feat(reconcile): safely seed canonical cost basis
This commit is contained in:
Hermes Agent
@@ -0,0 +1,115 @@
|
||||
# REL-012 cost-basis safe sync seed hotfix — deployment runbook
|
||||
|
||||
- Release: `REL-012`
|
||||
- Target source: **PENDING_COMMIT_AND_PUSH** (replace only with the approved immutable remote SHA)
|
||||
- Execution owner: 운영팀
|
||||
- Approval required: team lead review + user production execution approval
|
||||
- Safety classification: daemon restart; no DB migration; read/dry-run smoke only
|
||||
|
||||
> Do not record credentials, tokens, account numbers, DSNs, `.env` content, raw broker/portfolio responses, or command lines containing secrets. Use `[REDACTED]`.
|
||||
|
||||
## 1. Hard boundaries
|
||||
|
||||
Allowed only after every REL-012 approval gate is checked:
|
||||
|
||||
- Check out the approved immutable source and restart the existing trex-core daemon through the host’s approved supervisor.
|
||||
- Inspect startup status/logs and execute `sync --all --dry-run --json` plus `verify --json` using the unchanged approved instance configuration.
|
||||
|
||||
Not allowed:
|
||||
|
||||
- `sync --live`, `--yes` with a live write, automatic remediation, `enter`, `exit`, `cancel`, target portfolio selection, or any DB write.
|
||||
- Changes to credential/break-glass mode, instance config, endpoints, secrets, dependency versions, DB schema, AMQP topology, or strategy daemons.
|
||||
|
||||
If a prohibited action appears necessary, stop and return to the approver.
|
||||
|
||||
## 2. Preflight
|
||||
|
||||
1. Confirm the exact approved target SHA, approval, and off-market execution window. If the target remains `PENDING_COMMIT_AND_PUSH`, **stop**.
|
||||
2. Capture only redacted operating-checkout metadata:
|
||||
|
||||
```bash
|
||||
pwd
|
||||
git status --short
|
||||
git rev-parse HEAD
|
||||
git rev-parse --abbrev-ref HEAD
|
||||
```
|
||||
|
||||
Record the current SHA as `ROLLBACK_REVISION`. A dirty checkout is a stop condition.
|
||||
3. Identify the active instance configuration and existing supervisor method without exposing configuration values. Confirm credential/break-glass state will remain unchanged.
|
||||
4. From a clean source checkout, verify the candidate and migration/dependency delta:
|
||||
|
||||
```bash
|
||||
git fetch origin
|
||||
git show -s --format='%H %s' <APPROVED_TARGET_SHA>
|
||||
git diff --name-only "$ROLLBACK_REVISION" <APPROVED_TARGET_SHA> -- pyproject.toml trex_core/adapters/persistence/migrations
|
||||
```
|
||||
|
||||
Any output on a dependency/migration path or any uncertainty about the target SHA is a stop condition requiring lead review.
|
||||
|
||||
## 3. Source deployment and restart
|
||||
|
||||
Use the approved host supervisor; do not infer a service-manager command from this document.
|
||||
|
||||
```bash
|
||||
git fetch origin
|
||||
git checkout --detach <APPROVED_TARGET_SHA>
|
||||
# Stop the existing daemon through the approved host supervisor.
|
||||
# Start exactly one daemon with the unchanged approved instance configuration.
|
||||
.venv/bin/trex-core-daemon --config <approved-instance-config>
|
||||
```
|
||||
|
||||
Record redacted proof of target SHA, old-process stop, new-process supervisor/PID status, selected instance key, and startup log interval.
|
||||
|
||||
## 4. Startup acceptance and read-only smoke
|
||||
|
||||
Before CLI smoke, confirm startup completed, RabbitMQ topology declaration completed, expected workers are running, and the post-restart window has no `ERROR`, `CRITICAL`, or traceback.
|
||||
|
||||
Run only:
|
||||
|
||||
```bash
|
||||
.venv/bin/trex-core sync --all --dry-run --config <approved-instance-config> --json
|
||||
.venv/bin/trex-core verify --config <approved-instance-config> --json
|
||||
```
|
||||
|
||||
Acceptance:
|
||||
|
||||
- Output is sanitized; no credential/account/raw payload is collected.
|
||||
- For available WAC, dry-run may show `seeded_avg_price=true` with the preview only; no slot/warning write occurs.
|
||||
- For unavailable WAC on a positive-broker inactive slot, dry-run must show `seeded_avg_price=false`, sanitized reason, and no-write preview.
|
||||
- No invocation adds `--live` or `--yes`; no remediation occurs.
|
||||
- Any unexpected write indication, unsafe success/empty-balance interpretation, or error inconsistent with fail-closed behavior is a rollback trigger.
|
||||
|
||||
## 5. Rollback
|
||||
|
||||
For any stop condition, stop the new daemon through the approved supervisor, restore the actual captured `ROLLBACK_REVISION`, and restart with the unchanged configuration:
|
||||
|
||||
```bash
|
||||
# Stop the new daemon through the approved host supervisor.
|
||||
git checkout --detach "$ROLLBACK_REVISION"
|
||||
# Restart with the same approved configuration through the supervisor.
|
||||
```
|
||||
|
||||
Do not run DB rollback, direct DB changes, or `sync --live` as a diagnostic shortcut.
