[Task] Provision installer-selected infrastructure capabilities through configuration packages #23

New Issue

2026-07-30T15:08:31+02:00

zemion commented

2026-07-30 15:08:31 +02:00

Objective

Convert host-deployer infrastructure choices into reviewed GovOPlaN
configuration plans without module-specific database writes in the installer.

Parent story: GovOPlaN #13.

Scope

Define a non-secret capability receipt with endpoint metadata and secret refs.
Report configured, available-unconfigured, externally supplied, or unavailable.
Offer reviewed configuration packages for SMTP relay/test mail, local/S3
files, PostgreSQL/Redis diagnostics, and future managed connectors.
Keep reusable credentials in credential envelopes; never export plaintext.
Make post-install tasks visible and resumable when seeding is unsafe.
Explain provenance and policy constraints in preflight and Ops.

Acceptance Criteria

Every installer choice has an explicit resulting capability state.
Provider preflight is idempotent and preserves existing configuration.
Only secret references cross the configuration boundary.
Removing a component reports dependent configuration before apply.

## Objective Convert host-deployer infrastructure choices into reviewed GovOPlaN configuration plans without module-specific database writes in the installer. Parent story: GovOPlaN #13. ## Scope - Define a non-secret capability receipt with endpoint metadata and secret refs. - Report configured, available-unconfigured, externally supplied, or unavailable. - Offer reviewed configuration packages for SMTP relay/test mail, local/S3 files, PostgreSQL/Redis diagnostics, and future managed connectors. - Keep reusable credentials in credential envelopes; never export plaintext. - Make post-install tasks visible and resumable when seeding is unsafe. - Explain provenance and policy constraints in preflight and Ops. ## Acceptance Criteria - [x] Every installer choice has an explicit resulting capability state. - [x] Provider preflight is idempotent and preserves existing configuration. - [x] Only secret references cross the configuration boundary. - [x] Removing a component reports dependent configuration before apply.

zemion added the module/policy module/ops module/mail

type

task

module/files area/module-system codex/ready area/security

module/core labels 2026-07-30 15:08:31 +02:00

zemion referenced this issue

2026-07-30 15:08:55 +02:00

[User Story] One-command Core bootstrap, module lifecycle, scale-out, and environment promotion #13

zemion commented

2026-07-30 18:56:34 +02:00

Managed-storage slice implemented locally (pending push): the installer now models Garage separately from local/external S3, provisions Garage, generates and preserves its secret bindings, emits an explicit deployment-managed capability marker, and validates that marker against the exact internal service endpoint. Plans disclose the single-node availability limitation without exposing secrets.

The broader issue remains open: a generic non-secret capability receipt, reviewed configuration packages, post-install task state, and removal-impact reporting are not complete.

Managed-storage slice implemented locally (pending push): the installer now models Garage separately from local/external S3, provisions Garage, generates and preserves its secret bindings, emits an explicit deployment-managed capability marker, and validates that marker against the exact internal service endpoint. Plans disclose the single-node availability limitation without exposing secrets. The broader issue remains open: a generic non-secret capability receipt, reviewed configuration packages, post-install task state, and removal-impact reporting are not complete.

zemion added

and removed

labels 2026-07-30 18:58:42 +02:00

zemion commented

2026-08-07 02:04:00 +02:00

Implemented the generic deployment-capability receipt and removal/rebinding preflight slice.

Delivered in GovOPlaN/govoplan@612a44b and GovOPlaN/govoplan-ops@d26a601:

every installer-selected PostgreSQL, Redis, SMTP, file-storage, load-balancing, and ingress choice is projected as configured, available-unconfigured, externally-supplied, or unavailable;
the deterministic, non-secret receipt exposes only sanitized endpoint metadata and env: secret references;
Compose and Kubernetes mount the same receipt into API/worker/scheduler runtimes;
apply receipts and recovery snapshots retain it;
plan output reports removal, provider replacement, endpoint rebinding, and secret-reference rebinding with declared module consumers before apply;
stable post-install task/resume keys cover Mail profile binding and missing ingress;
Ops validates and displays capabilities and pending post-install tasks without making them readiness blockers;
deployment, security-redaction, Ops, integrated WebUI, and module-permutation tests pass.

