moebiusol/oculus_vita-cms
4
0
Fork 0
Code Issues Pull requests 21 Projects Releases Packages 1 Wiki Activity Actions

WIP: [OCV-246] Restore CMS authenticated semantic runtime contract #59

Draft
moeardent wants to merge 8 commits from fix/OCV-246-cms-runtime-contract into dev
pull from: fix/OCV-246-cms-runtime-contract
merge into: moebiusol:dev
Conversation 0 Commits 8 Files changed 24 +1294 -16
moeardent commented 2026-10-13 23:55:57 +00:00
Owner
Copy link

Summary

DEV cannot serve the required CMS semantic runtime contract. Restore the accepted authenticated endpoint and image-owned metadata without replacing the newer pipeline.

  • Change class: bounded bugfix recovery.
  • Promotion target: reviewed source to dev; WIP, no merge or deployment.
  • Trace: OCV-246, parent OCV-206.

Scope

Includes endpoint, metadata baker, preserved 3.1.0/14-capability inventory, Apache authorization/routing, UID33/PVC-safe route activation, explicit original product build input, tests, accepted ADR and repair spec.

Vault/GitOps changes, producer-publication governance, production and live deployment are outside this review request.

Implementation Notes

Both Oculus Vita and Oralert DEV/TEST contexts expose the exact six-field JSON schema with fixed tenant ocv and no-store. Rejections disclose generic errors only. Metadata is baked from the source contract and explicit OCV_PRODUCT_BUILD_NUMBER; no TeamCity ID substitution. Route activation stages and locks within the PVC and restores previous files on failure.

Verification Evidence

Independent source review identified indentation and cross-filesystem startup defects; both repaired, with no further confirmed source blockers on re-review. Local shell syntax, three Apache static tests, image-boundary checks and diff checks passed.

Existing TeamCity validation now requires PHP8.4+, PHPUnit endpoint tests, actual repository route rules and an actual tmpfs/PVC-boundary activation suite running as UID33. Missing tools or mount capabilities fails validation. No local Qodana or PHP execution was performed.

WIP blockers: exact-head remote CI and authentic Apache bearer smoke are pending. Original semantic producer input/publication integration and dedicated Vault reader remain prerequisites to live readiness. Source review is not quality or deployment acceptance.

Documentation and QMS Impact

Recovered accepted runtime boundary ADR and specs/ocv-246-cms-runtime-contract. Parent owns controlled documentation trigger/obligation records, risk/architecture evidence closure and release-bound CI/SBOM/security/live acceptance. No new dependency or clinical/user-data boundary.

Reviewer Focus

Review original semantic build authority, preserved full capabilities, pre-Apache and post-deploy synchronization, rollback behavior, authorization propagation through early END routing, and executable CI mount prerequisites.

Promotion and Recovery

Keep WIP until exact-head CI and real Apache bearer proof pass and semantic producer prerequisites are resolved. No merge/deploy is requested here. Activation rollback restores previous route files; image rollback must restore the selected image generation and its baked metadata.

Identity and Traceability

Human sponsor: Cristian Cotosman, Authentik principal 45a33291-8c6a-4e07-bdd5-131c8d44c38d. Executor: Moe Ardent moe.lorand.bot@moebiusol.eu, bounded CMS implementation worker.

