Lewati ke isi

RC1 Final Operations Packet for Independent Auditor

This packet does not claim CORE RC1 CERTIFIED.
This packet does not replace RC1-independent-verdict.md.
The independent Golden verdict remains RC1-B. This document records the exact-candidate bind/rollout that followed demo UAT, so the auditor can re-judge RC1F-006 against live served identities.

Item Value
Mode Server · /home/scola/odoo
Date (UTC) 2026-08-14
Operator authorization Bind candidate to dev; promote named production tenants spansa, aljabbar, rejis, sdn1pgt; keep GBN frozen; keep demo on the same exact pair
Isolation --live after rollout PASS
Module upgrade (-u) None (Python-only scola_identity_admin/controllers/user_detail_api.py vs 334db599…)
Filestore backup Skipped (no attachment/schema change)

Exact candidate pair

Do not treat worktree origin/develop tip 50198e3c… as the served frontend. That commit is docs-only after UAT; the application tree is unchanged. Demo was not rebuilt to that tip.

Side Exact identity
FE application commit 1ffc7160a6521f7d97f4d5731ff43223846d0e11
FE application tree eb10f68ee33086e2df0c5b93ddfc668bc4d04233ac7eed23c15a43c7b9faf31a
FE served commit / build fd3aba832bb8535e75c900b6fdcdc0fbe4c5d7c8 · fe-build-fd3aba832bb8-mssrc0va · fd3aba832bb8+mssrc0va
FE immutable production release /var/www/scola-releases/production/fe-build-fd3aba832bb8-mssrc0va (copied from demo CI dist /var/www/staging-scola/dist, then marked read-only)
BE commit 3d7a213d2c97bb660316b65ccbd74dbe5541e46d
BE application tree 69bd9993e08d37224c3a49ff717816320caebfc0c969608cfb4689764020b2e9
BE immutable release /home/scola/odoo/releases/backend/3d7a213d2c97bb660316b65ccbd74dbe5541e46d/ (source_kind: git-archive)

Previous production pair (still serving GBN only): FE 3b7e578040773f5054ba32d63d5fce64a30acc56 · fe-build-3b7e57804077-msqxgidf / BE 334db599f4fa0ef66e9872aa4cfcbf0f378f2381.

Live served identities (after bind + rollout)

Source JSON: docs/release-readiness/audit/RC1-final-auditor-report/served-identities.json (probed 2026-08-14T15:10:34Z).

Runtime Host FE SHA / build BE SHA / source DB name / UUID Status
Dev dev.gcgscola.id fd3aba83… / fe-build-fd3aba832bb8-mssrc0va 3d7a213… · editable custom_addons_scola/gcgscola · SCOLA_RELEASE_ID=dev-worktree scoladev / fad7c305-f131-11f0-9409-bc241149eb4e exact pair bound
Demo demo.gcgscola.id fd3aba83… / fe-build-fd3aba832bb8-mssrc0va 3d7a213… · immutable release scoladev_demo / fad7c305-f131-11f0-9409-bc241149eb4e exact pair unchanged (not rebuilt)
Spansa spansa.gcgscola.id fd3aba83… / immutable FE release 3d7a213… · immutable release scola_spansa / 6c22493a-3867-11f1-a8f8-bc241149eb4e promoted (canary)
Al-Jabbar aljabbar.gcgscola.id fd3aba83… / immutable FE release 3d7a213… · immutable release scola_aljabbar / e1cdaf32-909a-11f1-b83c-28e8d4be73f5 promoted
Rejis rejis.gcgscola.id fd3aba83… / immutable FE release 3d7a213… · immutable release scola_rejis / 14428dd0-909b-11f1-9a18-28e8d4be73f5 promoted
SDN 1 PGT sdn1pgt.gcgscola.id fd3aba83… / immutable FE release 3d7a213… · immutable release scola_sdn1pgt / 445d3f74-909b-11f1-b063-28e8d4be73f5 promoted
GBN goldenbabyntree.gcgscola.id 3b7e5780… / fe-build-3b7e57804077-msqxgidf 334db599… · previous immutable release scola_goldenbabyntree / 77826fd8-7d29-11f1-a59b-28e8d4be73f5 frozen — not changed

GBN FE symlink remains /var/www/vue-app-goldenbabyntree/dist → fe-build-3b7e57804077-msqxgidf.
GBN BE symlink remains environments/production/goldenbabyntree/backend/current → releases/backend/334db599…/gcgscola.
odoo-prod.service was not restarted.

What was executed

  1. Created read-only FE release from demo CI dist, not from the FE worktree.
  2. Bound that FE dist into /var/www/dev-scola/dist (mutable directory, as designed for dev).
  3. Set environments/development/runtime.env BE SHA to 3d7a213…, kept SCOLA_RELEASE_ID=dev-worktree, restarted only odoo-devscola.
  4. Ran authenticated UAT on scoladev with disposable rc1.uat.* principals, then deactivated them. Secrets stayed in /tmp/rc1_dev_uat.env (not committed).
  5. Took pg_dump -Fc --no-owner of the four non-GBN production databases before promotion.
  6. Canary Spansa, then Al-Jabbar, Rejis, SDN 1 PGT, one tenant at a time, stop-on-first-failure:
  7. atomic BE symlink to releases/backend/3d7a213…/gcgscola
  8. runtime.env SHA / SCOLA_RELEASE_ID update
  9. retarget only that tenant's FE symlink to fe-build-fd3aba832bb8-mssrc0va
  10. restart only that tenant unit
  11. verify served FE/BE/DB, smoke routes, GBN still frozen
  12. Reconfirmed demo still serves the exact pair. Demo was not copied, rebuilt, or restarted in this step.
  13. Re-ran python3 /tmp/environment_isolation_check.py --live → PASS.