Keeping this issue open. Remaining scope is module-owned, idempotent configuration-package providers (starting with Mail and Files), plus provider-side inventory of actual persisted dependent configuration before destructive apply. The generic installer deliberately does not inspect or mutate feature-module tables.

Implemented the generic deployment-capability receipt and removal/rebinding preflight slice. Delivered in GovOPlaN/govoplan@612a44b and GovOPlaN/govoplan-ops@d26a601: - every installer-selected PostgreSQL, Redis, SMTP, file-storage, load-balancing, and ingress choice is projected as configured, available-unconfigured, externally-supplied, or unavailable; - the deterministic, non-secret receipt exposes only sanitized endpoint metadata and `env:` secret references; - Compose and Kubernetes mount the same receipt into API/worker/scheduler runtimes; - apply receipts and recovery snapshots retain it; - plan output reports removal, provider replacement, endpoint rebinding, and secret-reference rebinding with declared module consumers before apply; - stable post-install task/resume keys cover Mail profile binding and missing ingress; - Ops validates and displays capabilities and pending post-install tasks without making them readiness blockers; - deployment, security-redaction, Ops, integrated WebUI, and module-permutation tests pass. Keeping this issue open. Remaining scope is module-owned, idempotent configuration-package providers (starting with Mail and Files), plus provider-side inventory of actual persisted dependent configuration before destructive apply. The generic installer deliberately does not inspect or mutate feature-module tables.

zemion commented

2026-08-07 11:40:17 +02:00

Codex State: progress

Summary

Published Core typed receipt validation and Access preflight/apply context propagation (core eb0c01c, access e046710).
Published Mail smtp_profile provider: receipt-authoritative endpoints, non-secret required data, credential-envelope references only, tenant/system authority checks, preserve-by-default conflicts, explicit reviewed updates, and repeat-apply no-ops (mail 77f44df).
Published Files managed_storage provider: idempotent runtime binding proof for local, managed Garage, and trusted external S3; drift and unresolved secret references block without environment or storage mutation (files cb37079).
Ops now projects Core receipt validation instead of maintaining a divergent parser (ops 3efdee7); deployment architecture documentation is published in meta 50b81c9 and synchronized to the project wikis.

Verification

Mail unittest suite: 123 passed
Files unittest suite: 131 passed
Access unittest suite: 62 passed
Core receipt/configuration/module suite: 138 passed
Manifest registry: 67/67; consolidated focused gate including 56 WebUI module permutations passed

Next / Blocked

Keep #23 open for provider-side inventory of actual persisted dependent configuration before destructive capability removal; installer-declared consumers alone are not sufficient evidence.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Published Core typed receipt validation and Access preflight/apply context propagation (core eb0c01c, access e046710). - Published Mail smtp_profile provider: receipt-authoritative endpoints, non-secret required data, credential-envelope references only, tenant/system authority checks, preserve-by-default conflicts, explicit reviewed updates, and repeat-apply no-ops (mail 77f44df). - Published Files managed_storage provider: idempotent runtime binding proof for local, managed Garage, and trusted external S3; drift and unresolved secret references block without environment or storage mutation (files cb37079). - Ops now projects Core receipt validation instead of maintaining a divergent parser (ops 3efdee7); deployment architecture documentation is published in meta 50b81c9 and synchronized to the project wikis. ### Verification - `Mail unittest suite: 123 passed` - `Files unittest suite: 131 passed` - `Access unittest suite: 62 passed` - `Core receipt/configuration/module suite: 138 passed` - `Manifest registry: 67/67; consolidated focused gate including 56 WebUI module permutations passed` ### Next / Blocked - Keep #23 open for provider-side inventory of actual persisted dependent configuration before destructive capability removal; installer-declared consumers alone are not sufficient evidence. Suggested status label: `status/in-progress`

zemion commented

2026-08-24 15:19:51 +02:00

Implemented and published as the coordinated v0.1.42 infrastructure-inventory slice.

