From acd929c704ec22b3ac909ecc3cd609b826376f5a Mon Sep 17 00:00:00 2001 From: brother7 <7brother7@gmail.com> Date: Sun, 16 Aug 2026 23:35:33 +0800 Subject: [PATCH] docs: integrate plaintext PostgreSQL decision --- .project-docs/00-brief/project-positioning.md | 3 + .project-docs/10-decisions/decision-index.md | 2 +- .project-docs/20-architecture/data-flow.md | 12 ++-- .project-docs/20-architecture/module-map.md | 5 +- .../20-architecture/system-overview.md | 31 +++++---- .project-docs/30-worklog/current-state.md | 54 ++++++++++----- .project-docs/30-worklog/task-history.md | 2 + ...6-integrate-plaintext-postgres-6e3b1a90.md | 66 +++++++++++++++++++ .project-docs/80-commitments/commitments.md | 6 +- .project-docs/90-maintenance/stale-items.md | 5 +- 10 files changed, 146 insertions(+), 40 deletions(-) create mode 100644 .project-docs/30-worklog/tasks/20260816-integrate-plaintext-postgres-6e3b1a90.md diff --git a/.project-docs/00-brief/project-positioning.md b/.project-docs/00-brief/project-positioning.md index 076e988..7354242 100644 --- a/.project-docs/00-brief/project-positioning.md +++ b/.project-docs/00-brief/project-positioning.md @@ -28,6 +28,9 @@ The project exists to give organizations an Alibaba Cloud ACK-deployable AI crea - Same-origin browser authentication through signed, chunked `zhinian_session` cookies with per-request account/organization/sessionVersion revalidation. - Production persistence fails closed: explicit RDS PostgreSQL through the Go PostgreSQL Adapter; local JSON is development/test only. +- PostgreSQL clients enforce plaintext (`sslmode=disable`) for the selected RDS + endpoint. Production database traffic must stay on the internal network and + be restricted by VPC, security-group, and RDS allowlist controls. - Production Web is a static export on Nginx. Browser runtime requests stay same-origin and all API/file/auth behavior belongs to Go. - Cross-instance concurrency stays in PostgreSQL: `claim_generation_jobs` for job claims and `billing_post_wallet_entry` for wallet idempotency; no process-local lock replacements. diff --git a/.project-docs/10-decisions/decision-index.md b/.project-docs/10-decisions/decision-index.md index a1f29be..1563767 100644 --- a/.project-docs/10-decisions/decision-index.md +++ b/.project-docs/10-decisions/decision-index.md @@ -4,7 +4,7 @@ | ID | Decision | Status | Date | Applies To | Detail | |---|---|---|---|---|---| -| RDS-001 | Production persistence uses explicit direct PostgreSQL through one server-only adapter; local JSON is explicit development/test mode. | Accepted | 2026-08-12 | Server stores and scripts | `ZHINIAN_DATA_BACKEND=postgres` fails closed and never silently falls back. | +| RDS-001 | Production persistence uses explicit direct PostgreSQL through one server-only adapter; local JSON is explicit development/test mode. | Accepted; transport amended 2026-08-16 | 2026-08-12, amended 2026-08-16 | Server stores and scripts | `ZHINIAN_DATA_BACKEND=postgres` fails closed and never silently falls back. PostgreSQL clients enforce plaintext (`sslmode=disable`) because the selected RDS endpoint refuses TLS; production must use the internal endpoint with VPC, security-group, and allowlist isolation. | | RDS-002 | Database changes use versioned, checksummed, advisory-locked migrations. | Accepted; execution amended 2026-08-14 | 2026-08-12 | Database schema and rollout | Initial production schema is executed manually from `database/migrations/*.sql` plus application-role grants; no migration Job manifest is shipped with the static Web image. | | ADR-003 | Production is a same-origin static Next.js export on Nginx plus a Go modular-monolith backend with an embedded WorkerLoop. | Accepted; repository implementation complete in `b14b4fc`; production rollout pending | 2026-08-12, amended 2026-08-16 | Application and ACK architecture | Browser routes are static; all runtime API/file/auth responsibility belongs to Go. See `adr-003-next-go-target.md`. | | DEP-001 | Production starts fresh with the ADR-003 static Web + Go topology, no legacy cutover or Node