starcoach-hackathon/zarinpal-analytics-deployment
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: advance platform build gate

Browse Source
This commit is contained in:
Amirhossein Khalili
2026-08-20 18:55:05 +03:30
parent 83d2e13d14
commit 480fd207c7
2 changed files with 25 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
tasks/todo.md
View File

@@ -1,18 +1,19 @@
# Platform Operations implementation tasks
- Status: Not authorized — wait for explicit approval of the revised spec
- Status: Ready for stakeholder review — implementation not authorized
- Canonical plan: `tasks/plan.md`
## Task 0: Approve revision and resolve implementation inputs
## Task 0: Resolve implementation inputs and preserve the implementation gate
**Description:** Approve the confirmed manual Qlockify-style intent and resolve every remaining server/runtime/backup/phase-gate decision.
**Description:** Use the approved manual Qlockify-style specification to collect the concrete values and service contracts required for later implementation while preserving the separate explicit build-authorization gate.
**Acceptance criteria:**
- [ ] Revised Platform Operations spec is explicitly approved.
- [ ] ADRs 0001–0003 match the approved topology, manual release, and font decisions.
- [ ] Every remaining decision has a named answer/evidence.
- [x] Revised Platform Operations spec is explicitly approved.
- [x] ADRs 0001–0003 match the approved topology, manual release, and font decisions.
- [ ] Production connection values, protected secrets, repository URLs, service commands/routes, and responsible operators are recorded outside public Git where required.
- [ ] Stakeholder explicitly authorizes creation of deployment implementation artifacts.
**Verification:** Stakeholder approval plus clean documentation review.
**Verification:** Approved specification, clean documentation review, resolved slice inputs, and explicit build authorization.
**Dependencies:** None
@@ -61,9 +62,10 @@
**Acceptance criteria:**
- [ ] Migration completes before API/worker readiness.
- [ ] Normal startup never runs import/admin; import uses one exact read-only path.
- [ ] `first-start.sh` starts data services, migrates, imports and reconciles the pinned archive, then starts public services only after success.
- [ ] Worker is private/event-driven and uses pinned pre-1.0 Asynq `v0.26.0`.
**Verification:** Startup/failure/import-idempotency/shutdown integration tests.
**Verification:** First-start, ordinary-startup, migration/import failure, checksum/count reconciliation, idempotent no-op, and shutdown integration tests.
**Dependencies:** Task 2 and approved backend commands
@@ -113,11 +115,11 @@
## Task 6: Adapt Qlockify manual deploy and rollback
**Description:** Modify Qlockify's deploy flow for ZarinPal paths/services and three-hash release records while removing unconditional destructive Git synchronization.
**Description:** Modify Qlockify's deploy flow for ZarinPal paths/services and three-hash release records while keeping interactive Git pulls as a separate operator prerequisite and removing unconditional destructive Git synchronization.
**Acceptance criteria:**
- [ ] Latest `origin/main` is fast-forwarded and three hashes recorded before build.
- [ ] Dirty/diverged checkout, pull, build, migration, or health failure preserves the active release.
- [ ] Operator manually fast-forwards all three repositories to latest `origin/main`; the deployment command performs no pull and records all three hashes before build.
- [ ] Dirty/diverged checkout, build, migration, or health failure preserves the active release; a manual pull failure prevents deployment from starting.
- [ ] Previous hashes rebuild/restore within 15 minutes without automatic down migration.
**Verification:** Script tests plus induced staging failures and timed rollback drill.
@@ -133,7 +135,7 @@
**Description:** Reuse Qlockify's PostgreSQL dump, OpenSSL, rclone upload, and retention flow with ZarinPal paths/services/credentials and a non-secret manifest.
**Acceptance criteria:**
- [ ] Archive/listing/checksums/encryption/remote verification gate success.
- [ ] Package contents, plain-SQL header/checksums, encryption, and remote verification gate success.
- [ ] Exactly three verified encrypted local and seven remote backups are retained.
- [ ] `.env`, secrets, Redis, TLS, CSV, credentials, logs, monitoring, font, and license are excluded.
@@ -164,7 +166,7 @@
## Task 9: Bootstrap and accept MVP server
**Description:** Follow the reviewed bootstrap runbook, deploy manually, run one-time data/demo setup, and capture MVP evidence.
**Description:** Follow the reviewed bootstrap runbook, run the guarded first-start migration/import/application sequence, perform separate demo setup, and capture MVP evidence.
**Acceptance criteria:**
- [ ] Access/firewall/Docker/DNS/TLS/deployment boundaries pass.