ced4568
bfae2aafe0
docs/ROOTNODE_PRICING_AND_OFFERS_V1.md — the founder-approved, locked V1 pricing matrix (seasonal camps, instructor-led programs, self-paced, mentoring/workshops, sibling policy, Winter Break launch terms) recovered from synced conversation history after the original Phase 9.5 commit was confirmed absent from canonical Git history. Cross-validated against the independently-prepared RootNode Academy WHM+WHMCS Agent Handoff's own price guardrail table — identical figures. Does not resolve or invent dates, venue, capacity, tax treatment, refund/cancellation policy, or legal agreement language — those remain separate, open launch gates. PHASE10_CANONICAL_STATE_AUDIT.md updated to reflect the recovery — the original Phase 9.5 commit is still confirmed missing from history, but the pricing decision itself is now canonically recorded rather than resting only on verbal confirmation. PC #2 inspection remains useful only to check for an earlier local copy to compare against, not to locate the pricing itself anymore.
191 lines
12 KiB
Markdown
191 lines
12 KiB
Markdown
# Phase 10 — Canonical State Audit
|
||
|
||
Gate 1. Performed before any Phase 10 production/launch work, per Phase 10's own explicit
|
||
requirement — Chase has been developing from two workstations, so nothing downstream was
|
||
started until canonical state was actually verified, not assumed.
|
||
|
||
## Baseline
|
||
|
||
- Starting SHA (as reported at the end of Phase 9.1): `a4c00580...` (full:
|
||
`a4c0058f8c3d9612f1d30508626fa5be00431fa7`).
|
||
- This workstation's `HEAD` and `origin/main`, confirmed via `git fetch --all --prune`, are
|
||
**both exactly `a4c0058f8c3d9612f1d30508626fa5be00431fa7`** — this workstation is fully
|
||
up to date with canonical Gitea, and canonical Gitea has not moved since Phase 9.1 ended.
|
||
|
||
## 1.1 Current workstation state
|
||
|
||
- Branch: `main`. Working tree: clean (`git status --short` — no output).
|
||
- `git remote -v`: `origin` → `gitea:ced4568/rootnode-academy.git` (fetch + push) — canonical,
|
||
no GitHub `kubekosh` remote configured in this clone at all.
|
||
- `git branch -vv`: `* main a4c0058 [origin/main]` — tracking correctly, no divergence.
|
||
- No stashes, no dangling work, no uncommitted changes.
|
||
|
||
## 1.2 Remote audit
|
||
|
||
`git ls-remote --heads --tags origin` shows exactly one branch (`main`, at `a4c0058`) and four
|
||
tags (`v0.4.1-preprod`, `v0.5.0-student-auth`, `v0.5.3-enrollment-comms`, `v0.6.0-root-v1`) — no
|
||
other branches, no unexpected experimental branches, no stale branches to reconcile.
|
||
`git log --all --oneline` and `git log --oneline` both return exactly **184** commits — every
|
||
commit reachable in this repository is reachable from `main`. **There is no orphaned or
|
||
unmerged work sitting in Gitea outside `main`.**
|
||
|
||
## 1.3 Second-PC reconciliation
|
||
|
||
This execution environment has no access to Chase's other workstation. Gitea's own state (§1.2)
|
||
proves there is no SECOND branch or unpushed-but-fetchable ref waiting anywhere on the remote —
|
||
if work exists only on the other PC, it is **local and unpushed there**, not merely unmerged
|
||
here. This is not automatically resolvable from this side.
|
||
|
||
**Exact commands for Chase to run on PC #2** to prove no local-only RootNode work is stranded:
|
||
|
||
```bash
|
||
cd ~/Dev/Gitea/ced4568/rootnode-academy # or wherever the clone lives on that machine
|
||
git status # must show "nothing to commit, working tree clean"
|
||
git branch -vv # every branch should show [origin/main] with no
|
||
# "ahead" count, or should not exist at all
|
||
git fetch origin
|
||
git log origin/main..HEAD --oneline # MUST be empty — any output here is unpushed work
|
||
git stash list # should be empty, or each entry reviewed manually
|
||
```
|
||
|
||
If `git log origin/main..HEAD --oneline` on PC #2 produces ANY output, that is real, unpushed
|
||
work — it must be reviewed and pushed (or explicitly discarded by Chase's own decision) before
|
||
being considered part of canonical state. **This audit cannot rule that out from here — it can
|
||
only confirm Gitea itself has no evidence of it.**
|
||
|
||
## 1.4 Expected milestone audit
|
||
|
||
Every phase SHA Phase 10's own authorization listed (Phase 2A through Phase 9.1 final) was
|
||
verified present in canonical history, in full agreement with the commit message labels:
|
||
|
||
| Phase | SHA (verified) | Commit subject |
|
||
|---|---|---|
|
||
| 2A | `42dfb1c` | docs(phase2a): document gateway and student launch architecture |
|
||
| 2B | `08ff531` | docs(phase2b): document admin and platform-data architecture |
|
||