Worker, and manual SQL schema initialization. | Accepted; manifests updated 2026-08-16 | 2026-08-14 | Deployment model and schema initialization | No migration Job pod; Go bootstraps the super administrator, owns the session Secret, and receives all runtime/backend configuration. | diff --git a/.project-docs/20-architecture/data-flow.md b/.project-docs/20-architecture/data-flow.md index cb2f0cb..dc00bc0 100644 --- a/.project-docs/20-architecture/data-flow.md +++ b/.project-docs/20-architecture/data-flow.md @@ -15,7 +15,8 @@ and are not a supported production path. ## Approved Target Flows -The implementation and desired ACK routing are present in `b14b4fc`. +The static implementation and desired ACK routing are present in `b14b4fc`; +`ed97814` adds the plaintext PostgreSQL transport correction. Production is already online, but the static revision and exact live Service ownership have not been confirmed from cluster configuration or logs: @@ -24,7 +25,7 @@ ownership have not been confirmed from cluster configuration or logs: | Browser UI | Browser | Same-origin Ingress -> Nginx static Web | Preserve current page URLs; Nginx performs no application logic. | | Browser identity | Browser auth Module | Same-origin Ingress -> Go `GET /api/auth/me` | Browser automatically sends HttpOnly Cookie; validate anonymous/authenticated response shapes, keep no token in JavaScript, and use client guards only for UX. | | Browser business/file requests | Browser components | Same-origin Ingress -> Go `/api`, `/uploads`, `/generated-results` | Go revalidates session/account/organization/sessionVersion and enforces every protected action. | -| Backend persistence | Go Modules | PostgreSQL Adapter -> RDS | Parameterized queries and transactions; fail closed in production. | +| Backend persistence | Go Modules | PostgreSQL Adapter -> internal RDS endpoint | Parameterized queries and transactions; fail closed in production; code-enforced plaintext (`sslmode=disable`) within VPC/security-group/allowlist isolation. | | Task execution | Embedded Go WorkerLoop | RDS claim -> provider -> OSS -> RDS -> Webhook | Bounded concurrency, recoverable leases, one owner for external side effects. | | Asset lifecycle | Go Assets | OSS plus RDS metadata | Shared storage required before horizontal scaling. | | Schema rollout | Manual operator or dedicated CI | RDS | Execute immutable versioned SQL plus grants outside long-lived workloads; no Web-image migration Job. | @@ -39,7 +40,9 @@ ownership have not been confirmed from cluster configuration or logs: ## External Interfaces -- Alibaba Cloud RDS PostgreSQL via its internal endpoint and verified TLS CA. +- Alibaba Cloud RDS PostgreSQL via its internal endpoint using code-enforced + plaintext; VPC, security-group, and RDS allowlist controls are the transport + isolation boundary. - Alibaba Cloud ACK resources under `deploy/ack/`. - Live production at `https://nianxxaigc.nianxx.cn`; public `/api/ready` has returned HTTP 200 with PostgreSQL configured, without proving the owning Service. - The legacy internal Worker prefix is denied by Ingress; production uses the @@ -47,7 +50,8 @@ ownership have not been confirmed from cluster configuration or logs: The accepted production topology uses the embedded Go WorkerLoop. The current live revision produces an RSC error for authenticated `/create`; the rollout -must deploy `b14b4fc` under immutable image references and smoke login, +must deploy `ed97814` under immutable image references and smoke PostgreSQL +bootstrap/readiness, login, authenticated routes, logout, roles, `/healthz`, `/api/health`, and `/api/ready`. diff --git a/.project-docs/20-architecture/module-map.md b/.project-docs/20-architecture/module-map.md index 34bd1ae..de35ac3 100644 --- a/.project-docs/20-architecture/module-map.md +++ b/.project-docs/20-architecture/module-map.md @@ -11,7 +11,7 @@ | `database/migrations/` | Immutable versioned PostgreSQL schema changes | Executed manually/through dedicated operator CI; no migration Job reuses Web. | | `deploy/ack/` | Seven ACK manifests plus Secret