Document and verify OpenShift configuration, secrets and health probes

Sub-tickets

Activity

• coder03-mba-l-ca created · 11h ago
  parent=#4648
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Produce the ASI-facing environment contract: YAML/manifest path, external DB parameters, variable names without values, Secret/ConfigMap owner, routes, integrations, storage expectations and probe paths/timings. Verify liveness/readiness against the deployment and smoke test DEV/QA. No credential rotation or live-secret edits under this item. Done when ASI operations accepts the contract and checks pass.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Document and verify OpenShift deployment configuration for the actual ASI-approved build/image: S2I builder, port 8080, manifests, external configuration and secrets, health/readiness probes, required service dependencies and ownership. Capture build/config/probe evidence on the approved image and environment; documentation alone is not completion. Resolve exact config/secret path through MOVILBA-826; do not commit credentials.
• coder03-mba-l-ca descriptionChanged · 11h ago
  was: Verify OpenShift deployment of the actual ASI-approved image: S2I builder, port 8080, manifests, external config and secrets, service dependencies and ownership. Probe routes already exist in code; prove their liveness/readiness wiring and behavior in the approved OCP environment. Capture builder/config/probe evidence, not just docs. Resolve current Secret/ConfigMap and credential policy through MOVILBA-826; do not commit values or rotate credentials.
• coder03-mba-l-ca progress · 9h ago
  QA runtime config gap found in source: origenIngresoNuevaFilaApp requires explicit APP_ENV dev/staging/pod/production; no value. Setting must be pinned for QA and verified in an authenticated CRUD smoke test, rather than inferred from NODE_ENV=production. coder04 assessing existing QA manifest/config evidence read-only; no code or secret change authorized.
• coder03-mba-l-ca progress · 9h ago
  QA runtime config gap found in source: origenIngresoNuevaFilaApp requires explicit APP_ENV values dev, staging, pod or production; it does not accept qa. Setting must be pinned for QA and verified in an authenticated CRUD smoke test, not inferred from NODE_ENV=production. coder04 assessing QA manifest/config evidence read-only; no code or secret change authorized.
• coder03-mba-l-ca progress · 9h ago
  coder04 read-only QA APP_ENV census: no committed QA manifest sets APP_ENV. origenIngresoNuevaFilaApp accepts dev->app_dev, staging->app_staging, pod->app_pod, production->app_prod; unset or qa throws on six create paths. Six DB CHECKs admit those four origins only. pod is coded as ASI-DEV identity; production would mislabel QA. staging is technically supported but not selected by any QA record. Package prep can continue, but QA CRUD acceptance requires an explicit approved QA APP_ENV and expected origin plus smoke test; no code/config/DB edit yet.
• coder03-mba-l-ca progress · 9h ago
  db04 recommends distinct app_qa provenance for QA rather than reusing app_staging. Current APP_ENV=qa throws; six provenance CHECKs reject app_qa; app_staging would mislabel QA and trigger 12-hour staging session. QA CORS origin is absent. QA import reconciler protection is unproven, so keep imports barred. coder04 preparing scoped app code/tests; db04 preparing QA-specific baseline-gated DDL design, both no apply/deploy. Existing PROD/DEV need no runtime DB change while APP_ENV values unchanged. Product choice and QA baseline still to confirm before release.
• coder03-mba-l-ca progress · 9h ago
  Independent code/DB assessment favors distinct app_qa. Reusing staging mislabels QA and invokes 12h session TTL. Current helper rejects qa and six CHECK mirrors omit app_qa; QA-specific rehearsed CHECK DDL required after QA baseline. proxy.ts currently treats unknown qa as nonprod and may allow localhost CORS; scoped app candidate must give QA production-like CORS/session behavior without changing existing envs. coder04 preparing code/tests, db04 preparing QA DDL design, neither applying/deploying.
• audit-mba-l-ca audited · 9h ago
  audit pass: audit-mba-l-ca | 2026-10-16 ART.0512bc88 + pins a73a4f99/f10cee62/93e033bc/9677b3b1/989c6094. Source78/78,typecheck,targeted ESLint,diff check;2 red controls. App code only; DB CHECK/app_qa,HTTP/OIDC/session runtime/build unexercised. No deploy.
  payload

  {"scope":"audit-mba-l-ca | 2026-10-16 ART.0512bc88 + pins a73a4f99/f10cee62/93e033bc/9677b3b1/989c6094. Source78/78,typecheck,targeted ESLint,diff check;2 red controls. App code only; DB CHECK/app_qa,HTTP/OIDC/session runtime/build unexercised. No deploy.","outcome":"pass","evidence":"Five full hashes verified before/after. qa->app_qa; known CORS hosts unchanged; localhost restricted to dev/staging/pod; QA/unknown denied. Original0512 provenance with new test fails rc1; prior permissive non-production localhost predicate with new CORS tests fails rc1. Current source49 files/78 tests pass. Typecheck, five-file ESLint and diff check rc0. auth.ts unchanged75fd874e: static inspection retains QA default short session, not live proof. Runtime Node24.22.0 vs declared24.14.1. New helper must ship with proxy. QA database CHECK/role compatibility remains release prerequisite; update UPGRADE claim rejecting qa before final artifact. No BWI completion or QA readiness asserted.","reportRef":null}