15 lines
3 KiB
Markdown
15 lines
3 KiB
Markdown
# Exact staged installation and acceptance order
|
|
|
|
Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.
|
|
|
|
1. Review the passing non-mutating `tests/32-stage1-state-tests.sh` results and the shared state implementation in `tests/stage1-state-lib.sh`. Then, from this directory, run only `tests/30-install-stage1.sh` as root and require zero failures. It invokes `tests/00-root-preinstall-validate.sh`, checks both manifests, requires all 16 destination files absent, validates shared parents, installs only static Stage 1 files, and atomically advances immutable checksummed state generations from `IN_PROGRESS` to `COMPLETE`. It does not create the approval marker or perform any reload/start/network action.
|
|
2. Preserve the approved Quad9 DNS pair `9.9.9.9` and `149.112.112.112`, observed public/NAT address denial `74.67.173.56`, and verified root inventory. Quad9 requires no LAN exception; `192.168.10.1` remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
|
|
3. Resolve `/var/lib/le-app-codex-phase2b/stage1/current` as a strict local generation name and review that generation's `manifest` and `manifest.sha256`; require `COMPLETE`, source commit, artifact-manifest digest, hostname, timestamp, 16 completed file records, no pending records, and every reached directory disposition to match the installer output.
|
|
4. Do not create `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` during Stage 1. Do not run `systemctl daemon-reload`, load nftables, create the namespace, or start/enable anything.
|
|
5. Review installed owner/mode/size/hash evidence. Docker user configuration and the five acceptance/preflight scripts must be owned by `1200:1200`; tests are `0750`, configs/unit `0640`. No credentials, checkout, or source copies are installed.
|
|
6. Run `systemctl daemon-reload`. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
|
|
7. Start only `le-app-codex-netns.service`. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
|
|
8. Run `tests/run-inert-without-user-manager.sh`. This starts only a finite transient test process, never `user@1200.service`, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
|
|
9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start `user@1200.service`, enable `docker.service` within its controlled lifetime, or run `tests/20-rootless-docker.sh` as UID 1200.
|
|
10. The later positive/negative Docker test uses only `unix:///run/user/1200/docker.sock`, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
|
|
11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.
|