template | Static Web + Go topology; Web has no runtime config/Secret and Go owns the session Secret. | | `backend/cmd/zhinian-api` | Go application entrypoint, configuration, HTTP server composition, health/readiness | Sole runtime API owner targeted by checked-in Ingress. | -| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Implemented in `b14b4fc`; publication of immutable images and rollout of the static Web + Go revision remain pending. | +| `backend/internal/*` | ADR-003 deep modules and adapters, 18 packages: `identity`, `administration`, `assets`, `billing`, `usage`, `jobs`, `providers`, `webhook`, `httpapi`, `publicapi`, `application`, `orchestration`, `postgres`, `localstore`, `logging`, `settings`, `templates`, `prompt` | Implemented in `b14b4fc`; `ed97814` enforces plaintext PostgreSQL. Publication of immutable images and live rollout remain pending. | | `contracts/**/*.json` | Language-neutral HTTP/Cookie/auth/jobs/billing/storage/webhook contract fixtures | Shared acceptance source for TypeScript and Go consumers. | ## Dependency Direction @@ -46,7 +46,8 @@ Real internal seams are PostgreSQL transport, object storage, generation provide - `database/migrations/` and the two concurrency-sensitive PostgreSQL functions. - Account authentication/password transactions and billing wallet idempotency. -- ACK Secrets, RDS CA mounting, Ingress protection for internal Worker routes, and pool connection budgeting. +- ACK Secrets, private-network enforcement for unencrypted RDS traffic, + Ingress protection for internal Worker routes, and pool connection budgeting. - `backend/internal/{postgres,jobs,billing}`: claim and wallet correctness across Go replica scaling until WorkerLoop concurrency is deliberate. - Static Web image construction/container startup still needs CI smoke evidence. - Go `emptyDir` file state is lost on Pod replacement when OSS is absent. diff --git a/.project-docs/20-architecture/system-overview.md b/.project-docs/20-architecture/system-overview.md index cbcb726..ae66c10 100644 --- a/.project-docs/20-architecture/system-overview.md +++ b/.project-docs/20-architecture/system-overview.md @@ -2,14 +2,19 @@ ## Current Architecture -The first production deployment is online at `https://nianxxaigc.nianxx.cn`. The public `/api/ready` endpoint has been observed returning HTTP 200 with PostgreSQL configured. The exact live Service owner for each path has not been confirmed through cluster configuration or logs, so the deployed routing shape is not inferred here. +The first production deployment is online at `https://nianxxaigc.nianxx.cn`. +An earlier public `/api/ready` response returned HTTP 200 with PostgreSQL +configured, but the latest observed Go API startup fails during bootstrap +because the RDS endpoint refuses TLS. The exact live Service owner and deployed +image revision for each path have not been confirmed through cluster +configuration or logs. -The live revision predates `b14b4fc` and authenticated `/create` currently -triggers a production RSC error. The repository now implements the stricter -ADR-003 boundary: Next.js statically exports pages, unprivileged Nginx serves -them, the browser reads identity from Go `/api/auth/me`, and Go owns every -runtime API/file route plus database-backed authorization and the embedded -WorkerLoop. The new images and ACK configuration have not yet been deployed. +The repository implements the strict ADR-003 boundary: Next.js statically +exports pages, unprivileged Nginx serves them, the browser reads identity from +Go `/api/auth/me`, and Go owns every runtime API/file route plus database-backed +authorization and the embedded WorkerLoop. Revision `ed97814` additionally +forces PostgreSQL plaintext for the TLS-refusing RDS endpoint. Deployment and +live validation of that exact revision remain pending. ## Approved Target Architecture @@ -17,9 +22,9 @@ The accepted target in ADR-003 is a same-origin static Next.js export on Nginx p | Target component | Responsibility | Constraint | Implementation state | |---|---|---|---| -| Static Web | Next.js build