From 576e131b0e739735848dbb375fcd612e8ca307eb Mon Sep 17 00:00:00 2001 From: Chris Leiter Date: Tue, 6 Oct 2026 11:13:55 -0400 Subject: [PATCH] Qualify native rollout and document operator state restoration --- .../REAL_PROJECT_FACILITY_OPERATIONS.md | 73 ++++++++++++++++--- modules/delivery.md | 12 +++ 2 files changed, 76 insertions(+), 9 deletions(-) diff --git a/docs/exec_ctrl/REAL_PROJECT_FACILITY_OPERATIONS.md b/docs/exec_ctrl/REAL_PROJECT_FACILITY_OPERATIONS.md index 1d5a318..df0557a 100644 --- a/docs/exec_ctrl/REAL_PROJECT_FACILITY_OPERATIONS.md +++ b/docs/exec_ctrl/REAL_PROJECT_FACILITY_OPERATIONS.md @@ -1,11 +1,12 @@ # Controlled real-project trial: an existing application -Date: 2026-10-06. Local correction verified; candidate native acceptance pending. +Date: 2026-10-06. Initial local correction verified; native acceptance subsequently +passed in the authorized follow-up below. Method: preview 5, `8f0117cf3e36975874a0b96853476391b0f115df`. Public target: [facility operations](https://github.com/LeiterConsulting/splunk-facility-operations), baseline `b8209ef7013ca1d1b421415b1226bcfcc8ce99d4`. Reviewed candidate: `b1fbfa7e342f2d6bb5874fdf255036f3a9a8e3ca`, -[application draft PR](https://github.com/LeiterConsulting/splunk-facility-operations/pull/1). +[application correction](https://github.com/LeiterConsulting/splunk-facility-operations/pull/1). ## Task and authority @@ -57,7 +58,7 @@ Skip only known host capability denials for symlink creation; unexpected errors still fail. The linked-input rejection then passed on Linux. Nearby contributor and live-data guidance were updated with these contracts. -| Check actually performed | Result and boundary | +| Initial check actually performed | Result and boundary | | --- | --- | | Repaired `npm run verify` | Type check, build/package and 11 model tests passed; 15 backend/package tests discovered, 14 passed and one Windows symlink skip | | Linux backend/package suite | All 15 passed, including actual linked-input rejection and private-file exclusion/inventory preservation fixtures | @@ -80,8 +81,8 @@ receipts, screenshots and environment troubleshooting remain private. The optional offline helper selected declared gates and rehashed explicit source inputs. The candidate manifest also included its generated lookup and package; credentials, dependencies, private policy and remote environment state were -excluded. The current record is valid but blocked on candidate native acceptance. -That is an intentional scope hold, not a failed local correction. +excluded. The initial record was valid but blocked on candidate native acceptance. +That was an intentional scope hold, not a failed local correction. | Deliberate record check | Observed helper result | | --- | --- | @@ -95,7 +96,7 @@ These checks validate declared structure, evidence kinds and subject consistency The helper did not run the application tests, authenticate approvers or establish evidence truth. The author reviewed the diff and retained failing/passing reports. -| Trial axis | Observation | +| Initial trial axis | Observation | | --- | --- | | Retrieval / blind activation | Not exercised; method/context preloaded, local entry/modules read at the pinned revision | | Selection | Relevant modules and explicit high-risk gates used; no recursive v1 load | @@ -111,6 +112,60 @@ work; it adds no mandatory activation reads, helper behavior or version change. Framework follow-up validation is recorded in the feedback PR checks. Independent cross-IDE adoption, organization rulesets, external team connectors, -real provider inference and release/customer acceptance remain untested. Review -and authorized candidate deployment are subsequent gates, separate from this -completed local correction and the already published framework preview. +real provider inference and customer acceptance remain untested. The initial trial +left review and authorized candidate deployment as subsequent gates. The follow-up +below closes the bounded native gate with new evidence, preserving the earlier +results and their original scope. + +## Authorized post-merge native follow-up + +After both corrections merged, the owner requested deployment and native checks. +Method: merged framework `3a1d26cb32aaecb3d1df117be2f73690da544175`. +Application: merged `b7c89e6418fe2ba84404d837d3cd6b3882f21d79`, with the same Git +tree as the tested application candidate. This remains a controlled authoring run. + +Back up scoped operator files, permissions and effective settings before rollout. +Reconstruct the original installer and verify it against its retained digest; +retain it for rollback. No rollback was needed or executed. Upgrade the first +environment, restore approved operator state and verify it before the second. +Both