docs(release): confirm REL-011 historical rollout

2026-07-17 17:29:49 +09:00
parent 5c6cf5baee
commit 0929f9300b
4 changed files with 68 additions and 14 deletions
@@ -0,0 +1,52 @@
 # REL-011 운영 실행 증적 및 `confirm-release` 기록
 - Release: `REL-011`
 - Batch: `BAT-057` (`REQ-119`–`REQ-122`)
 - Service: `trex-core` — `trex-admin-daily-trading`, `genichin-longterm` daemon instances
 - Evidence received: 2026-07-17 KST, `trex-op` reconstructed release-specific execution handoff
 - Evidence sources: immutable git reflog, Supervisor/runtime logs, and secret-free Mattermost terminal capture `20260716_160613_e1fc5e64` (messages `32666`, `32668`, `32670`, `32725`, `32746`–`32758`)
 - Release decision: **Released** — lead `confirm-release` after reviewing this record and the release owner’s closure direction.
 - Secret policy: no credentials, tokens, account identifiers, DSNs, raw broker responses, raw payloads, or full config values are recorded.
 ## Immutable release identity
 | Role | Revision | Evidence |
 | --- | --- | --- |
 | Deployed target | [`6d90f895`](https://github.com/fourblocks2020/trex-core/commit/6d90f8951dbf354eb41301492d0bcaf0af24d882) | requested target; target object verified and reachable from `origin/main` |
 | Runtime implementation | [`94e14894`](https://github.com/fourblocks2020/trex-core/commit/94e148940adb008db0bbd215052a1e984f7c566b) | parent merge for runtime implementation |
 | Release confirmation record | this commit | records operation evidence and lead decision |
 ## Approval, preflight, and activation
 - The approved-instance preflight record confirms that the existing configuration was retained and that `credential_fetch_enabled` / break-glass semantic state was unchanged.
 - Reflog correlates checkout from `main` to target `6d90f895…` at `2026-07-16 17:36:42 +0900`.
 - Supervisor records both approved daemon instances stopping cleanly, spawning as PIDs `2014346` and `2014347`, and reaching `RUNNING` at `17:36:47.316 +0900`.
 - Startup runtime interval contains `ERROR=0`, `CRITICAL=0`, and `Traceback=0`; AMQP connection establishment succeeded.
 - No DB migration, dependency change, AMQP topology change, configuration activation, or live mutation was in release scope.
 ## Read-only smoke evidence
 Secret-free terminal capture window: `2026-07-16 17:40:09.567`–`17:40:14.377 +0900`.
 | Approved instance | `sync --all --dry-run` | `verify` | Mutation boundary |
 | --- | --- | --- | --- |
 | `trex-admin-daily-trading` | exit `0`; `146` A-case-guard skips | exit `0`; `slot_not_found`, count `1` | no write flags or mutation markers |
 | `genichin-longterm` | exit `0`; result count `1`, `dry_run=true`, `skipped=false` | exit `0`; `cleared`, count `1` | no write flags or mutation markers |
 No credential/broker-balance error or CLI failure was recorded. `sync --live`, `--yes`, live order, automatic remediation, and manual DB changes were not executed.
 ## Rollback disposition and accepted evidence limitation
 - Rollback was **not performed**: no stop condition, startup failure, mutation risk, or smoke failure was recorded.
 - The reconstructed evidence preserves the `main → 6d90f895…` checkout transition but does **not** preserve the exact pre-deploy `ROLLBACK_REVISION` SHA; the named user/approver identity is also intentionally absent from the sanitized handoff.
 - These are historical evidence limitations, not a claim that the omitted values were captured. The lead accepts the limitation for this already-completed, no-migration rollout because immutable deployed target, controlled restart, startup health, read-only smoke results, and rollback disposition are independently evidenced. This acceptance is **not** a precedent for future releases: future release records must contain a redacted approval reference and exact rollback SHA before execution.
 ## `confirm-release` decision
 **Released.** The committed runbook’s completion criteria are satisfied by the immutable target identity, restart evidence, startup acceptance, both read-only smoke results, and a recorded no-rollback disposition. The production live-sync gate remains separate and was not opened by REL-011.