output (`out/`) and browser UI served by Nginx | No SSR, Middleware, Route Handlers, runtime configuration, application Secret, or internal Go URL. | Implemented and statically verified in `b14b4fc`; deployment pending. | +| Static Web | Next.js build output (`out/`) and browser UI served by Nginx | No SSR, Middleware, Route Handlers, runtime configuration, application Secret, or internal Go URL. | Implemented and statically verified in `b14b4fc`; publish the image from `ed97814` with the matching Go release. | | Go backend | Existing HTTP/file contracts, identity, administration, assets, jobs, billing, usage, providers, storage, Webhooks, readiness | Owns relational access and embeds the WorkerLoop in the approved topology. | Implemented in `backend/`; production is online, but exact live path ownership is not asserted without cluster evidence. | -| RDS PostgreSQL | Relational state and cross-instance concurrency | Retains versioned migrations and both concurrency-sensitive database functions. | Repository procedure requires manual SQL (migrations 0001/0002) plus role grants; live execution evidence remains to be confirmed. | +| RDS PostgreSQL | Relational state and cross-instance concurrency | Retains versioned migrations and both concurrency-sensitive database functions. Clients enforce plaintext (`sslmode=disable`); use only the internal endpoint protected by VPC, security groups, and an RDS allowlist. | Repository procedure requires manual SQL (migrations 0001/0002) plus role grants; live plaintext bootstrap/readiness and network-isolation evidence remain to be confirmed. | | Schema operator/CI | Schema and application-role grants | Runs versioned SQL outside long-lived workloads; never reuses the static Web image. | First-deployment procedure is manual; no migration Job manifest is shipped. | | Alibaba Cloud OSS | Shared generated/uploaded assets | Must be production-ready before horizontal workload scaling. | Still behind a storage Adapter; not validated against real OSS. | @@ -42,6 +47,9 @@ replica until file storage is shared. ## Important Boundaries - Production backend selection is explicit and fail-closed; never turn a PostgreSQL configuration failure into local JSON fallback. +- PostgreSQL transport is code-enforced plaintext because the selected RDS + endpoint refuses TLS. Database traffic must stay on the Alibaba Cloud private + network and be restricted with VPC, security-group, and allowlist controls. - Store callers depend on stable store interfaces, not `pg` or SQL details. - Multi-statement consistency uses one transaction client; atomic job claim and wallet posting remain database functions. - Database credentials and the session-signing Secret belong to Go and the @@ -56,8 +64,9 @@ replica until file storage is shared. ## Related Decisions - Current implementation: `RDS-001` and `RDS-002` (schema execution now manual SQL per `DEP-001`). -- Accepted implementation: `ADR-003` as amended by `b14b4fc`; production is - online, but the new static revision and exact live routing remain unverified. +- Accepted implementation: `ADR-003` as amended by `b14b4fc`, plus the + `RDS-001` transport amendment implemented in `ed97814`; production is online, + but the exact revision and live routing remain unverified. - First-deployment model: `DEP-001`. ## Last Updated diff --git a/.project-docs/30-worklog/current-state.md b/.project-docs/30-worklog/current-state.md index 39efdca..b73f3d9 100644 --- a/.project-docs/30-worklog/current-state.md +++ b/.project-docs/30-worklog/current-state.md @@ -17,23 +17,28 @@ This file is the integrated default-branch snapshot. Feature tasks record progre - `b14b4fc` (pure static Next.js export, browser-to-Go auth, Go-only runtime API ownership, unprivileged Nginx Web, and first-deployment ACK cleanup; task `20260816-static-frontend-go-api-4f8c2a7d`) +- `acf368b` (diagnosis of the production Go bootstrap failure against an RDS + endpoint that refuses PostgreSQL TLS) +- `ed97814` (code-enforced plaintext PostgreSQL for Go and retained Node + tooling, removal of the obsolete RDS