|
1 | | -# Vault and native infrastructure validation |
| 1 | +# Validation after restoring stashed work |
2 | 2 |
|
3 | | -This branch is based on `main` at `c904d71ef8a7541885cbbe887f25148e196ef768`. |
4 | | -It contains the infrastructure replacement, adapted to the committed service module names. |
5 | | -The owner's uncommitted module renames, Identity refactor, Wallet edits, and local tooling |
6 | | -remain outside the branch. No live database, Vault state, or deployment was accessed. |
| 3 | +Current source and evidence are documented in [the recovery record](recovery/stashed-work.md). |
7 | 4 |
|
8 | | -## Scope |
| 5 | +The recovered reactor packages and compiles its tests. 302 selected Java tests and 18 offline |
| 6 | +infrastructure contracts pass. PostgreSQL 18 migration/import SQL checks passed using PGlite; |
| 7 | +Docker-backed runtime, TLS, Vault renewal, recovery and business end-to-end acceptance remain |
| 8 | +pending. Recovered Wallet formatting fails the full formatting gate, and the unfinished Identity |
| 9 | +audit adapter remains an application-startup blocker. |
9 | 10 |
|
10 | | -- Compose manages PostgreSQL 18, Vault, dependencies, networks, application Agents and |
11 | | - independent Agent/Flyway migration jobs. Existing persistent volumes have explicit external names. |
12 | | -- Vault Agent handles AppRole authentication, token/credential renewal and application restart |
13 | | - on credential replacement. Java consumes Agent token files for scoped KV access. |
14 | | -- Ansible replaces preparation, provisioning, initialization, migration orchestration, import, |
15 | | - identity refresh, backup and recovery launchers. The root `scripts/` directory and custom |
16 | | - Java migration/import/leased-datasource implementations are removed. |
17 | | -- The four existing versioned PostgreSQL SQL files are byte-for-byte unchanged; their hashes |
18 | | - are recorded in `infrastructure/migrations.sha256`. Wallet receives a separate V1 marker, |
19 | | - not a financial persistence implementation. |
20 | | -- Identity import and privilege checks retain `identity_challenge`, `identity_audit_log`, and |
21 | | - `identity_challenge_scope`. No SQL from the owner's unfinished Identity refactor is imported. |
22 | | -- Existing Identity KV scoping and pepper-rotation tests are retained. Their fixture helper now |
23 | | - requires Agent-delivered token paths in `PAYGUARD_REHEARSAL_OPERATOR_TOKEN_FILE`, |
24 | | - `PAYGUARD_REHEARSAL_IDENTITY_TOKEN_FILE`, and `PAYGUARD_REHEARSAL_WALLET_TOKEN_FILE`. |
25 | | - Those live Vault tests were not executed here. |
26 | | - |
27 | | -## Executed checks |
28 | | - |
29 | | -| Check | Result | Limit | |
30 | | -| --- | --- | --- | |
31 | | -| Offline deployment/security contracts | PASS, 18 tests | Configuration and HCL/TOML parsing, not live leases | |
32 | | -| Compose base/application/migration/operations configuration | PASS | Compose 2.40.3; no daemon | |
33 | | -| Compose production overlay configuration | PASS | Dummy external broker hosts and CA paths | |
34 | | -| Ansible playbook syntax | PASS, 21 entry points | `preflight.yml` is an imported task list, not a playbook | |
35 | | -| Fresh preparation | PASS | OpenSSL and Ansible on a new isolated fixture | |
36 | | -| Repeated fresh preparation | PASS, safely refused | Generated bytes unchanged; private keys/passwords/config 0600, directories 0700 | |
37 | | -| Existing versioned PostgreSQL SQL | PASS, 4 files unchanged | No live Flyway history available | |
38 | | -| Shared Agent token/TLS/error-sanitization Java tests | PASS, 5 tests | No live Vault; repository style goals skipped for this run | |
39 | | -| Application packaging and test-source compilation | PASS, all four services | Runtime tests skipped; Spotless/Checkstyle bypassed in this packaging run | |
40 | | -| Reactor Maven validation | PASS | Spotless and Checkstyle for parent/shared/four services; PMD/SpotBugs not run | |
41 | | -| Changed Java formatting | PASS | Google Java Format 1.30.0 | |
42 | | -| Original checkout WIP preservation | PASS | Original status, staging state and file hashes unchanged | |
43 | | - |
44 | | -The Java test command used JDK 25 and the repository Maven wrapper: |
45 | | - |
46 | | -```bash |
47 | | -./mvnw -B -ntp -pl payguard-shared \ |
48 | | - -Dspotless.skip=true -Dcheckstyle.skip=true \ |
49 | | - -Dtest=AgentTokenClientTest,PostgreSqlTlsTest,SanitizedDependencyErrorTest test |
50 | | -python3 -m unittest discover -s infrastructure/tests -v |
51 | | -``` |
52 | | - |
53 | | -Dependency downloads used private, workspace-only proxy settings and the system Java trust |
54 | | -store. TLS verification remained enabled; proxy settings and generated secrets are not committed. |
55 | | - |
56 | | -## Required live acceptance |
57 | | - |
58 | | -The reusable native infrastructure CI workflow runs on an isolated Docker host. It prepares |
59 | | -separate volumes, provisions Vault/databases, migrates every database twice, verifies privileges, |
60 | | -starts the applications and rehearses a Vault outage. The workflow is executable test scaffolding, |
61 | | -not evidence that those jobs have passed. |
62 | | - |
63 | | -Production acceptance remains incomplete. Run integration, permission-denial, TLS failure, |
64 | | -Agent renewal/reauthentication, credential replacement, interrupted migration/recovery, |
65 | | -backup/restore, import rollback and business end-to-end tests before deployment. Test held SQL |
66 | | -transactions and Vault outages explicitly; credential expiration does not terminate every |
67 | | -already executing database statement. Complete paired PostgreSQL/Raft restoration and check |
68 | | -existing records, histories, ownership and secret versions on isolated recovery volumes. |
69 | | - |
70 | | -Base Kafka is a local plaintext rehearsal broker. The production overlay requires authenticated |
71 | | -TLS external Redis/Kafka and verified CA/hostname settings. This is a single-host deployment |
72 | | -building block, not a tested highly available database or Vault deployment. |
| 11 | +Historical infrastructure-only evidence from merged PR #40 is retained separately in |
| 12 | +[infrastructure-before-recovery.md](recovery/infrastructure-before-recovery.md). It must not be |
| 13 | +interpreted as validation of the recovered business refactor. |
0 commit comments