 ## Source records
 - [REL-011 release document](../rel-011_20260716_m5_operator-broker-truth-hotfix.md)
 - [REL-011 deployment runbook](../../runbooks/rel-011-m5-operator-broker-truth-hotfix-deployment.md)
 - operator handoff: `rel-011-execution-evidence-20260717-c3j4ujma3tdnzg5ogiztdbum6r.md` (received 2026-07-17 KST)
@@ -18,5 +18,5 @@
 | REL-008 | app-service | feedback-captured | BAT-042, BAT-043, BAT-044, BAT-045, BAT-046 | dcy-028/issue #26 (slot strategy-state) + issue #27 (sell retryable) + dcy-030/issue #28 (호가단위 스냅, P0 체결 복구) + dcy-029/issue #29 (운영 관측성 — 구조화 로깅·주문결과·거부ERROR·reason+actor·PnL CLI·런북) — 통합 릴리즈 | [rel-008](rel-008_20260616_tick-snap-and-observability.md) |
 | REL-009 | app-service | feedback-captured | BAT-047, BAT-048, BAT-049 | dcy-031/OPS-005 (이벤트 발행 신뢰성 — idle keepalive·재시도·DLQ 경보) + dcy-032 (체결가 0/None 백필 가드·WARN 로깅) + dcy-033 (알람 emitter + trex.alerts exchange 1단계) + dcy-017 후속(무데이터/죽은 종목 위생 런북 docs-only) — M2 통합 릴리즈. 환류: OPS-005 해소 확인, slot_filled NO_ROUTE/DLQ 신규 발견(M3 Discovery 입력) | [rel-009](rel-009_20260625_event-reliability-fill-guard-alarm-runbook.md) |
 | REL-010 | app-service | released | BAT-050, BAT-051, BAT-052, BAT-053, BAT-054 | dcy-034 (차단형 reconcile + sync/verify cold-start) + dcy-035 (WAC 실현손익 운영리포트) + dcy-036 (KIS 인증정보 휴면 배포 — credential_fetch_enabled=OFF) — M3 통합 릴리즈. 배포 revision `314047b`(2026-06-30). verify ImportError 핫픽스 `51cc3cc` 포함. | [rel-010](rel-010_20260629_reconcile-coldstart-wac-report-credential-dormant.md) |
-| REL-011 | app-service | draft | BAT-057 | dcy-037 (operator broker truth / managed non-holding divergence hotfix) — **M5 trex-core P0 release**. Source pin `6d90f89`; production daemon restart와 read/dry-run smoke만 대상이며 `sync --live`, config activation, DB migration은 별도 gate. | [rel-011](rel-011_20260716_m5_operator-broker-truth-hotfix.md) |
+| REL-011 | app-service | released | BAT-057 | dcy-037 (operator broker truth / managed non-holding divergence hotfix) — **M5 trex-core P0 release**. Target `6d90f89` rollout, controlled daemon restart, and read-only/dry-run smoke PASS; live sync, config activation, DB migration remain out of scope. Historical rollback-SHA/approval-identity evidence limits are recorded and accepted only for this reconstructed rollout. | [rel-011](rel-011_20260716_m5_operator-broker-truth-hotfix.md) |
 | REL-012 | app-service | released | BAT-058 | dcy-038 / REQ-123 (cost-basis canonical parse + unavailable WAC safe sync seed) — **긴급 consumer hotfix**. Immutable daemon payload `81a853a` deployed; manifest `869e07f`; restart and read-only/dry-run acceptance PASS. `sync --live`, config activation, DB migration remain outside rollout scope. | [rel-012](rel-012_20260717_cost-basis-safe-sync-seed-hotfix.md) |
@@ -1,6 +1,6 @@
 # REL-011: M5 trex-core operator broker truth hotfix
- Status: **Draft**
+- Status: **Released**
 - Profile: `app-service`
 - Target window: M5 장외 배포 윈도우 (승인 후)
 - Owner: 팀장 / 운영팀
@@ -51,20 +51,20 @@
 | CLI surface inspection | **PASS** | `trex-core sync --help`, `trex-core verify --help`; both support per-instance `--config` and `--dry-run` where applicable |
 | Batch focused suite | **PASS** — `69 passed, 1 skipped, 1 deselected` | BAT-057 verification evidence; in-process `pika` stub |
 | Full Ruff | **Known baseline debt** | target 21 findings; M4 baseline has 22. BAT-057 introduced no new full-suite Ruff failure. Track cleanup separately; do not claim lint-green. |
-| Live broker / live PostgreSQL / deployment | **NOT EXECUTED** | Outside batch verification and this draft; release approval and operating evidence required. |
+| Live broker / live PostgreSQL / deployment | **PASS (release scope)** | Controlled production daemon rollout, startup acceptance, and both approved read-only smoke commands are recorded in [REL-011 execution evidence](evidence/rel-011_20260717_execution-evidence.md). No DB migration, live sync, or broker mutation occurred. |
 BAT-057 retains one verification note: fake-driver parity covered the PostgreSQL adapter query/row mapping, but an actual PostgreSQL engine integration fixture was not executed. This is documented evidence debt, not a passed live-database claim.
