makearmy/le-app
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
le-app/docs/le-app-database-migration/phase2b-contained-runtime/INSTALL-ORDER.md

3 KiB
Raw Blame History

Exact staged installation and acceptance order

Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.

  1. Review the passing non-mutating tests/32-stage1-state-tests.sh results and the shared state implementation in tests/stage1-state-lib.sh. Then, from this directory, run only tests/30-install-stage1.sh as root and require zero failures. It invokes tests/00-root-preinstall-validate.sh, checks both manifests, requires all 16 destination files absent, validates shared parents, installs only static Stage 1 files, and atomically advances immutable checksummed state generations from IN_PROGRESS to COMPLETE. It does not create the approval marker or perform any reload/start/network action.
  2. Preserve the approved Quad9 DNS pair 9.9.9.9 and 149.112.112.112, observed public/NAT address denial 74.67.173.56, and verified root inventory. Quad9 requires no LAN exception; 192.168.10.1 remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
  3. Resolve /var/lib/le-app-codex-phase2b/stage1/current as a strict local generation name and review that generation's manifest and manifest.sha256; require COMPLETE, source commit, artifact-manifest digest, hostname, timestamp, 16 completed file records, no pending records, and every reached directory disposition to match the installer output.
  4. Do not create /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED during Stage 1. Do not run systemctl daemon-reload, load nftables, create the namespace, or start/enable anything.
  5. Review installed owner/mode/size/hash evidence. Docker user configuration and the five acceptance/preflight scripts must be owned by 1200:1200; tests are 0750, configs/unit 0640. No credentials, checkout, or source copies are installed.
  6. Run systemctl daemon-reload. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
  7. Start only le-app-codex-netns.service. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
  8. Run tests/run-inert-without-user-manager.sh. This starts only a finite transient test process, never user@1200.service, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
  9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start user@1200.service, enable docker.service within its controlled lifetime, or run tests/20-rootless-docker.sh as UID 1200.
  10. The later positive/negative Docker test uses only unix:///run/user/1200/docker.sock, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
  11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.