docs(release): complete REL-011 approval evidence

2026-07-17 17:33:29 +09:00
parent 8f33a83bf6
commit 51b584edd2
4 changed files with 14 additions and 14 deletions
@@ -5,7 +5,8 @@
 - Service: `trex-core` — `trex-admin-daily-trading`, `genichin-longterm` daemon instances
 - Evidence received: 2026-07-17 KST, `trex-op` reconstructed release-specific execution handoff
 - Evidence sources: immutable git reflog, Supervisor/runtime logs, and secret-free Mattermost terminal capture `20260716_160613_e1fc5e64` (messages `32666`, `32668`, `32670`, `32725`, `32746`–`32758`)
- Release decision: **Released** — lead `confirm-release` after reviewing this record and the release owner’s closure direction.
+- Approval: Justin Ko — Mattermost message `32675`, `2026-07-16 17:22:50 KST`
 - Release decision: **Released** — lead `confirm-release` after reviewing this record.
 - Secret policy: no credentials, tokens, account identifiers, DSNs, raw broker responses, raw payloads, or full config values are recorded.
 ## Immutable release identity
@@ -19,6 +20,8 @@
 ## Approval, preflight, and activation
 - The approved-instance preflight record confirms that the existing configuration was retained and that `credential_fetch_enabled` / break-glass semantic state was unchanged.
 - Approval was recorded by Justin Ko in Mattermost message `32675` at `2026-07-16 17:22:50 KST`.
 - The actual pre-deploy rollback revision was captured as `7845fbe856e125e712ac481e36ac582c1a2fe54b`.
 - Reflog correlates checkout from `main` to target `6d90f895…` at `2026-07-16 17:36:42 +0900`.
 - Supervisor records both approved daemon instances stopping cleanly, spawning as PIDs `2014346` and `2014347`, and reaching `RUNNING` at `17:36:47.316 +0900`.
 - Startup runtime interval contains `ERROR=0`, `CRITICAL=0`, and `Traceback=0`; AMQP connection establishment succeeded.
@@ -35,15 +38,14 @@ Secret-free terminal capture window: `2026-07-16 17:40:09.567`–`17:40:14.377 +
 No credential/broker-balance error or CLI failure was recorded. `sync --live`, `--yes`, live order, automatic remediation, and manual DB changes were not executed.
-## Rollback disposition and accepted evidence limitation
+## Rollback disposition
 - Pre-deploy `ROLLBACK_REVISION`: `7845fbe856e125e712ac481e36ac582c1a2fe54b`.
 - Rollback was **not performed**: no stop condition, startup failure, mutation risk, or smoke failure was recorded.
 - The reconstructed evidence preserves the `main → 6d90f895…` checkout transition but does **not** preserve the exact pre-deploy `ROLLBACK_REVISION` SHA; the named user/approver identity is also intentionally absent from the sanitized handoff.
 - These are historical evidence limitations, not a claim that the omitted values were captured. The lead accepts the limitation for this already-completed, no-migration rollout because immutable deployed target, controlled restart, startup health, read-only smoke results, and rollback disposition are independently evidenced. This acceptance is **not** a precedent for future releases: future release records must contain a redacted approval reference and exact rollback SHA before execution.
 ## `confirm-release` decision
-**Released.** The committed runbook’s completion criteria are satisfied by the immutable target identity, restart evidence, startup acceptance, both read-only smoke results, and a recorded no-rollback disposition. The production live-sync gate remains separate and was not opened by REL-011.
+**Released.** The committed runbook’s completion criteria are satisfied by the explicit approval reference, immutable target identity, captured rollback revision, controlled restart, startup health, both read-only smoke results, and a recorded no-rollback disposition. The production live-sync gate remains separate and was not opened by REL-011.
