Plan: V1F-008 — Isolation check must catch FE demo/prod bleed¶

Status: REMEDIATED 2026-08-26T113943Z
Evidence: execution/V1-current-tip-evidence/V1F-008-remediation-after-20260826T113943Z.json

Goal¶

Memperkuat environment_isolation_check.py agar FAIL jika demo dan production menyajikan konten FE yang sama, atau jika directory release di-mutate in-place.

Scope in¶

Checker backend ops script + tests
Aturan: demo frontend resolve path ≠ production tenant resolve paths; SHA demo boleh beda dari production; production SHA harus match expected baseline pin (opsional config)
Deteksi in-place: optional release-manifest checksum vs directory listing hash recorded at promote time

Scope out¶

Runtime restore production (V1F-007)
Perubahan produk FE

Steps¶

Tambah assertion: set resolved FE paths demo ∩ production == ∅.
Tambah assertion: version.json SHA demo ≠ setiap production tenant (kecuali allowlist eksplisit — default kosong).
Record content hash saat create/promote FE release; checker membandingkan hash hidup vs recorded (immutability).
Unit test mutations: shared path, shared SHA, mutated version.json.
Dokumentasikan di release-environment-promotion.md.

Acceptance criteria¶

Repro kasus V1F-007 membuat checker FAIL — MET (unit test_frontend_shared_path_bleed_fails / test_frontend_shared_sha_bleed_fails)
Tes unit baru hijau; --live tetap PASS pada state sehat pasca-restore — MET (7/7 unit; static+live PASS after demo restart + quarantine)
Contaminated fe-build-fd3aba… quarantined (moved, not deleted) — MET

Risks¶

False FAIL jika sengaja canary share (harus opt-in allowlist)
Effort menyimpan manifest hash historis

Estimated effort¶

4–8 jam engineering + review.

Dependencies¶

V1F-007 restore selesai atau baseline pin disepakati