Forbidden paths were not used: no git pull onto production, no worktree rsync onto production BE, no upgrade-odoo-prod-modules.sh, no wildcard DB, no bulk restart, no odoo-prod restart.

UAT / smoke

Probe Result
Golden independent re-audit (prior packet) RC1-B; RC1F-001–005/007–008 closed; RC1F-006 was the remaining deployment gate
Demo authenticated UAT 8/8 PASS (RC1-demo-uat.md)
Dev authenticated UAT after bind 8/8 PASS (RC1-final-auditor-report/dev-authenticated-uat.json): login admin + 2 teachers; 15 false-Core leaves not visible as Core; teacher reset capability_denied; DEC-014 caller-chosen reject + server temp reveal + chosen login fails
Per-tenant production smoke public version.json match; /api/public/source-identity SHA/tree/path/DB match; smoke-odoo-prod.sh 6/6 registered routes; public / HTTP 200
Production authenticated DEC-014 Not repeated on live school users (no password mutation against real accounts)
Isolation --live PASS after Spansa canary and after all four non-GBN tenants

Backups (restorable)

Directory: /home/scola/odoo/backups/rc1-prepromote-20260814T145701Z/
Manifest: docs/release-readiness/audit/RC1-final-auditor-report/backups.json

Database SHA-256
scola_spansa.dump 72d6122959e1decbebd5660d624517ccd2ac58406b3f45b881f66b9be6c3bbf5
scola_aljabbar.dump ddd3ecd37ab73b0be8e296510f3893fc237670f36bee2855d6e85c61fb47b30f
scola_rejis.dump ae76fd67b39cda53faf1f9dc3669fb95d82083a92da868692d9cb32736a75a79
scola_sdn1pgt.dump e454388e43918ff244b2a041a1dfa54f148e4c3f714d415b4c696b17bfbd91ce

Previous immutable FE fe-build-3b7e57804077-msqxgidf and BE 334db599… releases were not deleted.

Per-tenant rollback (do not use for GBN unless separately authorized)

For one named tenant T with FE link DIST and unit odoo-T:

  1. ln -sfn /home/scola/odoo/releases/backend/334db599f4fa0ef66e9872aa4cfcbf0f378f2381/gcgscola environments/production/T/backend/current (atomic .new + mv -Tf)
  2. Restore runtime.env SHA / SCOLA_RELEASE_ID to 334db599…
  3. sudo ln -sfn /var/www/scola-releases/production/fe-build-3b7e57804077-msqxgidf DIST
  4. sudo systemctl restart odoo-T
  5. Verify served FE 3b7e5780… and BE 334db599…; confirm GBN still frozen

Restore DB from the dump above only if data repair is required.

Honest residuals (do not close these as certified)

  1. GBN remains on the previous pair by explicit freeze. RC1F-006 cannot be described as closed for all production tenants.
  2. Independent Golden verdict is still RC1-B. This operations packet is evidence for a separate auditor decision, not a self-issued RC1-A.
  3. scoladev and scoladev_demo share database.uuid fad7c305-…. Isolation still PASSes on distinct DB names/ports/hosts. The shared UUID is a clone fingerprint; it was not changed in this rollout.
  4. Al-Jabbar https://aljabbar.gcgscola.id/web/login returns HTTP 403; Vue / returns 200 and API smoke is green. Spansa /web/login returns 200. Treat the 403 as an edge observation, not as identity mismatch.
  5. Spansa log showed a pre-existing missing filestore blob during /api/public/company-info; the route still returned HTTP 200. Not introduced by this Python-only candidate.
  6. No -u scola_attendance / -u scola_news. News authoring remains fail-closed; W16 is not claimed.
  7. Production tenants did not receive disposable authenticated DEC-014 probes. Rely on Golden + demo + scoladev for that control.

Suggested auditor reading of RC1F-006

Previous independent wording: demo and five production tenants did not serve the candidate pair.

Current live fact:

  • Demo does serve the exact pair and already has authenticated UAT 8/8.
  • Four named production tenants do serve the exact pair after backup, canary, and isolation PASS.
  • GBN does not serve the candidate pair, by freeze.

A truthful closure of RC1F-006 would have to be scoped (demo + named non-GBN tenants) or remain open until GBN is separately authorized. That call belongs to the independent auditor.

Documents read for this packet

  • AGENTS.md
  • scola-fe-v2/docs/ai-guidelines/workspace-governance.md
  • scola-release-promotion skill
  • scola-fe-v2/docs/release-readiness/audit/RC1-independent-verdict.md
  • scola-fe-v2/docs/release-readiness/audit/RC1-demo-uat.md
  • scola-fe-v2/docs/release-readiness/audit/RC1-deployment-prerequisites.md
  • /tmp/environment_isolation_check.py (live isolation script; FE isolation docs remain stashed)