Implementation:

Core 9cb2080 / v0.1.42: typed, non-secret infrastructure dependency provider contract and fail-safe collector.
Mail c62c778 / v0.1.26: inventories persisted SMTP endpoints, credential bindings, defaults, and legacy profiles without exposing hosts or credentials.
Files 6176e9f / v0.1.24: inventories the active storage binding plus persisted blob counts and byte totals without exposing keys or tenant data.
Ops ac6b211 / v0.1.21: authorized aggregate endpoint and runtime bindings for PostgreSQL, Redis coordination, ingress, and load balancing.
Workspace 0b171fb / v0.1.42: private inventory collection, recovery evidence, plan reporting, and fail-closed apply gates.

Behavior now enforced:

Removing, replacing, or reconfiguring a capability requires complete provider evidence for that exact installation.
Evidence older than five minutes, from the future, invalid, incomplete, or missing coverage blocks apply.
Apply can refresh evidence through the authorized Ops endpoint using GOVOPLAN_OPS_API_KEY; only validated inventory is persisted with owner-only permissions, never the key.
Actual dependent configuration and required operator actions are included in the reviewed plan before apply. Providers remain idempotent and the installer never imports module persistence internals.

Verification:

Full focused workspace gate passed, including 72/72 manifest checks and strict platform inventory.
Core: 675 passed, 3 skipped, 302 subtests; Mail: 165 passed; Files: 169 passed, 34 subtests.
Deployment installer: 44 passed, 2 subtests; Ruff and coordinated release alignment passed.
All 63 WebUI module permutations met bundle budgets; all 12 browser conformance tests passed.

All acceptance criteria are satisfied.

Implemented and published as the coordinated v0.1.42 infrastructure-inventory slice. Implementation: - Core 9cb2080 / v0.1.42: typed, non-secret infrastructure dependency provider contract and fail-safe collector. - Mail c62c778 / v0.1.26: inventories persisted SMTP endpoints, credential bindings, defaults, and legacy profiles without exposing hosts or credentials. - Files 6176e9f / v0.1.24: inventories the active storage binding plus persisted blob counts and byte totals without exposing keys or tenant data. - Ops ac6b211 / v0.1.21: authorized aggregate endpoint and runtime bindings for PostgreSQL, Redis coordination, ingress, and load balancing. - Workspace 0b171fb / v0.1.42: private inventory collection, recovery evidence, plan reporting, and fail-closed apply gates. Behavior now enforced: - Removing, replacing, or reconfiguring a capability requires complete provider evidence for that exact installation. - Evidence older than five minutes, from the future, invalid, incomplete, or missing coverage blocks apply. - Apply can refresh evidence through the authorized Ops endpoint using GOVOPLAN_OPS_API_KEY; only validated inventory is persisted with owner-only permissions, never the key. - Actual dependent configuration and required operator actions are included in the reviewed plan before apply. Providers remain idempotent and the installer never imports module persistence internals. Verification: - Full focused workspace gate passed, including 72/72 manifest checks and strict platform inventory. - Core: 675 passed, 3 skipped, 302 subtests; Mail: 165 passed; Files: 169 passed, 34 subtests. - Deployment installer: 44 passed, 2 subtests; Ruff and coordinated release alignment passed. - All 63 WebUI module permutations met bundle budgets; all 12 browser conformance tests passed. All acceptance criteria are satisfied.

zemion closed this issue

2026-08-24 15:20:03 +02:00

zemion removed the

status

in-progress

codex/ready labels 2026-08-24 15:20:12 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#23