CA deployment dependency, and protocol + regression coverage; task `20260816-disable-postgres-tls-d4a89c12`) ## Current Focus -The first production deployment is live at `https://nianxxaigc.nianxx.cn`; the -currently observed revision still fails authenticated `/create` with an RSC -error. Repository revision `b14b4fc` removes that request-time frontend seam: -Next.js now emits static `out/` files served by unprivileged Nginx, the browser -loads identity from same-origin Go `/api/auth/me`, and Ingress routes all -`/api`, `/uploads`, and `/generated-results` traffic directly to Go. Web has no -runtime ConfigMap, Secret, database credential, or internal Go URL. The new -images/manifests have not yet been deployed, and exact live Service ownership -still requires cluster evidence. +The first production deployment is live at `https://nianxxaigc.nianxx.cn`. +After a redeployment, the observed Go API process fails during super-admin +bootstrap because its RDS endpoint refuses a TLS negotiation. Repository +revision `ed97814` retains the static Web + Go-only runtime boundary from +`b14b4fc` and forces every maintained PostgreSQL client to plaintext +(`sslmode=disable`), without requiring an Alibaba Cloud RDS configuration +change. The fixed Go image and updated ACK manifest have not yet been verified +in the live cluster, and the exact deployed image revisions still require +cluster evidence. ## Recently Completed - 2026-08-12: Replaced the Supabase/PostgREST runtime path with a server-only `pg` adapter across data, account, and billing stores. -- 2026-08-12: Added versioned PostgreSQL migrations, strict backend selection, verified-CA TLS, database readiness, and ACK Web/Worker/migration manifests. +- 2026-08-12: Added versioned PostgreSQL migrations, strict backend selection, database readiness, and ACK Web/Worker/migration manifests; the original verified-CA transport decision was amended on 2026-08-16. - 2026-08-12: Accepted and documented the Next.js frontend plus Go backend target, migration contracts, and acceptance criteria. - 2026-08-14: Implemented and merged the Go backend (foundation, identity, administration, assets, billing, usage, jobs/providers/webhooks/worker loop, public and compatibility HTTP surfaces) with language-neutral contract fixtures and migration 0002. - 2026-08-14: Reconciled canonical architecture, decision, history, commitment, and positioning memory with the merged Go implementation (task `20260814-go-memory-reconcile-7f2a9c41`). @@ -47,23 +52,30 @@ still requires cluster evidence. Worker/migration manifests, and added static/deployment regressions (task `20260816-static-frontend-go-api-4f8c2a7d`, commit `b14b4fc`; not yet deployed). +- 2026-08-16: Diagnosed the Go bootstrap failure as a TLS negotiation against + an endpoint that refuses TLS, then changed Go and retained Node PostgreSQL + clients to enforce plaintext, removed the obsolete CA deployment dependency, + and added real wire-protocol regression coverage (task + `20260816-disable-postgres-tls-d4a89c12`, commit `ed97814`; live rollout not + yet verified). ## In Progress -- Build, publish, and deploy immutable Web and Go images for `b14b4fc`, then - verify the static Web + Go-only runtime boundary in the live ACK cluster. +- Build, publish, and deploy immutable Web and Go images containing `ed97814`, + then verify PostgreSQL readiness/bootstrap and the static Web + Go-only + runtime boundary in the live ACK cluster. ## Next Recommended Steps -1. Build and smoke the pinned unprivileged Nginx Web image in CI or another - host with Docker, then publish Web and Go images under new immutable tags or - digests. +1. Build and smoke Web and Go images from `ed97814` in CI or another host with + Docker, then publish them under new immutable tags or digests. 