docs backend evidence cd ZD 08

ZD-08 — Operations source and remaining activation

Status: LOCAL_DONE (source) / INTEGRATION_PENDING / LIVE_ACCEPTANCE_OWED Validation: PASS (local source and read-only live status)

B-BR-CD-ZD-08: Operator status is read-only and reveals only scoped service states, release identifiers, receipt results, latch/hold, pod/ReplicaSet health and quota. It never prints environment, private endpoints, raw errors or credentials. A failure hook receives only a sanitized receipt summary on stdin; notifications cannot change deploy/rollback outcome or clear a hold/latch.

BUC-CD-ZD-08: Owner inspects one status screen, reviews the latest failure, pauses the timer if necessary and explicitly resolves a hold. A root-owned local notification hook chooses the channel and reads its own local token; no message/channel/token is configured by this source task. Timer jitter and timeout are reviewed source until individually approved installation.

Tested parent 0792eb35 plus this task. Status privacy/scope test passes with private address/message/image canaries excluded. Agent harness: 229 assertions, zero failures; notification failure is contained, rejected candidate causes no second hook invocation, failed restoration readiness creates a hold. Final review first reproduced three RED assertions: rollback command success was not proof of restored readiness, and a signed response could differ from a journal's pinned SHA. Both are corrected with dedicated regressions. Rollback waits for the original revision to become ready and journal SHA must match the verified manifest exactly. Separate worker rollback captures its own revision.

Seven real HTTP/subprocess probe cases, capacity/manifest suites and the 21-case gate harness pass. Required Quick now calls the complete deploy-agent target and manifest tests. Affected backend build, race tests, vet/gofmt, real jobs/PostGIS and real S3 proofs are recorded in the preceding task files; shellcheck, actionlint 1.7.12, release guard and secret/diff review pass. No new dependency, production change, message delivery or VPS mutation occurred.

Read-only status executed on the existing host through stdin (no install): 11:39:54Z receipt no-change, current c19f0bde, schema 000145, floor 000132, timer enabled/active, service success, no hold/inflight, five ready containers, two active ReplicaSets. This uses the existing namespace-scoped kubeconfig and prints no endpoints, private paths or secrets.

Source operations: read-only status; optional bounded/permission-checked local notification hook; timer jitter 15s/accuracy 1s; 20-minute service timeout so bounded jobs/rollback can finish before systemd interrupts recovery. Existing retained backup count seven, landing last five plus original rollback target and API revision history ten remain the source policies. Image-GC thresholds, actual retention and notification delivery are not live-verified. Phase 3 step 5 is formally amended: stable landing-current search-script path plus existing deduplicated 15-minute worker schedule, permitting up to one interval before portal regeneration. Actual path/refresh remains OWED.

Owner-controlled activation queue

1. Approve a complete reviewed agent bundle and service timeout update, with the prior bundle/unit retained for rollback. Acquire the existing service lock and install atomically; do not run bootstrap/user/env creation on the existing host. No topology, surge, quota, edge or timer flag change is part of that proposed first step. This step has not been approved or executed.
2. After protected main integration produces the matching signed images, separately approve the scheduled storage move and rollout hardening; stop the old writer before starting the singleton. Rollback reverses that order. Verify private media and semantic zero-diff.
3. Separately approve each full probe campaign/surge opt-in, actual failure drill, timer pause/resume and notification channel activation. Never raise quota, change shared k3s GC or touch another vhost/application implicitly.
4. Three distinct measured image rollouts, two unattended main receipts, broken-image/contract/landing drills and restored-data rehearsal remain unaccepted. See ZD-06 and ZD-07. ZD-05 has no trigger; ZD-09 has no owner opt-in. No production certification or wiki publication is implied by opening this source PR.

Delivery

One isolated codex/cd-zero-downtime bundle from main c19f0bde, delivered through remote dev → protected main. Remote dev was an ancestor of main; the occupied local dev checkout and its three unmerged Android commits are preserved and excluded from this scoped PR. Main protection was read on 2026-11-03: strict required Quick verification (GitHub Actions app 15368), enforced for admins; zero required approvals, stale reviews dismissed. No bypass/force/direct-main push, CI polling, guarded merge or wiki sync is part of the open-PR request. PR number/check state are recorded in PR metadata after publication.