| 3A | `4069292` | docs(phase3a): document production identity architecture |
|
||
| 3B | `45a147a` | docs(phase3b): document the learning and assessment engine |
|
||
| 4 | `bf1e1b5` | docs(phase4): production infrastructure documentation + runbooks |
|
||
| 4.1 | `5bc0743` | docs(phase4.1): pre-production hardening documentation |
|
||
| 5A | `896c230` | docs(phase5a): student identity and remote classroom documentation |
|
||
| 5B | `1c08a30` | docs(phase5b): self-paced enrollment documentation + website integration contract |
|
||
| 5C | `777efd1` | docs(phase5c): enrollment communications documentation + Google Workspace runbook |
|
||
| 6A | `fd38d06` | docs(phase6a): document RootNode course foundation |
|
||
| 6B | `2db1368` | docs(phase6b): document curriculum expansion |
|
||
| 6C | `bd0a10f` | docs(phase6c): pilot readiness standard, pilot curriculum manifest, ROOT 11 scope |
|
||
| 6D | `b6516a7` | docs(phase6d): document the ROOT Foundations milestone |
|
||
| 6E | `87ad125` | docs(phase6e): document the ROOT Foundations Completion milestone |
|
||
| 6F | `d066410` | docs(phase6f): document ROOT_ V1 pilot readiness (tag `v0.6.0-root-v1`) |
|
||
| 7 | `df5e39f` | docs(phase7): document the business/product architecture foundation |
|
||
| 8 | `788fb19` | docs(phase8): document enrollment operations |
|
||
| 9 | `80a5f6e` | docs(phase9): document commerce integration and Winter Break launch readiness |
|
||
| 9.1 (prep) | `77fd186` | docs(stripe): document Phase 9.1 blocked status and live-mode readiness checklist |
|
||
| 9.1 (final) | `a4c0058` | docs(stripe): document real Stripe TEST-mode validation results |
|
||
|
||
**Original Phase 9.5 commit — NOT FOUND, reconfirmed in Phase 10.1.** No commit, branch, or tag
|
||
matching "Phase 9.5" or a founder-pricing document existed in this repository's reachable history
|
||
(`git log --all` contains no such commit, searched again in Phase 10.1 with a broader content
|
||
search for "FOUNDER APPROVED"/"LOCKED FOR V1"/"Founding Cohort"/`39900` — every hit traces to
|
||
the Phase 9.1/10 work, never a separate Phase 9.5 commit). The complete founder-approved matrix
|
||
was subsequently recovered from Chase's synced RootNode Academy conversation and canonicalized
|
||
as `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. The earlier belief that a unique document existed
|
||
only on PC #2 was not verified and is no longer relied upon. The original desktop still requires
|
||
inspection only to determine whether it holds an earlier unpushed copy or commit. The recovered
|
||
document is now the authoritative V1 pricing record unless that inspection reveals a material
|
||
difference requiring Chase's review.
|
||
|
||
**Website pricing is stale, confirmed with Chase.** A read-only fetch of `rootnodeacademy.com`
|
||
during Phase 10.1 found founding-price RANGES (INIT_ $200–250, COMPILE_ $300–360, ROOT_
|
||
$550–650, CAMPS_ $250–350 — no specific "Winter Break Camp" named, no ROOT_ tier breakdown) that
|
||
do not match the exact fixed V1 prices Chase gave directly this phase. Chase confirmed the exact
|
||
fixed prices are the correct, current figures — **the live website has not yet been updated to
|
||
the real V1 pricing matrix.** This is the separate, not-RootNode-owned website repo; updating it
|
||
is outside this repo's scope, noted here only as a real discrepancy for Chase's own awareness.
|
||
|
||
## 1.5 File/artifact audit
|
||
|
||
Searched all tracked files for secret-shaped filenames (`.env*`, `.local`, `credential`,
|
||
`secret`, `.key`, `.pem`, `.p12`, service-account JSON). Every match is a legitimate
|
||
template/placeholder or educational-content reference, never a real runtime secret:
|
||
|
||
- Course content (`content/root/root-07-.../m02-configuration-and-secrets/`) — teaching material
|
||
about Kubernetes Secrets, no real secret data.
|
||
- `infra/ansible/roles/*/templates/*.env.j2` — Ansible Jinja2 templates referencing
|
||
`{{ vault_* }}` variables (values live in an Ansible Vault-encrypted file, never plaintext in
|
||
git).
|
||
- `infra/environments/{production,staging}/*.env.template` — checked-in templates with explicit
|
||
`__REPLACE_WITH_...__`/`__REPLACE_openssl_rand_hex_32__` placeholders, never real values.
|
||
- `platform/provisioner/.env.example`, migration `017_student_credentials.sql` (schema, not
|
||
data), `scenarios/data/*secret*.json` (fake Kubernetes lab-scenario fixtures).
|
||
|
||
`.gitignore` correctly excludes `.env` (blanket pattern) — confirmed via `git status
|
||
--porcelain --ignored`: `platform/.env` and `platform/provisioner/.env` (both containing real
|
||
local secrets) are ignored, never tracked.