 ## Source records
@@ -18,5 +18,5 @@
 | REL-008 | app-service | feedback-captured | BAT-042, BAT-043, BAT-044, BAT-045, BAT-046 | dcy-028/issue #26 (slot strategy-state) + issue #27 (sell retryable) + dcy-030/issue #28 (호가단위 스냅, P0 체결 복구) + dcy-029/issue #29 (운영 관측성 — 구조화 로깅·주문결과·거부ERROR·reason+actor·PnL CLI·런북) — 통합 릴리즈 | [rel-008](rel-008_20260616_tick-snap-and-observability.md) |
 | REL-009 | app-service | feedback-captured | BAT-047, BAT-048, BAT-049 | dcy-031/OPS-005 (이벤트 발행 신뢰성 — idle keepalive·재시도·DLQ 경보) + dcy-032 (체결가 0/None 백필 가드·WARN 로깅) + dcy-033 (알람 emitter + trex.alerts exchange 1단계) + dcy-017 후속(무데이터/죽은 종목 위생 런북 docs-only) — M2 통합 릴리즈. 환류: OPS-005 해소 확인, slot_filled NO_ROUTE/DLQ 신규 발견(M3 Discovery 입력) | [rel-009](rel-009_20260625_event-reliability-fill-guard-alarm-runbook.md) |
 | REL-010 | app-service | released | BAT-050, BAT-051, BAT-052, BAT-053, BAT-054 | dcy-034 (차단형 reconcile + sync/verify cold-start) + dcy-035 (WAC 실현손익 운영리포트) + dcy-036 (KIS 인증정보 휴면 배포 — credential_fetch_enabled=OFF) — M3 통합 릴리즈. 배포 revision `314047b`(2026-06-30). verify ImportError 핫픽스 `51cc3cc` 포함. | [rel-010](rel-010_20260629_reconcile-coldstart-wac-report-credential-dormant.md) |
-| REL-011 | app-service | released | BAT-057 | dcy-037 (operator broker truth / managed non-holding divergence hotfix) — **M5 trex-core P0 release**. Target `6d90f89` rollout, controlled daemon restart, and read-only/dry-run smoke PASS; live sync, config activation, DB migration remain out of scope. Historical rollback-SHA/approval-identity evidence limits are recorded and accepted only for this reconstructed rollout. | [rel-011](rel-011_20260716_m5_operator-broker-truth-hotfix.md) |
+| REL-011 | app-service | released | BAT-057 | dcy-037 (operator broker truth / managed non-holding divergence hotfix) — **M5 trex-core P0 release**. Justin Ko approval (`32675`, 2026-07-16 17:22:50 KST), target `6d90f89`, rollback SHA `7845fbe`, controlled daemon restart, and read-only/dry-run smoke PASS; live sync, config activation, DB migration remain out of scope. | [rel-011](rel-011_20260716_m5_operator-broker-truth-hotfix.md) |
 | REL-012 | app-service | released | BAT-058 | dcy-038 / REQ-123 (cost-basis canonical parse + unavailable WAC safe sync seed) — **긴급 consumer hotfix**. Immutable daemon payload `81a853a` deployed; manifest `869e07f`; restart and read-only/dry-run acceptance PASS. `sync --live`, config activation, DB migration remain outside rollout scope. | [rel-012](rel-012_20260717_cost-basis-safe-sync-seed-hotfix.md) |
@@ -60,8 +60,8 @@ BAT-057 retains one verification note: fake-driver parity covered the PostgreSQL
 All functional release gates are confirmed in the [REL-011 execution evidence](evidence/rel-011_20260717_execution-evidence.md):
 - [x] Lead reviewed BAT-057 status, target `6d90f895…`, source lineage, and no-migration/no-wire-delta boundary.
- [x] Operations provided source checkout, Supervisor restart, instance, and startup-health records. The exact historical pre-deploy rollback SHA was not retained; this evidence limitation is explicitly accepted in the release decision.
+- [x] Operations provided the captured pre-deploy `ROLLBACK_REVISION` `7845fbe856e125e712ac481e36ac582c1a2fe54b`, source checkout, Supervisor restart, instance, and startup-health records.
- [x] Historical operator record identifies the approved off-market rollout and retains the sanitized Mattermost evidence references; personal approver identity/window detail is intentionally absent from the sanitized record.
+- [x] Justin Ko authorized the release execution in Mattermost message `32675` at `2026-07-16 17:22:50 KST`; the read-only broker smoke did not authorize any `sync --live` action.
 - [x] Operations recorded unchanged `credential_fetch_enabled` / break-glass semantics.