Earlier construction checkpoint entries (preserved from PROGRESS)

• ZD-06 2026-11-03: probe tooling LOCAL_DONE, LIVE_ACCEPTANCE_OWED on codex/cd-zero-downtime, tested parent 7ceed35d plus task. Evidence: seven HTTP/subprocess fixtures pass, including 503/unavailable/no-rollout/saturation and privacy refusals. Three actual campaigns remain OWED; surge default OFF. ZD-05 has no measured trigger. Next: ZD-07 owner-controlled drill runbook, ZD-08 ops.

• ZD-04 2026-11-03: rollout/capacity source LOCAL_DONE / INTEGRATION_PENDING, codex/cd-zero-downtime, tested parent ca7a7aba plus task. Evidence: 218 agent assertions, four quota dimensions, storage refusal and infra/static gates pass. Source default surge OFF; live 0/1 unchanged, zero-diff/measurements OWED. Next: ZD-06 probe tooling; ZD-05 only on measured edge failure.

• ZD-03 2026-11-03: storage separation source LOCAL_DONE / INTEGRATION_PENDING on codex/cd-zero-downtime, tested parent 30160e51 plus task. Evidence: singleton/render, scoped config, HTTP race/real MinIO signatures and infra gates pass. Signed public URLs preserved. Live topology unchanged; migration requires signed new image and individual approval. Next: ZD-04 hardening.

• ZD-02 2026-11-03: drain source LOCAL_DONE / INTEGRATION_PENDING on codex/cd-zero-downtime, tested parent 9bc48e20 plus task. Evidence: real SIGTERM/TCP/upload and affected Go race/vet pass; full real-PostGIS jobs and overlapping workers pass. Next: ZD-03 preserve signed public URLs while separating singleton storage; no VPS change, live acceptance OWED.

• ZD-00/01 2026-11-03: read-only staging inventory and agent safety source LOCAL_DONE / INTEGRATION_PENDING on codex/cd-zero-downtime, tested parent d9fa3db0 plus task. Inventory, safety; 221 harness assertions and static checks pass. Live c19f0bde/timer active, surge OFF; no VPS mutation. Next: ZD-02 drain, then storage separation before surge; live approvals and measured acceptance OWED. Final single dev → main PR pending.

Protected source integration — 2026-11-03

PR #183 merged as d0eb9c798b93d3659648177945a5b83626de452e through git-flow.sh finish --base origin/main --pr 183 --required "Quick verification". Exact PR head 3efc171b had successful test, fast, integration and required Quick checks; the helper ran local Quick once, guarded the head and preserved commits. A separate local clone kept the occupied local dev/three Android commits intact; remote dev was synchronized normally to merged main. Main-push signed release and the actual running-image/receipt comparison remain to be observed. No manual VPS write or completed zero-downtime acceptance is implied. Wiki will mirror the final cumulative construction batch; no bookkeeping-only PR is introduced.

PR #183 automatic deployment observation (2026-11-03)

Main push checks and release run 41636764685 succeeded, including API/worker/migrate image builds and signed OCI manifest publication. The owner-approved read-only inventory observed current.json advance to d0eb9c798b93d3659648177945a5b83626de452e at 12:39:49Z, without a manual service start/apply. Both ready running imageIDs and Deployment image pins match the downloaded signed release manifest:

• API: sha256:048ca8d4e0903450e64780641512b5f7e6852f9fdbe027f9346889a99baece31.
• Worker: sha256:4cfa36d534574634993ecb5a011dd002b10205d1885c6c04e898d01f1cbecdfa.

Public staging readiness returned HTTP 200; five containers ready, no inflight journal/operator hold. The Pod status.image field exposed a different image index/platform coordinate; comparison correctly uses running imageID and the Deployment's desired digest. No live config/agent install was performed. This proves automatic signed-image update for this release, not zero-downtime acceptance: singleton storage/strategy activation and measured drills remain OWED under separate approvals.