REL-012 cost-basis safe sync seed hotfix — deployment runbook

Release: REL-012
Target source: 81a853a314391da7a8bc9df5517013c7fd296d61 (must be verified on origin before execution)
Execution owner: 운영팀
Approval required: team lead review + user production execution approval
Safety classification: daemon restart; no DB migration; read/dry-run smoke only

Do not record credentials, tokens, account numbers, DSNs, .env content, raw broker/portfolio responses, or command lines containing secrets. Use [REDACTED].

1. Hard boundaries

Allowed only after every REL-012 approval gate is checked:

Check out the approved immutable source and restart the existing trex-core daemon through the host’s approved supervisor.
Inspect startup status/logs and execute sync --all --dry-run --json plus verify --json using the unchanged approved instance configuration.

Not allowed:

sync --live, --yes with a live write, automatic remediation, enter, exit, cancel, target portfolio selection, or any DB write.
Changes to credential/break-glass mode, instance config, endpoints, secrets, dependency versions, DB schema, AMQP topology, or strategy daemons.

If a prohibited action appears necessary, stop and return to the approver.

2. Preflight

Confirm the exact approved target SHA (81a853a314391da7a8bc9df5517013c7fd296d61), origin publication, approval, and off-market execution window. If the SHA cannot be verified on origin, stop.
Capture only redacted operating-checkout metadata:
```
pwd
git status --short
git rev-parse HEAD
git rev-parse --abbrev-ref HEAD
```
Record the current SHA as ROLLBACK_REVISION. A dirty checkout is a stop condition.
Identify the active instance configuration and existing supervisor method without exposing configuration values. Confirm credential/break-glass state will remain unchanged.
From a clean source checkout, verify the candidate and migration/dependency delta:
```
git fetch origin
git show -s --format='%H %s' <APPROVED_TARGET_SHA>
git diff --name-only "$ROLLBACK_REVISION" <APPROVED_TARGET_SHA> -- pyproject.toml trex_core/adapters/persistence/migrations
```
Any output on a dependency/migration path or any uncertainty about the target SHA is a stop condition requiring lead review.

3. Source deployment and restart

Use the approved host supervisor; do not infer a service-manager command from this document.

git fetch origin
git checkout --detach <APPROVED_TARGET_SHA>
# Stop the existing daemon through the approved host supervisor.
# Start exactly one daemon with the unchanged approved instance configuration.
.venv/bin/trex-core-daemon --config <approved-instance-config>

Record redacted proof of target SHA, old-process stop, new-process supervisor/PID status, selected instance key, and startup log interval.

4. Startup acceptance and read-only smoke

Before CLI smoke, confirm startup completed, RabbitMQ topology declaration completed, expected workers are running, and the post-restart window has no ERROR, CRITICAL, or traceback.

Run only:

.venv/bin/trex-core sync --all --dry-run --config <approved-instance-config> --json
.venv/bin/trex-core verify --config <approved-instance-config> --json

Acceptance:

Output is sanitized; no credential/account/raw payload is collected.
For available WAC, dry-run may show seeded_avg_price=true with the preview only; no slot/warning write occurs.
For unavailable WAC on a positive-broker inactive slot, dry-run must show seeded_avg_price=false, sanitized reason, and no-write preview.
No invocation adds --live or --yes; no remediation occurs.
Any unexpected write indication, unsafe success/empty-balance interpretation, or error inconsistent with fail-closed behavior is a rollback trigger.

5. Rollback

For any stop condition, stop the new daemon through the approved supervisor, restore the actual captured ROLLBACK_REVISION, and restart with the unchanged configuration:

# Stop the new daemon through the approved host supervisor.
git checkout --detach "$ROLLBACK_REVISION"
# Restart with the same approved configuration through the supervisor.

Do not run DB rollback, direct DB changes, or sync --live as a diagnostic shortcut.

6. Evidence template

Release: REL-012
Approved by / timestamp: [REDACTED AS NEEDED]
Window: [REDACTED]
Host / instance key: [REDACTED]
Pre-deploy revision (ROLLBACK_REVISION): <sha>
Target revision: <approved immutable sha>
Configuration/credential mode unchanged: yes/no (values not recorded)
Checkout clean: pass/fail
Dependency/migration path delta: none / stop
Daemon stop/start evidence: <redacted supervisor status or PID>
Startup acceptance: pass/fail
sync --dry-run result: pass/fail + sanitized exit/status summary
verify result: pass/fail + sanitized exit/status summary
Unexpected write indication: none / details and stop action
Rollback performed: no / yes (reason and restored SHA)
Operator: [REDACTED]

REL-012 can move to released only after this record is returned and the lead completes confirm-release. sync --live remains a separate explicit approval gate.

5.2 KiB Raw Blame History Unescape Escape