le-app/docs/le-app-database-migration/phase2b-contained-runtime/INSTALL-ORDER.md

Exact staged installation and acceptance order

Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.

1. From this directory, run only tests/00-root-preinstall-validate.sh as root and require zero failures. It atomically checks both manifests, staged nftables/systemd/shell/JSON, exact Phase 1 ownership/modes, absent approval marker/installed payload/manager/process/socket/linger, and public/NAT address drift. Save output outside production.
2. Preserve the approved Quad9 DNS pair 9.9.9.9 and 149.112.112.112, observed public/NAT address denial 74.67.173.56, and verified root inventory. Quad9 requires no LAN exception; 192.168.10.1 remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
3. Copy only the manifest-listed launcher to /usr/local/libexec, mode 0755, root:root; rehash the installed file.
4. Copy only the slice and user@1200.service drop-ins, resolver file, namespace helper/unit, and nftables fragment to their manifest paths with root:root, directories/files 0755/0644, helper 0755. After exact-value approval, create root-owned mode 0644 /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED containing the artifact-manifest checksum and approval timestamp. Do not start anything. Run systemd-analyze verify and nft --check -f; inspect the merged systemctl cat/properties.
5. Copy the Docker user unit/config/context and tests below /srv/le-app-codex; set directories 0750, config/unit/tests 0640 except tests 0750, all owned 1200:1200. Do not create credentials, checkout, or source copies.
6. Run systemctl daemon-reload. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
7. Start only le-app-codex-netns.service. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
8. Run tests/run-inert-without-user-manager.sh. This starts only a finite transient test process, never user@1200.service, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start user@1200.service, enable docker.service within its controlled lifetime, or run tests/20-rootless-docker.sh as UID 1200.
10. The later positive/negative Docker test uses only unix:///run/user/1200/docker.sock, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.