jcoffey-dev
5a898cb43e
Docker access is still unavailable in this environment (permission denied on the socket, no docker group membership, no passwordless sudo -- confirmed again), so this can't be the live-infrastructure verification pass Phase 4 actually needs. What it can be: re-running every command this runbook claims is Docker-free and fixing what's drifted since it was written across several commits. Found and fixed by actually executing each command, not just reading the prose: - go test ./internal/chwriter/... -run TestRegistry -v (§14) doesn't match what the surrounding paragraph claims it verifies -- TestRegistry as a regex matches TestRegistryWritesEachTenantToItsOwnDatabase/ TestRegistryRefusesUnprovisionedTenant (the live-ClickHouse tests, which just skip), not TestWriteBatchRefusesEmptyTenantID/ TestWriteBatchRefusesUnknownTenantWithEmptyRegistry (the actual Docker-free fail-closed tests the paragraph describes). Fixed the filter and left a note explaining the mismatch, since it's the kind of thing worth knowing was caught by running the command, not just proofreading it. - §9's cargo test still said "expect 14 tests passing" -- stale since the Tantivy write-routing and active-tenant-gate passes added 10 more (now 24, verified by actually running it). Added a pointer to the new registry.rs/tenants.rs tests those two passes added. - §3a's "Not yet built: an equivalent for revoking/listing memberships" was stale -- -revoke-membership-*/-list-memberships-tenant/ -transfer-owner-* all exist now. Narrowed the still-accurate part (dashboard_permissions grants have no operator flag) and pointed at sentryctl dashboards permissions instead, which does cover it. - The "Two genuine exceptions" intro undercounted its own list, which had grown to five items across later edits without the header being updated to match. Every other Docker-free command in this runbook (§3a/§3b's login tests, §9's searchclient/chrunner mid-provisioning probes, §11's tenantcrd tests, §12's session/loginhandler tests, §13's ingest identity tests, §14's active-tenant-gate tests, the cli dashboard- permissions tests, docker compose config's profile/port/alias assertions) was re-run and matches what the doc already claimed -- no further drift found. Full cross-module build/vet/test sweep (all Go modules including terraform/, search's cargo build/clippy, hack/check-tenant-boundary.sh) also re-confirmed clean.