updates rewrote operator metadata and the empty inventory file. Restore the +original bytes and permissions from the protected backups, then repeat affected +native checks. This is meaningful upgrade behavior, not evidence that a sanitized +release package automatically preserves installed state. + +A new browser in one environment received an older frontend after an earlier +browser had passed candidate identity. Retain that failure. A project-supported +Web asset-cache refresh followed by new normal and regression browsers yielded +the correct candidate. Exact internal cache/worker causality was not established. +No service restart, provider change or server-side synthetic inventory write was +performed. Connection values, backups, receipts and screenshots remain private. + +| Follow-up check actually performed | Result and boundary | +| --- | --- | +| Deployed identity | Raw installed bundle and fresh served assets match the repaired candidate on both supported versions | +| Normal native workflows | Eight service and ten browser checks per environment; 36 passed against the repaired candidate, with no page errors | +| Briefing regressions | Six cases per environment, 12 passed using browser-only synthetic search responses against the installed frontend; no live-source ingestion claim | +| Scoped preservation and identity | Nine checks per environment passed: protected file bytes/permissions, effective settings, inventory, other-app version/enabled flags, app flags, unchanged startup time and raw bundle identity | +| Fresh merged-source verification | 11 model tests, all 15 backend/package tests on Linux and four local browser workflows passed; Windows retains one explicit symlink skip | +| Fresh dependency audits | Runtime and full audits report zero advisories | +| Scanner artifact binding | Rebuild is byte-identical to the earlier inspected/deployed installer; the retained AppInspect 4.2.1 report applies to those bytes, with its original warnings/skips and certification limits | +| Fresh record and source comparison | Exit 0, structurally valid and ready to close; current deployment and live evidence satisfy the declared native gate | + +Git checkout normalized line endings in five selected source/test/doc files after +merge reconciliation. The old raw-byte manifest was correctly rejected even +though the canonical Git tree matched the candidate. Fresh verification and a new +20-input manifest identified current inputs; the rebuild matched the deployed +artifact. Historical records and failures were retained, not relabeled as passes +for a different source subject. The helper remained offline and read-only; project +tools performed the network, upgrade and browser operations. + +The twelve briefing cases check unknown-only and partial coverage in normal and +recovery phases, and positive verified healthy/recovered behavior. Their synthetic +responses exist only in isolated browsers. Normal native workflows separately +exercise actual lab searches and the deterministic investigation service. + +The [delivery module](../../modules/delivery.md) now makes operator-state restoration +and fresh-client asset identity explicit. This adds relevant rollout guidance, +with no activation-entry, adapter, helper, catalog or version change. Independent +adoption, organization policy, native reader-role, real model, cloud certification +and customer acceptance remain outside this completed deployment qualification. diff --git a/modules/delivery.md b/modules/delivery.md index c0fdaea..6fbd31e 100644 --- a/modules/delivery.md +++ b/modules/delivery.md @@ -31,6 +31,18 @@ required behavior in that environment. After an abort, verify the restored artifact and its behavior; copying an old file alone is not rollback acceptance. This says nothing about reversing persisted data, which needs its own recovery. +For an upgrade, back up the scoped operator-owned settings, permissions/metadata +and mutable files in a protected location. A sanitized package can still overwrite +installed operator state. Compare relevant bytes, ownership/permissions and +effective settings afterward; restore approved overrides from verified backups +and recheck the affected behavior. State the comparison's coverage explicitly. + +Verify served assets as well as installed files. An earlier successful request +does not establish that a later client receives the same artifact. If fresh clients +observe stale assets, use the project's supported cache invalidation within the +authorized rollout scope; coordinate shared caches and recheck runtime identity. +Do not infer cache internals or perform a service restart from that symptom alone. + ## Evidence and gate `delivery-readiness`: artifact/source identity, required checks, rollout/recovery