|
||||
|
||||
## 6. Evidence template
|
||||
|
||||
```text
|
||||
Release: REL-012
|
||||
Approved by / timestamp: [REDACTED AS NEEDED]
|
||||
Window: [REDACTED]
|
||||
Host / instance key: [REDACTED]
|
||||
Pre-deploy revision (ROLLBACK_REVISION): <sha>
|
||||
Target revision: <approved immutable sha>
|
||||
Configuration/credential mode unchanged: yes/no (values not recorded)
|
||||
Checkout clean: pass/fail
|
||||
Dependency/migration path delta: none / stop
|
||||
Daemon stop/start evidence: <redacted supervisor status or PID>
|
||||
Startup acceptance: pass/fail
|
||||
sync --dry-run result: pass/fail + sanitized exit/status summary
|
||||
verify result: pass/fail + sanitized exit/status summary
|
||||
Unexpected write indication: none / details and stop action
|
||||
Rollback performed: no / yes (reason and restored SHA)
|
||||
Operator: [REDACTED]
|
||||
```
|
||||
|
||||
REL-012 can move to `released` only after this record is returned and the lead completes `confirm-release`. `sync --live` remains a separate explicit approval gate.
|
||||
@@ -0,0 +1,50 @@
|
||||
# TREX REL-012 운영팀 배포 요청 근거
|
||||
|
||||
- 대상: 운영팀 (`trex-op`)
|
||||
- 작성일: 2026-07-17
|
||||
- 상태: **긴급 배포 사전 근거 및 실행 요청 준비 — source publication / production approval 대기**
|
||||
|
||||
> 이 문서는 운영팀용 요약이다. 실제 실행은 immutable remote source에 존재하는 REL-012 및 deployment runbook만 따른다. 이 문서는 deployment approval 또는 execution completion이 아니다.
|
||||
|
||||
## 1. 결론
|
||||
|
||||
BAT-058은 independent QC-7 `PASS-WITH-NOTES`를 수용해 batch verification을 완료했고, REL-012 긴급 릴리즈 초안을 준비했다. 코드가 현재 delivery worktree에만 존재하여 **배포 가능한 immutable target SHA는 아직 없다**. 따라서 운영팀은 지금 배포를 시작하지 말고, 아래 source-publication gate가 해소된 뒤에만 preflight를 시작한다.
|
||||
|
||||
## 2. 배포 전 근거와 원본
|
||||
|
||||
| 순서 | Release | 배포 대상 source/artifact | 비운영 근거 | 실행 전 남은 gate | immutable 원본 링크 |
|
||||
| --- | --- | --- | --- | --- | --- |
|
||||
| 1 | REL-012 / BAT-058 | `PENDING_COMMIT_AND_PUSH` | QC-7: focused `113 passed`, full `833 passed, 47 skipped`; release-prep full regression `833 passed, 47 skipped`; focused Ruff/compileall PASS | immutable SHA publish·remote tree 확인·release execution approval·window·host preflight | **PENDING** — git-ops 검증 후 commit-URL만 삽입 |
|
||||
|
||||
원본 문서(현재 release candidate worktree):
|
||||
|
||||
- REL draft: [`REL-012`](../releases/rel-012_20260717_cost-basis-safe-sync-seed-hotfix.md)
|
||||
- 운영 runbook: [`REL-012 deployment runbook`](rel-012-cost-basis-safe-sync-seed-deployment.md)
|
||||
- batch verification: [`BAT-058 verification`](../batches/bat-058_20260716_cost-basis-safe-sync-seed/verification.md)
|
||||
|
||||
## 3. 승인 후 실행 순서
|
||||
|
||||
1. **Git-ops / lead** — reviewed source와 REL/runbook을 commit·push하고 exact remote SHA 및 immutable commit URLs를 검증·전달한다.
|
||||
2. **운영팀** — 승인된 장외 window에 `ROLLBACK_REVISION`, clean checkout, unchanged config/credential mode, dependency/migration delta를 preflight에 기록한다.
|
||||
3. **운영팀** — approved supervisor로 동일 config의 trex-core daemon을 target SHA로 재기동한다.
|
||||
4. **운영팀** — startup acceptance 후 `sync --all --dry-run --json` 및 `verify --json`만 수행하고 runbook evidence template을 반환한다.
|
||||
5. **팀장** — evidence를 검토해 `confirm-release` 여부를 판정한다.
|
||||
|
||||
어느 단계에서든 stop condition이면 즉시 rollout을 멈추고 captured `ROLLBACK_REVISION`으로 되돌린다. `sync --live`는 이 배포 요청의 범위가 아니다.
|
||||
|
||||
## 4. 핵심 주의사항 / 중단 조건
|
||||
|
||||
- 허용 범위: daemon restart, startup/log inspection, `sync --dry-run`, `verify`.
|
||||
- 금지 범위: `sync --live`, `--yes` live write, 자동 remediation, 주문 명령, DB/스키마 변경, config/credential/break-glass 변경, AMQP topology 변경.
|
||||
- target SHA가 정확하지 않거나 dirty checkout, dependency/migration delta, startup error/traceback, unexpected write indication, fail-closed 위반, unsafe empty-balance 해석이 있으면 **중단 및 rollback**.
|
||||
- token, secret, account number, DSN, raw broker/portfolio payload를 전달서 또는 증적에 기록하지 않는다.
|
||||
|
||||
## 5. 운영팀 반환 증적
|
||||
|
||||
runbook의 evidence template을 작성해 아래만 전달한다.
|
||||
|
||||
- approver/window/operator 및 redacted host/instance identifier
|
||||
- target SHA와 `ROLLBACK_REVISION`
|
||||
- clean-checkout·dependency/migration preflight 결과
|
||||
- daemon restart/startup·dry-run·verify의 secret-free 결과
|
||||
- no-write/fail-closed 관찰 결과, rollback 여부와 사유/복구 SHA
|
||||
Reference in New Issue
Block a user