|
||
|
||
## 1.6 Secret history audit
|
||
|
||
Searched the **entire** git history (`git log --all -p`, pickaxe search `-S`) for:
|
||
`sk_test_`, `sk_live_`, `whsec_`, `BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY`, `"private_key"`,
|
||
and a broad regex for any `sk_test_`/`sk_live_`/`whsec_`-prefixed string of realistic secret
|
||
length (20+ trailing characters).
|
||
|
||
**Result: clean. No real secret value has ever been committed.** Every `sk_test_`/`sk_live_`/
|
||
`whsec_` hit is a code guard-clause literal (e.g. `.startsWith('sk_test_')`) or documentation
|
||
prose referencing the prefix pattern, from this session's own Phase 9.1 commits — never a full
|
||
key. The one `"private_key"` hit (`b38c46a`, Phase 5C) is a code comment showing an EXAMPLE
|
||
env-var invocation with a `"..."` placeholder, not a real value. No `BEGIN PRIVATE KEY`/`BEGIN
|
||
RSA PRIVATE KEY` header appears anywhere in history. **No credential rotation is required.**
|
||
|
||
## 1.7 Current runtime secret state (this workstation)
|
||
|
||
`platform/.env` (gitignored, never committed) holds real local-dev values for
|
||
`PROVISIONER_SHARED_SECRET`, `INTEGRATION_SHARED_SECRET`, `GOOGLE_SERVICE_ACCOUNT_JSON`,
|
||
`EMAIL_FROM_ADDRESS`, `GOOGLE_DELEGATED_USER` — all pre-existing from earlier phases. Its
|
||
`PAYMENT_PROVIDER`/`STRIPE_SECRET_KEY`/`STRIPE_WEBHOOK_SECRET` lines are present but **blank**,
|
||
per this repo's own "set only for a deliberate session, unset again after" convention (matching
|
||
`EMAIL_PROVIDER`'s established pattern) — confirmed after Phase 9.1's real-Stripe validation
|
||
session ended. See `docs/SECRETS_AND_INFISICAL.md` for the full inventory and centralization
|
||
status.
|
||
|
||
## Discrepancies found
|
||
|
||
1. **The original "Phase 9.5" has no canonical commit** — see §1.4. The complete approved matrix
|
||
was recovered from the synced RootNode Academy conversation and canonicalized in
|
||
`docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. PC #2 inspection remains useful only to detect an
|
||
earlier local copy or commit and compare it for material differences.
|
||
2. **Chase's Phase 10.1 authorization states RootNode Academy "ALREADY EXISTS" as an Infisical
|
||
project** on `infisical.cedshomelab.com`. Re-investigated in Phase 10.1 with a proper
|
||
org-scoped API enumeration (`GET /api/v2/organizations/{orgId}/workspaces`, not just the
|
||
CLI's interactive picker, which turned out to be incomplete — it showed 6 projects in Phase
|
||
10, the API shows 8 for the same identity). **Still no project named "RootNode Academy" (or
|
||
similar) is visible to this machine identity** even with the more complete method — the
|
||
full, real list is: Core Infrastructure, Kubernetes, Media Platform, Monitoring, Network
|
||
Service, Privileged Access Manager, Storage, Synthos Systems. **Root cause is now narrowed,
|
||
not fully resolved**: this machine identity's own project list only shows projects it has
|
||
been explicitly granted access to (standard Infisical per-project ACL, separate from org
|
||
membership) — so the most likely explanation is that "RootNode Academy" exists but this
|
||
identity was never added to it, not that it doesn't exist. This cannot be distinguished from
|
||
here without either org-owner-level API access or the web dashboard, neither available to
|
||
this session. **No duplicate project was created.** See `docs/SECRETS_AND_INFISICAL.md` for
|
||
the exact one-line fix (grant the `claude-code-migration` identity access to the existing
|
||
project via its Project Settings → Access page).
|
||
3. **No dedicated production server/Proxmox VM has been provisioned** — `infra/terraform/` has
|
||
no `terraform.tfvars` (only `.example`) and no state file; `infra/ansible/group_vars/
|
||
production.yml` still holds literal placeholders (`__PLATFORM_VM_IP__`,
|
||
`__LAB_HOST_VM_IP__`, `__PROXMOX_HOST_MGMT_CIDR__`). See `docs/
|
||
PHASE10_PRODUCTION_DEPLOYMENT.md`.
|
||
|
||
## Remediation performed
|
||
|
||
The complete founder-approved Phase 9.5 matrix was recovered from synced conversation history
|
||
and written to `docs/ROOTNODE_PRICING_AND_OFFERS_V1.md`. This audit was corrected to distinguish
|
||
the missing original Phase 9.5 commit from the now-recovered pricing decision. No existing Git
|
||
history was rewritten.
|
||
|
||
## Conclusion
|
||
|
||
**Canonical Gitea history through Phase 10.1 is internally consistent, fully verified against
|
||
every claimed milestone, and free of any committed secret.** The Phase 9.5 pricing matrix has
|
||
now been recovered locally from synced conversation history and awaits review/commit. The only
|
||
remaining multi-PC item is running the PC #2 commands in §1.3 to positively rule out stranded
|
||
local work or identify an earlier Phase 9.5 copy for comparison.
|