116 lines
5.2 KiB
Markdown
116 lines
5.2 KiB
Markdown
# REL-012 cost-basis safe sync seed hotfix — deployment runbook
|
||
|
||
- Release: `REL-012`
|
||
- Target source: [`81a853a314391da7a8bc9df5517013c7fd296d61`](https://github.com/fourblocks2020/trex-core/commit/81a853a314391da7a8bc9df5517013c7fd296d61) (must be verified on origin before execution)
|
||
- Execution owner: 운영팀
|
||
- Approval required: team lead review + user production execution approval
|
||
- Safety classification: daemon restart; no DB migration; read/dry-run smoke only
|
||
|
||
> Do not record credentials, tokens, account numbers, DSNs, `.env` content, raw broker/portfolio responses, or command lines containing secrets. Use `[REDACTED]`.
|
||
|
||
## 1. Hard boundaries
|
||
|
||
Allowed only after every REL-012 approval gate is checked:
|
||
|
||
- Check out the approved immutable source and restart the existing trex-core daemon through the host’s approved supervisor.
|
||
- Inspect startup status/logs and execute `sync --all --dry-run --json` plus `verify --json` using the unchanged approved instance configuration.
|
||
|
||
Not allowed:
|
||
|
||
- `sync --live`, `--yes` with a live write, automatic remediation, `enter`, `exit`, `cancel`, target portfolio selection, or any DB write.
|
||
- Changes to credential/break-glass mode, instance config, endpoints, secrets, dependency versions, DB schema, AMQP topology, or strategy daemons.
|
||
|
||
If a prohibited action appears necessary, stop and return to the approver.
|
||
|
||
## 2. Preflight
|
||
|
||
1. Confirm the exact approved target SHA (`81a853a314391da7a8bc9df5517013c7fd296d61`), origin publication, approval, and off-market execution window. If the SHA cannot be verified on origin, **stop**.
|
||
2. Capture only redacted operating-checkout metadata:
|
||
|
||
```bash
|
||
pwd
|
||
git status --short
|
||
git rev-parse HEAD
|
||
git rev-parse --abbrev-ref HEAD
|
||
```
|
||
|
||
Record the current SHA as `ROLLBACK_REVISION`. A dirty checkout is a stop condition.
|
||
3. Identify the active instance configuration and existing supervisor method without exposing configuration values. Confirm credential/break-glass state will remain unchanged.
|
||
4. From a clean source checkout, verify the candidate and migration/dependency delta:
|
||
|
||
```bash
|
||
git fetch origin
|
||
git show -s --format='%H %s' <APPROVED_TARGET_SHA>
|
||
git diff --name-only "$ROLLBACK_REVISION" <APPROVED_TARGET_SHA> -- pyproject.toml trex_core/adapters/persistence/migrations
|
||
```
|
||
|
||
Any output on a dependency/migration path or any uncertainty about the target SHA is a stop condition requiring lead review.
|
||
|
||
## 3. Source deployment and restart
|
||
|
||
Use the approved host supervisor; do not infer a service-manager command from this document.
|
||
|
||
```bash
|
||
git fetch origin
|
||
git checkout --detach <APPROVED_TARGET_SHA>
|
||
# Stop the existing daemon through the approved host supervisor.
|
||
# Start exactly one daemon with the unchanged approved instance configuration.
|
||
.venv/bin/trex-core-daemon --config <approved-instance-config>
|
||
```
|
||
|
||
Record redacted proof of target SHA, old-process stop, new-process supervisor/PID status, selected instance key, and startup log interval.
|
||
|
||
## 4. Startup acceptance and read-only smoke
|
||
|
||
Before CLI smoke, confirm startup completed, RabbitMQ topology declaration completed, expected workers are running, and the post-restart window has no `ERROR`, `CRITICAL`, or traceback.
|
||
|
||
Run only:
|
||
|
||
```bash
|
||
.venv/bin/trex-core sync --all --dry-run --config <approved-instance-config> --json
|
||
.venv/bin/trex-core verify --config <approved-instance-config> --json
|
||
```
|
||
|
||
Acceptance:
|
||
|
||
- Output is sanitized; no credential/account/raw payload is collected.
|
||
- For available WAC, dry-run may show `seeded_avg_price=true` with the preview only; no slot/warning write occurs.
|
||
- For unavailable WAC on a positive-broker inactive slot, dry-run must show `seeded_avg_price=false`, sanitized reason, and no-write preview.
|
||
- No invocation adds `--live` or `--yes`; no remediation occurs.
|
||
- Any unexpected write indication, unsafe success/empty-balance interpretation, or error inconsistent with fail-closed behavior is a rollback trigger.
|
||
|
||
## 5. Rollback
|
||
|
||
For any stop condition, stop the new daemon through the approved supervisor, restore the actual captured `ROLLBACK_REVISION`, and restart with the unchanged configuration:
|
||
|
||
```bash
|
||
# Stop the new daemon through the approved host supervisor.
|
||
git checkout --detach "$ROLLBACK_REVISION"
|
||
# Restart with the same approved configuration through the supervisor.
|
||
```
|
||
|
||
Do not run DB rollback, direct DB changes, or `sync --live` as a diagnostic shortcut.
|
||
|
||
## 6. Evidence template
|
||
|
||
```text
|
||
Release: REL-012
|
||
Approved by / timestamp: [REDACTED AS NEEDED]
|
||
Window: [REDACTED]
|
||
Host / instance key: [REDACTED]
|
||
Pre-deploy revision (ROLLBACK_REVISION): <sha>
|
||
Target revision: <approved immutable sha>
|
||
Configuration/credential mode unchanged: yes/no (values not recorded)
|
||
Checkout clean: pass/fail
|
||
Dependency/migration path delta: none / stop
|
||
Daemon stop/start evidence: <redacted supervisor status or PID>
|
||
Startup acceptance: pass/fail
|
||
sync --dry-run result: pass/fail + sanitized exit/status summary
|
||
verify result: pass/fail + sanitized exit/status summary
|
||
Unexpected write indication: none / details and stop action
|
||
Rollback performed: no / yes (reason and restored SHA)
|
||
Operator: [REDACTED]
|
||
```
|
||
|
||
REL-012 can move to `released` only after this record is returned and the lead completes `confirm-release`. `sync --live` remains a separate explicit approval gate.
|