2. Create/verify the `zhinian` Namespace, run target-cluster server-side dry runs, apply the production Go-owned Secret and six checked-in resource manifests (not `secrets.example.yaml`), and confirm live Ingress/Service ownership from cluster state. -3. Smoke anonymous login, authenticated `/create?mode=video`, logout, and each - admin role; verify Web `/healthz`, Go `/api/health`, and Go `/api/ready`. +3. Confirm Go bootstrap completes without an SSLRequest, then smoke anonymous + login, authenticated `/create?mode=video`, logout, and each admin role; + verify Web `/healthz`, Go `/api/health`, and Go `/api/ready`. 4. Configure OSS or another shared/persistent store before any Go Pod replacement that must preserve current local uploads/generated results. 5. Continue real RDS/provider/Webhook validation and confirm the public @@ -71,7 +83,10 @@ still requires cluster evidence. ## Open Questions / Blockers -- Canonical memory does not yet record the live RDS PostgreSQL version, connection budget, endpoint, TLS/CA details, database roles, ACK network policy, or confirmed request-path Service ownership. +- Canonical memory does not yet record the live RDS PostgreSQL version, + connection budget, exact internal endpoint, database roles, effective VPC / + security-group / allowlist controls, or confirmed request-path Service + ownership. - Real OSS bucket/credential configuration is still needed for shared asset storage. - Public `/api/v1` support promises for external consumers need explicit confirmation. - The static Web Docker image has not been built or container-smoked in this @@ -79,6 +94,9 @@ still requires cluster evidence. ## Risky Areas +- PostgreSQL transport is intentionally unencrypted. The RDS connection must + remain on the private network and be constrained by VPC, security-group, and + allowlist controls; those live controls still require recorded validation. - Database grants and least-privilege roles still require documented validation against the live RDS instance. - Go currently stores local uploads/results on `emptyDir` when OSS is absent; Pod replacement or rolling update loses them, not only horizontal scaling. diff --git a/.project-docs/30-worklog/task-history.md b/.project-docs/30-worklog/task-history.md index 9c1c020..b8beaec 100644 --- a/.project-docs/30-worklog/task-history.md +++ b/.project-docs/30-worklog/task-history.md @@ -20,6 +20,8 @@ | 2026-08-16 | `20260816-integrate-auth-ssr-9d7e4c2a` | Serialized integration of source commit `498c2fa` and canonical reconciliation for the authenticated SSR-to-Go identity bridge. No live deployment was performed. | Current state, task history, system overview, module map, data flow, commitments | | 2026-08-16 | `20260816-static-frontend-go-api-4f8c2a7d` | Revision `b14b4fc` replaces production SSR/Middleware/Next APIs with a static export on unprivileged Nginx; browser runtime traffic goes directly to the Go-owned same-origin API/file surface. | Task record, proposal, application/deployment docs | | 2026-08-16 | `20260816-integrate-static-frontend-2c7e91b4` | Serialized canonical promotion of the user-approved static Web + Go-only runtime architecture. | Positioning, success criteria, ADR-003, decision index, current state, architecture, domain rules, commitments, task history | +| 2026-08-16 | `20260816-disable-postgres-tls-d4a89c12` | Revision `ed97814` forces plaintext PostgreSQL in Go and retained Node clients, removes the obsolete RDS CA deployment dependency, and adds wire-level regression coverage for an endpoint that refuses TLS. No live deployment was performed. | Task record, application/deployment docs | +| 2026-08-16 | `20260816-integrate-plaintext-postgres-6e3b1a90` | Serialized canonical promotion of the user-approved plaintext PostgreSQL transport decision and its private-network security boundary. | Positioning, decision index, current state, architecture, commitments, task history | ## Notes diff --git a/.project-docs/30-worklog/tasks/20260816-integrate-plaintext-postgres-6e3b1a90.md b/.project-docs/30-worklog/tasks/20260816-integrate-plaintext-postgres-6e3b1a90.md new file mode 100644 index 0000000..4e3183a --- /dev/null +++ b/.project-docs/30-worklog/tasks/20260816-integrate-plaintext-postgres-6e3b1a90.md @@ -0,0 +1,66 @@ +# Task: Integrate plaintext PostgreSQL decision + +## Identity + +- Task ID: 