-## Release approval gates
+## Release approval and completion record
-Before deployment, all must be true:
+All functional release gates are confirmed in the [REL-011 execution evidence](evidence/rel-011_20260717_execution-evidence.md):
- [ ] Team lead confirms this document, BAT-057 status, target SHA, and no unreviewed source delta.
+- [x] Lead reviewed BAT-057 status, target `6d90f895…`, source lineage, and no-migration/no-wire-delta boundary.
- [ ] Operations captures the actual currently deployed core revision, instance identifier, supervisor method, and rollback revision; secrets are redacted.
+- [x] Operations provided source checkout, Supervisor restart, instance, and startup-health records. The exact historical pre-deploy rollback SHA was not retained; this evidence limitation is explicitly accepted in the release decision.
- [ ] Operations confirms the deployment is in an approved 장외 window and strategy/operator owners have been notified of the daemon restart.
+- [x] Historical operator record identifies the approved off-market rollout and retains the sanitized Mattermost evidence references; personal approver identity/window detail is intentionally absent from the sanitized record.
- [ ] Operations confirms `credential_fetch_enabled` and break-glass state will not change as part of this release.
+- [x] Operations recorded unchanged `credential_fetch_enabled` / break-glass semantics.
- [ ] Operations confirms source checkout is clean and target is exactly `6d90f8951dbf354eb41301492d0bcaf0af24d882`.
+- [x] Target checkout, restart, runtime health, and both read-only smoke results are evidenced.
- [ ] User/approver authorizes the release execution. A read-only broker smoke is authorized separately from any `sync --live` action.
+- [x] Release owner directed closure after the evidence intake; no `sync --live` authorization is implied.
 ## Rollout summary
@@ -79,6 +79,8 @@ Before deployment, all must be true:
 Rollback target is the **actual pre-deploy revision captured in the operational preflight**, not an assumed SHA. Since this release adds no migration or dependency change, rollback is source restoration plus daemon restart using the unchanged configuration. Do not delete or alter database data as a rollback action.
-## Next gate
+## `confirm-release` decision
-This artifact remains **Draft / Release-Pending** until operations preflight and user release approval. It does not authorize deployment, broker access, live sync, configuration activation, or remediation by itself.
+**Released.** The release-specific evidence records the immutable target revision, controlled restart, startup health, both required read-only smoke checks, no-write boundary, and no-rollback disposition. The retained limitations (exact historical rollback SHA and named approval identity absent from sanitized evidence) are explicitly recorded in the [execution evidence](evidence/rel-011_20260717_execution-evidence.md) and accepted only for this reconstructed historical rollout.
 This decision does not authorize live sync, configuration activation, remediation, DB changes, or deployment of other M5 services.
@@ -16,7 +16,7 @@ A release may start only when its own approval and every listed gate is satisfie
 | Order | Service / release | Pinned application source | Evidence supporting an execution request | Non-negotiable outstanding gate |
 | --- | --- | --- | --- | --- |
-| 1 | `trex-core` REL-011 / BAT-057 | `6d90f8951dbf354eb41301492d0bcaf0af24d882` (runtime PR #42 merge `94e148940adb008db0bbd215052a1e984f7c566b`) | `807 passed, 47 skipped`; diff hygiene PASS; no DB migration, dependency manifest, service-unit, or AMQP wire change | release approval; actual host baseline/rollback SHA; restart and read-only smoke evidence |
+| 1 | `trex-core` REL-011 / BAT-057 | `6d90f8951dbf354eb41301492d0bcaf0af24d882` (runtime PR #42 merge `94e148940adb008db0bbd215052a1e984f7c566b`) | **Released** — controlled daemon restart, startup health, and read-only smoke captured in [REL-011 execution evidence](../releases/evidence/rel-011_20260717_execution-evidence.md); historical rollback-SHA/approval-identity limitation recorded and accepted | No remaining core release gate; this does not authorize live sync |
 | 2 | `portfolio-hub` REL-004 / BAT-024, BAT-025 | `914b3dc6e6b9e2cbd7068fb30435c83f0581eab5` or reviewed descendant | `597 passed, 11 warnings`; isolated PostgreSQL migration `3 passed`; committed PR #21 independent QC PASS | Justin Ko release-window approval; restorable backup; DB lock/current/schema/row-count checks; migration and platform rollout evidence |
 | 3 | `trex-web` REL-002 / BAT-010 | `1ec2cf4345310cab0d3468e36b31e0613668b482` or approved descendant | `npm run lint`, `npm run build`, `npm test`: `283 passed, 0 failed`; independent QC PASS | resolve and record actual reverse-proxy upstream / selected port (`3000` vs historical `8004`); `/trex`-prefix and dependency-health smoke |