wangcong/story
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: require production infrastructure evidence

Browse Source
This commit is contained in:
Codex Local
2026-08-26 22:56:19 +08:00
parent 3786db0de8
commit feb99de192
19 changed files with 237 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/smoke-acceptance-snapshot.ps1
+5 -3
View File
@@ -37,9 +37,11 @@ try {
if ($createdResponse.StatusCode -ne 201 -or $snapshot.redaction_policy -ne 'ops-acceptance-minimal-v1') { throw '验收快照首次生成结果不正确' }
if ($snapshot.database.migration_version -lt 36 -or $snapshot.database.dirty) { throw '验收快照未正确冻结数据库迁移状态' }
if (@($snapshot.external_dependencies).Count -ne 1 -or $snapshot.external_dependencies[0].dependency -ne 'oidc_jwks' -or -not $snapshot.external_dependencies[0].gate_satisfied) { throw '验收快照未正确冻结OIDC外部依赖状态' }
if (@($snapshot.gates).Count -ne 6) { throw '验收快照门禁数量不正确' }
if (@($snapshot.gates).Count -ne 8) { throw '验收快照门禁数量不正确' }
$productionGate = @($snapshot.gates | Where-Object { $_.code -eq 'production_infrastructure_ready' })
if ($productionGate.Count -ne 1 -or -not $productionGate[0].satisfied -or $snapshot.production_infrastructure.applicable -or -not $snapshot.production_infrastructure.gate_satisfied) { throw 'LAB快照不应被生产基础设施门禁阻断' }
$failedGates = @($snapshot.gates | Where-Object { -not $_.satisfied })
if ($snapshot.overall_gate_satisfied -ne ($failedGates.Count -eq 0)) { throw '验收快照总结果与六项门禁不一致' }
if ($snapshot.overall_gate_satisfied -ne ($failedGates.Count -eq 0)) { throw '验收快照总结果与八项门禁不一致' }
$blockingItems = @($snapshot.alerts.blocking_items)
$expectedItems = [Math]::Min([int]$snapshot.alerts.blocking, 100)
if ($blockingItems.Count -ne $expectedItems -or $snapshot.alerts.blocking_items_truncated -ne ($snapshot.alerts.blocking -gt 100)) { throw '阻断告警定位数量或截断标识不正确' }
@@ -60,7 +62,7 @@ try {
if ($null -eq $_.Exception.Response -or [int]$_.Exception.Response.StatusCode -ne 403) { throw }
}
$failedCodes = if ($failedGates.Count) { ($failedGates.code -join ',') } else { 'none' }
Write-Host "发布候选验收快照烟测通过：真实OIDC、迁移冻结、外部依赖、六项门禁、阻断告警定位、幂等重放、租户隔离和端点脱敏均正确；当前阻断项=$failedCodes。"
Write-Host "发布候选验收快照烟测通过：真实OIDC、迁移冻结、外部依赖、八项门禁、生产条件按环境适用、阻断告警定位、幂等重放、租户隔离和端点脱敏均正确；当前阻断项=$failedCodes。"
} finally {
docker compose exec -T postgres psql -U voice -d voice_platform -v ON_ERROR_STOP=1 -c "BEGIN; DELETE FROM audit_event WHERE request_id='$requestID'; DELETE FROM idempotency_record WHERE idempotency_key='$key'; COMMIT;" | Out-Null
Write-Host '已清理验收快照烟测审计和幂等记录；快照本身不在服务端留存。'