Closure Checklist

  • Bounded scope and explicit DEV/TEST target.
  • Source review, documentation impact and recovery behavior recorded.
  • Exact-head remote PHP/mount/quality evidence.
  • Authentic Apache bearer smoke.
  • Governed original semantic producer input/publication and runtime secret prerequisites.
## Summary DEV cannot serve the required CMS semantic runtime contract. Restore the accepted authenticated endpoint and image-owned metadata without replacing the newer pipeline. - Change class: bounded bugfix recovery. - Promotion target: reviewed source to `dev`; WIP, no merge or deployment. - Trace: [OCV-246](https://moebiusol.youtrack.cloud/issue/OCV-246), parent [OCV-206](https://moebiusol.youtrack.cloud/issue/OCV-206). ## Scope Includes endpoint, metadata baker, preserved 3.1.0/14-capability inventory, Apache authorization/routing, UID33/PVC-safe route activation, explicit original product build input, tests, accepted ADR and repair spec. Vault/GitOps changes, producer-publication governance, production and live deployment are outside this review request. ## Implementation Notes Both Oculus Vita and Oralert DEV/TEST contexts expose the exact six-field JSON schema with fixed tenant `ocv` and `no-store`. Rejections disclose generic errors only. Metadata is baked from the source contract and explicit `OCV_PRODUCT_BUILD_NUMBER`; no TeamCity ID substitution. Route activation stages and locks within the PVC and restores previous files on failure. ## Verification Evidence Independent source review identified indentation and cross-filesystem startup defects; both repaired, with no further confirmed source blockers on re-review. Local shell syntax, three Apache static tests, image-boundary checks and diff checks passed. Existing TeamCity validation now requires PHP8.4+, PHPUnit endpoint tests, actual repository route rules and an actual tmpfs/PVC-boundary activation suite running as UID33. Missing tools or mount capabilities fails validation. No local Qodana or PHP execution was performed. WIP blockers: exact-head remote CI and authentic Apache bearer smoke are pending. Original semantic producer input/publication integration and dedicated Vault reader remain prerequisites to live readiness. Source review is not quality or deployment acceptance. ## Documentation and QMS Impact Recovered accepted runtime boundary ADR and `specs/ocv-246-cms-runtime-contract`. Parent owns controlled documentation trigger/obligation records, risk/architecture evidence closure and release-bound CI/SBOM/security/live acceptance. No new dependency or clinical/user-data boundary. ## Reviewer Focus Review original semantic build authority, preserved full capabilities, pre-Apache and post-deploy synchronization, rollback behavior, authorization propagation through early END routing, and executable CI mount prerequisites. ## Promotion and Recovery Keep WIP until exact-head CI and real Apache bearer proof pass and semantic producer prerequisites are resolved. No merge/deploy is requested here. Activation rollback restores previous route files; image rollback must restore the selected image generation and its baked metadata. ## Identity and Traceability Human sponsor: Cristian Cotosman, Authentik principal `45a33291-8c6a-4e07-bdd5-131c8d44c38d`. Executor: Moe Ardent <moe.lorand.bot@moebiusol.eu>, bounded CMS implementation worker. ## Closure Checklist - [x] Bounded scope and explicit DEV/TEST target. - [x] Source review, documentation impact and recovery behavior recorded. - [ ] Exact-head remote PHP/mount/quality evidence. - [ ] Authentic Apache bearer smoke. - [ ] Governed original semantic producer input/publication and runtime secret prerequisites.
[FIX] OCV-246 restore CMS authenticated semantic runtime contract
Some checks are pending
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch is running
Details
7b4845195f 
- Recover the accepted fixed-tenant six-field endpoint and complete semantic capability inventory.
- Bake explicit original product coordinates and activate the image-owned route safely inside the PVC.
- Preserve current CI and require PHP, actual-rule and UID33 mount regression tests; remote evidence remains pending.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Verification-Ref: source re-review complete; shell syntax, 3 Apache static checks and image boundary passed; exact-head remote PHP/mount/Apache evidence pending
Risk-Ref: OCV-206 [https://moebiusol.youtrack.cloud/issue/OCV-206]
Release-Ref: DEV/TEST candidate only; no deployment or production authorization
Exception-Ref: None
[FIX] OCV-246 replace CMS route entries safely
All checks were successful
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch passed
Details
2829b2c23b 
Use no-follow moves for handler activation and PVC rollback so a symlink-to-directory cannot redirect staged entries.

Add an injected activation-failure regression that checks the prior symlink and PVC route configuration are restored.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: shell syntax, Apache static checks (3/3), image boundary and diff checks passed; PHP-backed route sync test unavailable locally (PHP CLI missing); exact-head TeamCity revalidation pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: DEV/TEST candidate only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 validate CMS runtime contract on review branches
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
3d558e1910 
Keep delivery provenance closed to dev/test/main while running the exact PHP runtime suite in the existing non-release Qodana branch lane.

