chore: establish local platform baseline

2026-08-26 06:41:54 +08:00
commit 29bdf4900f
575 changed files with 95644 additions and 0 deletions
@@ -0,0 +1,57 @@
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandUseErrorActionPreference = $true
+$root = Split-Path -Parent $PSScriptRoot
+Set-Location -LiteralPath $root
+
+$temporaryRoot = Join-Path ([System.IO.Path]::GetTempPath()) ('infrastructure-conformance-' + [Guid]::NewGuid().ToString('N'))
+$capturePath = Join-Path $temporaryRoot 'capture.json'
+$reportPath = Join-Path $temporaryRoot 'report.json'
+
+function Write-JsonUtf8([string]$path, $value) {
+  $json = $value | ConvertTo-Json -Depth 12
+  [System.IO.File]::WriteAllText($path, $json, [System.Text.UTF8Encoding]::new($false))
+}
+
+try {
+  New-Item -ItemType Directory -Path $temporaryRoot | Out-Null
+  $null = Invoke-RestMethod -Uri 'http://localhost:58080/health/ready'
+  $jwks = Invoke-RestMethod -Uri 'http://localhost:58180/realms/voice-local/protocol/openid-connect/certs'
+  if (@($jwks.keys).Count -lt 1) { throw '本地OIDC JWKS不可用' }
+  if ((docker compose exec -T postgres pg_isready -U voice -d voice_platform) -notmatch 'accepting connections') { throw '本地PostgreSQL不可用' }
+  if ((docker compose exec -T redis redis-cli ping).Trim() -ne 'PONG') { throw '本地Redis不可用' }
+  $null = Invoke-WebRequest -UseBasicParsing -Uri 'http://localhost:59000/minio/health/ready'
+  $null = Invoke-WebRequest -UseBasicParsing -Uri 'http://localhost:59190/-/ready'
+  foreach ($path in @('deploy/kubernetes/base/network-policies.yaml','deploy/prometheus/prometheus.yml','deploy/prometheus/rules/platform-alerts.yml')) {
+    if (-not (Test-Path -LiteralPath $path)) { throw "缺少本地配置引用：$path" }
+  }
+
+  $imageDigest = (docker image inspect data-terminal-cloud-api --format '{{.Id}}').Trim()
+  if ($imageDigest -notmatch '^sha256:[a-f0-9]{64}$') { throw '无法取得API镜像摘要' }
+  $observedAt = (Get-Date).ToUniversalTime().AddMinutes(-1)
+  $collectedAt = (Get-Date).ToUniversalTime()
+  $definitions = @(
+    @('DOMAIN_TLS','http://localhost:58080','LOCAL_HTTP_REACHABLE','probe:api-ready','compose.yaml'),
+    @('OIDC','http://localhost:58180/realms/voice-local','JWKS_AVAILABLE','probe:keycloak-jwks','deploy/keycloak/voice-local-realm.json'),
+    @('POSTGRES','compose:postgres','LOCAL_REACHABLE','probe:pg-isready','compose.yaml'),
+    @('REDIS','compose:redis','LOCAL_REACHABLE','probe:redis-ping','compose.yaml'),
+    @('OBJECT_STORE','compose:minio','LOCAL_REACHABLE','probe:minio-ready','compose.yaml'),
+    @('NETWORK_ISOLATION','kubernetes:network-policy','STATIC_RENDER_PRESENT','probe:file-present','deploy/kubernetes/base/network-policies.yaml'),
+    @('MONITORING','compose:prometheus','LOCAL_REACHABLE','probe:prometheus-ready','deploy/prometheus/prometheus.yml')
+  )
+  $components = @($definitions | ForEach-Object {
+    @{ component_type = $_[0]; resource_ref = $_[1]; status = 'VERIFIED'; observed_at = $observedAt.ToString('o'); verified_controls = @($_[2]); probe_ref = $_[3]; configuration_ref = $_[4]; audit_ref = 'local-smoke:no-external-audit' }
+  })
+  $capture = @{
+    schema_version = 'production-infrastructure-capture-v1'; evidence_source = 'LOCAL'; candidate_version = '0.63.0-rc.local'; build_digest = $imageDigest
+    environment = 'LOCAL'; region_ref = 'local-machine'; cluster_ref = 'docker-compose'; change_ticket_ref = 'local-smoke'
+    attested_by_ref = 'local-smoke-script'; attested_at = $observedAt.AddSeconds(30).ToString('o'); collected_at = $collectedAt.ToString('o'); components = $components
+  }
+  Write-JsonUtf8 $capturePath $capture
+  go run ./cmd/infrastructure-conformance -capture $capturePath -candidate-version '0.63.0-rc.local' -build-digest $imageDigest -output $reportPath
+  $report = Get-Content -Raw -LiteralPath $reportPath | ConvertFrom-Json
+  if ($report.result -ne 'PASS' -or $report.evidence_scope -ne 'LOCAL_INFRASTRUCTURE' -or -not $report.external_validation_required -or $report.component_count -ne 7) { throw '本地基础设施报告边界不正确' }
+  Write-Host '本地基础设施纵向冒烟通过：7类组件可达或配置存在；报告固定为LOCAL_INFRASTRUCTURE，生产门禁继续待验。'
+} finally {
+  if (Test-Path -LiteralPath $temporaryRoot) { Remove-Item -LiteralPath $temporaryRoot -Recurse -Force }
+  Write-Host '已清理本地基础设施冒烟临时文件。'
+}