Dev\Apps\Database` PASS; Prettier + `git diff --check` PASS; earlier exact-tree `verify:cheap` and `verify:pr-local` remain the broad baseline; hosted required checks will rerun on this follow-up. |
| 2026-07-27 | PR #1271 / `codex/config-reconciliation-current-20260727` | `3321c1eb1f2d1ac4294caf40e09a63b74fe1f713` | Second automated-review follow-up for safe local fill targeting/reporting | APPROVE. Two valid P2 findings were fixed: an explicit root must now carry the Database package identity before any fill, and fill mode applies file-only state solely to writable HMAC/probe gaps while preserving merged process/file truth for report-only provider rows and project identity. Tests cover an unrelated package root, caller-only fillable values, and caller-only provider reporting. Zero unresolved local findings remain. | Focused `tests/local-presence.test.ts` PASS (11/11); exact primary presence PASS; unrelated-root CLI rejection PASS; Prettier PASS; hosted required checks and automated review must rerun on this head before merge. |
18 changes: 10 additions & 8 deletions docs/operator-backlog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,14 +42,16 @@ Findings inventory for handover: [audit-handover-2026-07-14.md](audit-handover-2
Each environment gets **separate** service-role + OpenAI keys (per-env blast radius). Placement is a
dashboard/CLI action, never committed.

| Secret / config | Status | Where | Notes |
| ------------------------------------------ | ---------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Local fillable HMAC/probe secrets | ✅ local | `.env.local` (gitignored) | Use `npm run check:local-presence` / `--fill` for distinct local `OPENAI_SAFETY_IDENTIFIER_SECRET`, `RAG_QUERY_HASH_SECRET`, and `HEALTH_DEEP_PROBE_SECRET`. Never commit values. Hosted stores are separate. |
| `RAG_QUERY_HASH_SECRET` (prod) | 🔎 verify | Railway runtime secret | GitHub repo secret present since 2026-07-10 (CI green); confirm the SAME value is set in Railway runtime. PIA-2 fail-closed guard requires it at boot (min 16 chars) |
| `HEALTH_DEEP_PROBE_SECRET` (prod + GitHub) | ⚠️ partial | Railway runtime + GitHub repo secret | Railway production was set and the authorized deep probe returned healthy on 2026-07-19. GitHub remains pending: set the same value as a repo secret, set `PROD_HEALTH_URL`, then enable the ops-digest schedule. Cloud Agent re-probe 2026-07-26 blocked (GitHub secrets/vars 403; no Railway CLI/token; Railway MCP unavailable). |
| `SUPABASE_SERVICE_ROLE_KEY` (per env) | ⏳ pending | Railway runtime secret | accepts the `sb_secret_…` key |
| `OPENAI_API_KEY` (per env) | ⏳ pending | Railway runtime secret | `RAG_PROVIDER_MODE=auto` |
| OpenAI DPA / ZDR execution | ⏳ pending | OpenAI account + legal | app endpoints are ZDR-eligible; execution is operator + legal — see [openai-cross-border-basis.md](openai-cross-border-basis.md) |
| Secret / config | Status | Where | Notes |
| ------------------------------------------ | ---------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Local fillable HMAC/probe secrets | ✅ present | primary `.env.local` (gitignored) | Correct production project identity was verified and three distinct local-only values were filled on 2026-07-27. `check:local-presence -- --root <checkout>` supports safe cross-worktree checks; values were not printed or committed. |
| `RAG_QUERY_HASH_SECRET` (prod) | ✅ present | Railway runtime + GitHub repo secret | Names-only presence passed in both stores on 2026-07-27. GitHub does not expose the value, so equality cannot be proven read-only; do not rotate solely for comparison because that would break query-pseudonym continuity. |
| `HEALTH_DEEP_PROBE_SECRET` (prod + GitHub) | ✅ present | Railway runtime + GitHub repo secret | Names-only presence and the `PROD_HEALTH_URL` repository variable passed on 2026-07-27. The Ops Digest workflow is active and its 2026-07-26 scheduled run succeeded. The last separately authorized deep probe was healthy on 2026-07-19. |
| `OPENAI_SAFETY_IDENTIFIER_SECRET` (prod) | ✅ active | Railway app runtime secret | A distinct 256-bit production value was stored without an immediate deploy on 2026-07-25; the app's later successful 2026-07-26 `main` deployment proves that stored configuration has entered the active deployment generation. |
| `SUPABASE_SERVICE_ROLE_KEY` (production) | ✅ present | Railway app + worker; GitHub secret | Names-only presence passed for the production app, worker, and repository on 2026-07-27. Values were neither emitted nor compared. Staging remains separately tracked by #056. |
| `OPENAI_API_KEY` (production) | ✅ present | Railway app + worker; GitHub secret | Names-only presence passed for the production app, worker, and repository on 2026-07-27. `RAG_PROVIDER_MODE=auto`; no OpenAI request was dispatched for this configuration check. Staging remains separately tracked by #056. |
| Supabase schedules / Vault names | ✅ present | `Clinical KB Database` | Read-only 2026-07-27 proof found active retention/performance/auto-toggle schedules and the `cron_ingestion_jwt` / `indexing_v3_agent_secret` Vault names. The deliberately absent document-change webhook activation secret remains tracked by #025. |
| OpenAI DPA / ZDR execution | ⏳ pending | OpenAI account + legal | App endpoints are ZDR-eligible; execution is operator + legal — see [openai-cross-border-basis.md](openai-cross-border-basis.md). This legal/provider decision remains #053 and is not implied by config presence. |

## Disaster-recovery re-creation (does NOT survive a schema restore)

Expand Down
Loading
Loading