The branch lane remains verification-only and does not build, publish, or promote images.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP runtime suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 isolate branch runtime checks from TeamCity secrets
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
02544ab56f 
Run PHP route tests in a minimal environment so source-under-review does not inherit unrelated project credentials.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; remote runtime test pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 require PHP CLI for CMS runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
49cfe047b5 
Do not treat Docker presence as satisfying a PHP CLI dependency; install or fail clearly before executing the required runtime suite.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provision PHPUnit for runtime validation
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 2
Details
04f9d28872 
Install or require PHPUnit alongside PHP CLI before running the fail-closed runtime contract suite on branch and stable validation lanes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; exact-head remote PHP suite pending

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 provide PHP 8.4 in CMS validation lane
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
56685f430f 
Install the required PHP 8.4 CLI when the TeamCity agent has no qualifying interpreter; Docker presence is not a PHP CLI substitute.

The PHP 8.4 Ubuntu setup follows PHP installation guidance; only CLI SAPI is used by validation.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d

Human-Sponsor-Display-Name: Cristian Cotosman

Human-Sponsor-Email: cristian@moebiusol.eu

Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>

Agent-Role: bounded CMS runtime implementation worker

Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Review-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Verification-Ref: Qodana branch-lane static check, shell syntax, 3 Apache static tests, image boundary and diff checks passed; rerunning exact-head remote PHP suite

Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]

Release-Ref: review validation only; no deployment or production authorization

Exception-Ref: None
[FIX] OCV-246 fail closed without approved PHP test image
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Details
4c922d5ae0 
Remove the unapproved third-party PHP package source and package installation from shared TeamCity validation. Require PHP 8.4+ CLI and PHPUnit from an approved, digest-pinned test image; retain the branch-only runtime suite and do not widen native delivery routes.

Human-Sponsor-Principal-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Authentik-User-Id: 45a33291-8c6a-4e07-bdd5-131c8d44c38d
Human-Sponsor-Display-Name: Cristian Cotosman
Human-Sponsor-Email: cristian@moebiusol.eu
Agent-Identity: Moe Ardent <moe.lorand.bot@moebiusol.eu>
Agent-Role: bounded CMS runtime implementation worker
Trace-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Review-Ref: OCV-246 [moebiusol/oculus-vita-cms#59]
Verification-Ref: branch-lane/static checks and shell syntax, Apache route tests, image boundary checks, and diff checks pass; PHP runtime suite not run due missing approved PHP 8.4/PHPUnit image
Risk-Ref: OCV-246 [https://moebiusol.youtrack.cloud/issue/OCV-246]
Release-Ref: review validation only; no deployment or production authorization
Exception-Ref: None
Some checks failed
teamcity/medcms/qodana-branch TeamCity OculusVitaCMS_QodanaBranch failed with exit 4
Required
Details
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/OCV-246-cms-runtime-contract:fix/OCV-246-cms-runtime-contract
git switch fix/OCV-246-cms-runtime-contract
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
Compat/Breaking

Breaking change that won't be backward compatible

  
Kind/Bug

Something is not working

  
Kind/Documentation

Documentation changes

  
Kind/Enhancement

Improve existing functionality

  
Kind/Feature

New functionality

  
Kind/Security

This is security issue

  
Kind/Testing

Issue or pull request related to testing

  
Priority
Critical
The priority is critical

  
Priority
High
The priority is high

  
Priority
Low
The priority is low

  
Priority
Medium
The priority is medium

  
Reviewed
Confirmed
Issue has been confirmed

  
Reviewed
Duplicate
This issue or pull request already exists

  
Reviewed
Invalid
Invalid issue

  
Reviewed
Won't Fix
This issue won't be fixed

  
Status
Abandoned
Somebody has started to work on this but abandoned work

  
Status
Blocked
Something is blocking this issue or pull request

  
Status
Need More Info
Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: moebiusol/oculus_vita-cms#59
No description provided.
Delete branch "fix/OCV-246-cms-runtime-contract"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?