docs: document combined cross-sink production proof - #308
Conversation
1cedf75 to
f28e975
Compare
b0501a7 to
d0f42c1
Compare
d0f42c1 to
b51f050
Compare
e49a3b4
into
codex/pr198-cross-sink-production-proof
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b51f0502b1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| expect(runbook).toContain('Redis credential-revocation/namespace proof') | ||
| expect(runbook).toContain('complete cross-sink production proof') | ||
| expect(runbook).not.toContain(['deferred complete', 'cross-sink production proof'].join(' ')) |
There was a problem hiding this comment.
When Markdown wraps any part of the prohibited phrase onto another line, this exact not.toContain check passes even though the runbook again describes the cross-sink proof as deferred. The previous assertion tolerated whitespace, so normalize the prose or use a \s+-based negative match to preserve the intended regression coverage.
Useful? React with 👍 / 👎.
| The mandatory combined CI proof is | ||
| `cross-sink-production-sentinel.postgres-redis.test.ts`. It must pass exactly | ||
| 1/1 and emit `S4_CROSS_SINK_PRODUCTION_SENTINEL_OK`. It composes the supported |
There was a problem hiding this comment.
When an operator tries to reproduce this newly mandatory gate, the documented filename is insufficient: a direct Vitest run exits successfully with the only test skipped unless destructive mode and three dedicated service URLs are configured, while the disposable database setup and exact 1/1/marker validation exist only inside .github/workflows/web-ci.yml. Include the safe setup and checked invocation, add a wrapper command, or link directly to the relevant workflow step so this release gate is operable from the runbook.
AGENTS.md reference: AGENTS.md:L155-L165
Useful? React with 👍 / 👎.
1 participant
Source Issue
Issue: #179
Summary
This documentation child closes the wording gap left by PR #307. It explains that the PostgreSQL scrub, Redis purge, and Redis ACL checks are necessary individual gates, while the combined production sentinel is the proof that the supported sink set is checked together.
Stack
codex/pr198-cross-sink-production-proof5c7cfdb66425d42f49f8597f04565ff97aca4421b51f0502b1ad3aa434aab9de00c075d685a1a021Scope
Exactly three files:
docs/operator-guide.mddocs/operators/legacy-leakage-scrub-v1.mdweb/__tests__/legacy-leakage-scrub.test.tsThe docs name the mandatory
cross-sink-production-sentinel.postgres-redis.test.tsproof, exact 1/1 result, markerS4_CROSS_SINK_PRODUCTION_SENTINEL_OK, and the collectively checked sink set. They preserve the disposable-hosted-evidence, future-sink, and not-proof-of-correctness limitations and do not imply that specialist, ACP, or three-lease execution is implemented.Validation
git diff --check: passedDraft child only; do not mark ready or merge until PR #307 and the combined proof are reviewed.