 - [x] Target checkout, restart, runtime health, and both read-only smoke results are evidenced.
 - [x] Release owner directed closure after the evidence intake; no `sync --live` authorization is implied.
@@ -81,12 +81,10 @@ Rollback target is the **actual pre-deploy revision captured in the operational
 ## `confirm-release` decision
-**Released.** The release-specific evidence records the immutable target revision, controlled restart, startup health, both required read-only smoke checks, no-write boundary, and no-rollback disposition. The retained limitations (exact historical rollback SHA and named approval identity absent from sanitized evidence) are explicitly recorded in the [execution evidence](evidence/rel-011_20260717_execution-evidence.md) and accepted only for this reconstructed historical rollout.
+**Released.** The release-specific evidence records Justin Ko’s approval reference, immutable target revision, pre-deploy rollback SHA `7845fbe…`, controlled restart, startup health, both required read-only smoke checks, no-write boundary, and no-rollback disposition. This decision does not authorize live sync, configuration activation, remediation, DB changes, or deployment of other M5 services.
 This decision does not authorize live sync, configuration activation, remediation, DB changes, or deployment of other M5 services.
 ## Release feedback
 - **Operational outcome:** the reconstructed record shows a clean controlled restart, no startup fatal log, and successful read-only smoke for both approved instances; no release-scope rollback or incident was recorded.
- **Process debt:** the historical record lacked an exact pre-deploy rollback SHA and named approval identity in its sanitized form. The limitation was accepted only for this completed historical rollout.
+- **Evidence recovery outcome:** the final secret-free record now includes the approval reference and exact pre-deploy rollback revision, alongside the operational smoke evidence.
- **Next Discovery input:** establish a release-evidence capture standard that records a redacted approval reference, exact rollback revision, instance identity, per-command timestamp/exit/result/no-write classification, and rollback disposition before a future release gate is closed.
+- **Next Discovery input:** standardize first-pass release evidence capture: a redacted approval reference, exact rollback revision, instance identity, per-command timestamp/exit/result/no-write classification, and rollback disposition must be recorded before a future release gate is closed.
@@ -16,7 +16,7 @@ A release may start only when its own approval and every listed gate is satisfie
 | Order | Service / release | Pinned application source | Evidence supporting an execution request | Non-negotiable outstanding gate |
 | --- | --- | --- | --- | --- |
-| 1 | `trex-core` REL-011 / BAT-057 | `6d90f8951dbf354eb41301492d0bcaf0af24d882` (runtime PR #42 merge `94e148940adb008db0bbd215052a1e984f7c566b`) | **Released** — controlled daemon restart, startup health, and read-only smoke captured in [REL-011 execution evidence](../releases/evidence/rel-011_20260717_execution-evidence.md); historical rollback-SHA/approval-identity limitation recorded and accepted | No remaining core release gate; this does not authorize live sync |
+| 1 | `trex-core` REL-011 / BAT-057 | `6d90f8951dbf354eb41301492d0bcaf0af24d882` (runtime PR #42 merge `94e148940adb008db0bbd215052a1e984f7c566b`) | **Released** — Justin Ko approval `32675`, rollback SHA `7845fbe`, controlled daemon restart, startup health, and read-only smoke captured in [REL-011 execution evidence](../releases/evidence/rel-011_20260717_execution-evidence.md) | No remaining core release gate; this does not authorize live sync |
 | 2 | `portfolio-hub` REL-004 / BAT-024, BAT-025 | `914b3dc6e6b9e2cbd7068fb30435c83f0581eab5` or reviewed descendant | `597 passed, 11 warnings`; isolated PostgreSQL migration `3 passed`; committed PR #21 independent QC PASS | Justin Ko release-window approval; restorable backup; DB lock/current/schema/row-count checks; migration and platform rollout evidence |
 | 3 | `trex-web` REL-002 / BAT-010 | `1ec2cf4345310cab0d3468e36b31e0613668b482` or approved descendant | `npm run lint`, `npm run build`, `npm test`: `283 passed, 0 failed`; independent QC PASS | resolve and record actual reverse-proxy upstream / selected port (`3000` vs historical `8004`); `/trex`-prefix and dependency-health smoke |