58 lines
3.8 KiB
Markdown
58 lines
3.8 KiB
Markdown
# VEP P1 — Build Log
|
|
### What was stood up, verified, and the one outstanding step.
|
|
### Date: 2026-08-07. Status: P1 minimal spine LIVE (internal), edge gated on DNS.
|
|
|
|
=====================================================================
|
|
STOOD UP
|
|
=====================================================================
|
|
- Git repo at /root/vep (branch main), .gitignore, pytest.ini, requirements.txt.
|
|
- Postgres 16 + pgvector (pgvector/pgvector:0.7.0-pg16) container, internal only,
|
|
with healthcheck. Append-only event_log, dead_letter, actor, tenant tables.
|
|
Row-level security (RLS) enabled; app connects as least-privilege 'vep_app' so
|
|
RLS actually applies (superuser bypasses RLS — this was the key fix).
|
|
- FastAPI app (python:3.12-slim) container on vep_net; /health, /events (GET list,
|
|
POST ingest with validation -> dead-letter on failure). Provenance fields
|
|
(actor_id, raw_ref, confidence DOUBLE PRECISION, create_capture) enforced.
|
|
- Forgejo (codeberg.org/forgejo/forgejo:10.0.3) container, sqlite, on vep_net;
|
|
published 127.0.0.1:3000 + host 2222->22.
|
|
- Caddy (host) routes added: git.* -> 3000, api.* -> 8000, preserving erp.* + agent.*.
|
|
- spine_check.py CI gate + .forgejo/workflows/ci.yml (runs boundary tests + spine-check).
|
|
|
|
=====================================================================
|
|
VERIFIED (real execution, not claims)
|
|
=====================================================================
|
|
- Boundary tests: 4/4 PASS (tenant isolation via RLS, no-unvalidated-row dead-letter,
|
|
provenance required, append-only privilege layer). Run in-net against postgres:5432.
|
|
- spine-check: FAILS a code change with no JL justification (exit 1); PASS on clean tree.
|
|
- Running stack end-to-end (internal + via Caddy with tls internal):
|
|
/health -> {"status":"ok","product":"VEP","phase":"P1"}
|
|
POST /events (valid) -> {"id":N,"status":"recorded"} w/ provenance
|
|
POST /events (no actor_id) -> 422 + dead-letter (no silent loss)
|
|
/events -> lists recorded events with full provenance
|
|
git.mangoopsdesign.com -> 200 (Caddy -> forgejo)
|
|
- ERPNext on 8080 left UNTOUCHED (it is a live service, not a stray container).
|
|
|
|
=====================================================================
|
|
OUTSTANDING (requires USER action — external)
|
|
=====================================================================
|
|
- DNS: add A records for api.mangoopsdesign.com and git.mangoopsdesign.com -> 177.7.40.244.
|
|
DONE 2026-08-07. Caddy auto-issued Let's Encrypt certs; edge verified live over real TLS
|
|
(api./health -> ok; git./ -> 200 Forgejo; POST /events over public TLS -> recorded).
|
|
Note: the box's own local resolver cached the old NXDOMAIN briefly; external clients
|
|
(public DNS) reach the edge correctly. No action needed.
|
|
- Secrets: .env uses dev passwords. Before any real tenant, set strong PG/vep_app secrets
|
|
and consider moving Forgejo to postgres at P6.
|
|
- P0 falsification (gst_p0_falsification.md) still not run — per the spine, P0 should have
|
|
preceded this. Build proceeded in parallel (user directed "proceed"); if P0 kills an
|
|
assumption, the build gets pruned, not wasted (it is small + reversible).
|
|
|
|
=====================================================================
|
|
HOW TO RE-RUN / TEARDOWN
|
|
=====================================================================
|
|
- Up: cd /root/vep && docker compose up -d
|
|
- Test: docker run --rm --network vep_vep_net -v /root/vep:/app -w /app \
|
|
-e DATABASE_URL=postgresql://vep_app:vep_app@postgres:5432/vep \
|
|
-e DATABASE_ADMIN_URL=postgresql://vep:vep_dev_pass@postgres:5432/vep \
|
|
python:3.12-slim bash -c "pip install -q -r requirements.txt >/dev/null 2>&1; python -m pytest -q"
|
|
- Down (keeps data): docker compose down
|
|
- Down (wipe): docker compose down -v (DESTRUCTIVE — not run; blocked earlier)
|