# REL-012 cost-basis safe sync seed hotfix — deployment runbook

- Release: `REL-012`
- Target source: [`81a853a314391da7a8bc9df5517013c7fd296d61`](https://github.com/fourblocks2020/trex-core/commit/81a853a314391da7a8bc9df5517013c7fd296d61) (must be verified on origin before execution)
- Execution owner: 운영팀
- Approval required: team lead review + user production execution approval
- Safety classification: daemon restart; no DB migration; read/dry-run smoke only

> Do not record credentials, tokens, account numbers, DSNs, `.env` content, raw broker/portfolio responses, or command lines containing secrets. Use `[REDACTED]`.

## 1. Hard boundaries

Allowed only after every REL-012 approval gate is checked:

- Check out the approved immutable source and restart the existing trex-core daemon through the host’s approved supervisor.
- Inspect startup status/logs and execute `sync --all --dry-run --json` plus `verify --json` using the unchanged approved instance configuration.

Not allowed:

- `sync --live`, `--yes` with a live write, automatic remediation, `enter`, `exit`, `cancel`, target portfolio selection, or any DB write.
- Changes to credential/break-glass mode, instance config, endpoints, secrets, dependency versions, DB schema, AMQP topology, or strategy daemons.

If a prohibited action appears necessary, stop and return to the approver.

## 2. Preflight

1. Confirm the exact approved target SHA (`81a853a314391da7a8bc9df5517013c7fd296d61`), origin publication, approval, and off-market execution window. If the SHA cannot be verified on origin, **stop**.
2. Capture only redacted operating-checkout metadata:

   ```bash
   pwd
   git status --short
   git rev-parse HEAD
   git rev-parse --abbrev-ref HEAD
   ```

   Record the current SHA as `ROLLBACK_REVISION`. A dirty checkout is a stop condition.
3. Identify the active instance configuration and existing supervisor method without exposing configuration values. Confirm credential/break-glass state will remain unchanged.
4. From a clean source checkout, verify the candidate and migration/dependency delta:

   ```bash
   git fetch origin
   git show -s --format='%H %s' <APPROVED_TARGET_SHA>
   git diff --name-only "$ROLLBACK_REVISION" <APPROVED_TARGET_SHA> -- pyproject.toml trex_core/adapters/persistence/migrations
   ```

   Any output on a dependency/migration path or any uncertainty about the target SHA is a stop condition requiring lead review.

## 3. Source deployment and restart

Use the approved host supervisor; do not infer a service-manager command from this document.

```bash
git fetch origin
git checkout --detach <APPROVED_TARGET_SHA>
# Stop the existing daemon through the approved host supervisor.
# Start exactly one daemon with the unchanged approved instance configuration.
.venv/bin/trex-core-daemon --config <approved-instance-config>
```

Record redacted proof of target SHA, old-process stop, new-process supervisor/PID status, selected instance key, and startup log interval.

## 4. Startup acceptance and read-only smoke

Before CLI smoke, confirm startup completed, RabbitMQ topology declaration completed, expected workers are running, and the post-restart window has no `ERROR`, `CRITICAL`, or traceback.

Run only:

```bash
.venv/bin/trex-core sync --all --dry-run --config <approved-instance-config> --json
.venv/bin/trex-core verify --config <approved-instance-config> --json
```

Acceptance:

- Output is sanitized; no credential/account/raw payload is collected.
- For available WAC, dry-run may show `seeded_avg_price=true` with the preview only; no slot/warning write occurs.
- For unavailable WAC on a positive-broker inactive slot, dry-run must show `seeded_avg_price=false`, sanitized reason, and no-write preview.
- No invocation adds `--live` or `--yes`; no remediation occurs.
- Any unexpected write indication, unsafe success/empty-balance interpretation, or error inconsistent with fail-closed behavior is a rollback trigger.

## 5. Rollback

For any stop condition, stop the new daemon through the approved supervisor, restore the actual captured `ROLLBACK_REVISION`, and restart with the unchanged configuration:

```bash
# Stop the new daemon through the approved host supervisor.
git checkout --detach "$ROLLBACK_REVISION"
# Restart with the same approved configuration through the supervisor.
```

Do not run DB rollback, direct DB changes, or `sync --live` as a diagnostic shortcut.

## 6. Evidence template

```text
Release: REL-012
Approved by / timestamp: [REDACTED AS NEEDED]
Window: [REDACTED]
Host / instance key: [REDACTED]
Pre-deploy revision (ROLLBACK_REVISION): <sha>
Target revision: <approved immutable daemon payload SHA>
Release manifest revision: <immutable commit URL of the REL-012/runbook revision used>
Configuration/credential mode unchanged: yes/no (values not recorded)
Checkout clean: pass/fail
Dependency/migration path delta: none / stop
Daemon stop/start evidence: <redacted supervisor status or PID>
Startup acceptance: pass/fail
sync --dry-run result: pass/fail + sanitized exit/status summary
verify result: pass/fail + sanitized exit/status summary
Unexpected write indication: none / details and stop action
Rollback performed: no / yes (reason and restored SHA)
Operator: [REDACTED]
```

REL-012 can move to `released` only after this record is returned and the lead completes `confirm-release`. `sync --live` remains a separate explicit approval gate.