PR13 — Deployment runbook and enterprise-security smoke test extension - #23
Merged
Conversation
Seeds throwaway scientist/viewer-role users directly via MySQL (no HTTP-reachable way to do this otherwise -- org creation only grants org_admin, and there's no accept-invite endpoint to get a second user into active org membership), then asserts scientist gets 200 and viewer gets 403 on GET /model-registry/v1. ADMIN_BOOTSTRAP_TOKEN still works as a direct override for an operator who'd rather not grant DB access. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Backup -> merge -> migrate -> restart -> verify procedure for when PR13 is reviewed and approved. Documentation only -- migration 0016 has not been applied and the live stack has not been touched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Closes the gap flagged in the PR13 pre-merge integration review ("no
rollback plan exists"). Flags that scripts/restore-mysql.sh referenced
in the original draft doesn't actually exist in this repo -- gives the
working manual mysqldump-restore command instead of silently documenting
a broken reference. Also fixes the earlier merge-order inconsistency
(this file previously listed docs before studio; every PR's stated
dependency order has studio before docs) while in here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
man4ish
marked this pull request as ready for review
August 6, 2026 02:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Deployment support for PR13, not application code:
scripts/test-enterprise-security.sh: extends the existing PR12 IAM/RBAC smoke test with the case it previously couldn't exercise without an operator-providedADMIN_BOOTSTRAP_TOKEN— a real "200 when permission present" check. Seeds throwawayscientist- andviewer-role users directly via MySQL (this script's existingdocker composedependency, now also used for this, since there's no HTTP-only way to get a self-registered user into an org-scoped role — no accept-invite endpoint exists), then asserts a scientist token gets200onGET /model-registry/v1and a viewer token gets403.scripts/PR13-DEPLOYMENT-RUNBOOK.md: the documented deploy procedure (backup → merge → migrate → restart → verify) for when PR13 is actually approved. Documentation only — none of these steps have been executed.Dependency
This PR is part of PR13 — Dynamic Enterprise RBAC Activation.
It must be reviewed and merged in dependency order with the other PR13 repositories.
Do not merge independently.
Dependency order: auth → policy-engine → api-gateway → control-center → studio (this PR) → docs. This repo's smoke test only exercises the live stack meaningfully once the other 4 repos' PRs are merged and deployed per the runbook.
Validation
Tests performed: no automated test suite exists for this repo (Electron app) — the PR13 diff here is scripts/docs only, no application code.
bash -nsyntax-checked; the smoke test's new logic was validated conceptually against the actualomnibioai-authschema (membership_roles/organization_membershipstables) it seeds, but not yet run against the live stack — that's deferred to actual deployment time, per the runbook.Security checks: n/a — no application code in this PR. The smoke test itself is a security validation tool, not something requiring its own security review beyond "does it seed test data safely" — it only ever creates throwaway accounts/orgs, never touches real user data.
Compatibility notes:
ADMIN_BOOTSTRAP_TOKENstill works as a direct override for an operator who'd rather not grant the script MySQL access — the new seeding path is additive, not a replacement.Related PRs
Part of the PR13 review set, all on
feature/pr13-dynamic-rbac-activation:omnibioai-auth— PR #32 (draft, open)omnibioai-policy-engine— PR #2 (draft, open)omnibioai-api-gateway— PR #5 (draft, open)omnibioai-control-center— PR #20 (draft, open)omnibioai-docs— architecture documentationReview only — do not merge. No migration applied, no deployment performed, live stack untouched. The deployment runbook in this PR is documentation of a future procedure, not a record of one that ran.