Docker access is still unavailable in this environment (permission
denied on the socket, no docker group membership, no passwordless
sudo -- confirmed again), so this can't be the live-infrastructure
verification pass Phase 4 actually needs. What it can be: re-running
every command this runbook claims is Docker-free and fixing what's
drifted since it was written across several commits.
Found and fixed by actually executing each command, not just reading
the prose:
- go test ./internal/chwriter/... -run TestRegistry -v (§14) doesn't
match what the surrounding paragraph claims it verifies --
TestRegistry as a regex matches TestRegistryWritesEachTenantToItsOwnDatabase/
TestRegistryRefusesUnprovisionedTenant (the live-ClickHouse tests,
which just skip), not TestWriteBatchRefusesEmptyTenantID/
TestWriteBatchRefusesUnknownTenantWithEmptyRegistry (the actual
Docker-free fail-closed tests the paragraph describes). Fixed the
filter and left a note explaining the mismatch, since it's the kind
of thing worth knowing was caught by running the command, not just
proofreading it.
- §9's cargo test still said "expect 14 tests passing" -- stale since
the Tantivy write-routing and active-tenant-gate passes added 10 more
(now 24, verified by actually running it). Added a pointer to the new
registry.rs/tenants.rs tests those two passes added.
- §3a's "Not yet built: an equivalent for revoking/listing memberships"
was stale -- -revoke-membership-*/-list-memberships-tenant/
-transfer-owner-* all exist now. Narrowed the still-accurate part
(dashboard_permissions grants have no operator flag) and pointed at
sentryctl dashboards permissions instead, which does cover it.
- The "Two genuine exceptions" intro undercounted its own list, which
had grown to five items across later edits without the header being
updated to match.
Every other Docker-free command in this runbook (§3a/§3b's login
tests, §9's searchclient/chrunner mid-provisioning probes, §11's
tenantcrd tests, §12's session/loginhandler tests, §13's ingest
identity tests, §14's active-tenant-gate tests, the cli dashboard-
permissions tests, docker compose config's profile/port/alias
assertions) was re-run and matches what the doc already claimed -- no
further drift found. Full cross-module build/vet/test sweep (all Go
modules including terraform/, search's cargo build/clippy,
hack/check-tenant-boundary.sh) also re-confirmed clean.
jcoffey-dev
5a898cb43e