20260816-integrate-plaintext-postgres-6e3b1a90 +- Mode: Integration +- Branch: main +- Worktree: D:\Datas\OthersProjects\NianAIGC +- Base commit: ed978142ebbea4ed8e4d3743f9ece42a334c6ea5 +- Owner: codex +- Status: Ready for Integration + +## Scope + +- Promote the completed plaintext PostgreSQL implementation and decision into + canonical project memory. +- Reconcile stale verified-CA/TLS wording in current architecture, deployment + commitments, and current-state guidance. +- Do not change application code, Alibaba Cloud configuration, or historical + task/proposal records. + +## Intent And Constraints + +- The user explicitly requires a code-only correction and no Alibaba Cloud RDS + configuration change. +- PostgreSQL clients must enforce plaintext even when an existing Secret still + contains TLS query parameters. +- Canonical memory must disclose that transport confidentiality now depends on + the internal endpoint plus VPC, security-group, and allowlist isolation. +- Source feature task `20260816-disable-postgres-tls-d4a89c12` and commit + `ed97814` are read-only inputs to this integration task. + +## Outcome + +- Canonical `RDS-001` now records the plaintext transport amendment and its + required private-network isolation boundary. +- Current state, architecture, positioning, commitments, and history now point + rollout at `ed97814` and no longer describe verified-CA TLS as the target. +- No application code, cloud configuration, or deployment state was changed by + this integration task. + +## Verification + +- Source implementation final `sol_reviewer`: PASS for Standards and Spec after + both identified gaps were fixed. +- `check_project_docs.py --target .`: PASS. +- `check_doc_drift.py --target . --task-id + 20260816-integrate-plaintext-postgres-6e3b1a90`: PASS; only this integration + task record and authorized canonical documents changed. +- `git diff --check`: PASS (line-ending conversion warnings only). +- First read-only integration review: FAIL on one stale TLS/CA maintenance item + and this record's pending verification state; both findings were remediated. +- Final read-only integration re-review: PASS; both initial documentation + findings are closed and no residual Standards or Spec blocker remains. + +## Follow-ups + +- Build, publish, and deploy immutable Web and Go images from `ed97814`. +- Apply the checked-in Go manifest without the obsolete CA mount and verify + bootstrap/readiness against the real internal RDS endpoint. +- Record effective VPC, security-group, allowlist, database-role, and live + request-path ownership evidence without exposing credentials. + +## Promotion Candidates + +- None; this integration task directly updates canonical memory. diff --git a/.project-docs/80-commitments/commitments.md b/.project-docs/80-commitments/commitments.md index d686cec..75f7c44 100644 --- a/.project-docs/80-commitments/commitments.md +++ b/.project-docs/80-commitments/commitments.md @@ -4,7 +4,7 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks, | Date | Commitment | Trigger / Due | Owner | Status | Next Action | |---|---|---|---|---|---| -| 2026-08-12 | Validate migration, TLS, permissions, and readiness against the real Alibaba Cloud RDS instance. | Production hardening follow-up | Deployment owner | Open | Record the live RDS roles/CA/network configuration and validation evidence; public `/api/ready` currently returns HTTP 200 with PostgreSQL configured. | +| 2026-08-12 | Validate migrations, plaintext connectivity, permissions, and readiness against the real Alibaba Cloud RDS instance. | Production hardening follow-up | Deployment owner | Open | Deploy `ed97814`, then record live roles, internal endpoint, VPC/security-group/allowlist controls, bootstrap, and readiness evidence. Do not treat the earlier public `/api/ready` response as evidence for the new image. | | 2026-08-12 | Keep Go at one replica until generated assets use OSS or another shared store; static Web may scale independently. | Before raising Go replicas or replacing a Pod whose local files must survive | Deployment owner | Open | Configure and validate external object storage; absent OSS, `emptyDir` files are lost on Pod replacement. | | 2026-08-12 | Harden production runtimes to non-root with explicit writable paths. | Security hardening follow-up | Application owner | Completed | Go already uses UID 10001; `b14b4fc` moves Web to unprivileged Nginx UID/GID 101 with read-only root and a `/tmp` volume. | | 2026-08-12 | Implement ADR-003 only after executable compatibility contracts exist. | Before starting the Go migration | Application owner | Completed | Contracts exist under `contracts/`; Go implementation merged 2026-08-14. | @@ -13,8 +13,8 @@ Track future-facing memory: promised follow-ups, unfinished loops, timed checks, | 2026-08-14 | Confirm the live status of `ZHINIAN_BOOTSTRAP_ADMIN_PHONE` / `ZHINIAN_BOOTSTRAP_ADMIN_PASSWORD`; the Go process creates the first super administrator exactly once and uses the default name when `ZHINIAN_BOOTSTRAP_ADMIN_NAME` is absent. | Production configuration audit | Deployment owner | Open | Verify deployed configuration and bootstrap outcome without exposing credentials. | | 2026-08-14 | Validate the Go backend against non-production RDS, real OSS, provider credentials, and external Webhooks. | Production hardening follow-up | Deployment owner | Open | Run the contract and recovery suites against representative external dependencies and record any live parity gaps. | | 2026-08-14 | Confirm the public `/api/v1` support promise for external consumers. | Production compatibility follow-up | Product owner | Open | Product decision on which v1 endpoints and behaviors are guaranteed for partners. | -| 2026-08-16 | Release and smoke-test authenticated `/create` SSR through the internal Go identity bridge. | Superseded by the static architecture decision | Deployment owner | Superseded | Do not deploy the SSR bridge as the target architecture; deploy `b14b4fc` static Web + Go instead. | -| 2026-08-16 | Publish and deploy `b14b4fc` static Web + Go under immutable image references, then smoke the full same-origin boundary. | Before closing the production login repair | Deployment owner | Open | Build/container-smoke Web, server-side dry-run ACK, verify live path owners, anonymous login, `/create?mode=video`, logout, role pages, Web `/healthz`, Go `/api/health`, and Go `/api/ready`. | +| 2026-08-16 | Release and smoke-test authenticated `/create` SSR through the internal Go identity bridge. | Superseded by the static architecture decision | Deployment owner | Superseded | Do not deploy the SSR bridge as the target architecture; deploy the static Web + Go release containing `ed97814` instead. | +| 2026-08-16 | Publish and deploy `ed97814` static Web + Go under immutable image references, then smoke PostgreSQL bootstrap and the full same-origin boundary. | Before closing the production login repair | Deployment owner | Open | Build/container-smoke both images, server-side dry-run ACK, verify no PostgreSQL SSLRequest, confirm live path owners, anonymous login, `/create?mode=video`, logout, role pages, Web `/healthz`, Go `/api/health`, and Go `/api/ready`. | ## Use diff --git a/.project-docs/90-maintenance/stale-items.md b/.project-docs/90-maintenance/stale-items.md index 849ebc7..99d4215 100644 --- a/.project-docs/90-maintenance/stale-items.md +++ b/.project-docs/90-maintenance/stale-items.md @@ -9,7 +9,10 @@ This is the integrated registry of stale or conflicting canonical memory. Update ## Missing Context -- RDS deployment inputs (target version, connection budget, endpoint, TLS/CA bundle, database roles, ACK network policy) — needed before production validation. +- RDS deployment inputs (target version, connection budget, exact internal + endpoint, database roles, effective VPC/security-group/RDS allowlist policy) + — needed before production validation of the intentionally plaintext + connection. - Real OSS bucket/credential configuration — needed before horizontal scaling or Go asset validation. - The public `/api/v1` support promise for external consumers — needed before the first production deployment.