Allow IAP SSH to reach the deploy controller

Allow IAP SSH to reach the deploy controller

Deploy story

What this commit did to the running system — joined from the forge receipt chain, the part a commit page elsewhere cannot show.

Not deployed through the forge lane

No push, promotion, build, or deploy receipt references this commit (receipts are scanned over a bounded recent window). Changes shipped by full node replacement carry their proof in the release gate receipt instead.

Changed files

modified infra/staging/main.tf
modified ops/production/preflight.sh
modified test/openagents/staging_candidate_contract_test.exs

Diff

3 files changed, +17 -3

  priority  = 900

  source_ranges = ["35.235.240.0/20"]
  target_tags   = ["openagents-staging-fleet"]
  target_tags   = ["openagents-staging-fleet", "openagents-staging-controller"]

  allow {
    protocol = "tcp"

  exit 1
fi

if [ "$git_sha" != "$(git rev-parse --verify refs/remotes/origin/main)" ]; then
  echo "production candidate must equal the fetched origin/main commit" >&2
if ! git merge-base --is-ancestor "$git_sha" refs/remotes/origin/main; then
  echo "production candidate must remain in the fetched origin/main history" >&2
  exit 1
fi


    assert outputs =~ ~s("openagents@${instance_ip}" => instance_name)
  end

  test "IAP SSH reaches the fleet and deploy controller" do
    terraform = File.read!("infra/staging/main.tf")

    assert terraform =~
             ~s(target_tags   = ["openagents-staging-fleet", "openagents-staging-controller"])
  end

  test "production preflight preserves a pinned candidate across later commits" do
    preflight = File.read!("ops/production/preflight.sh")

    assert preflight =~ ~s(git merge-base --is-ancestor "$git_sha" refs/remotes/origin/main)
    refute preflight =~ "production candidate must equal the fetched origin/main commit"
  end

  test "candidate publication binds exact immutable registry and artifact identities" do
    publisher = File.read!("ops/staging/publish-candidate.sh")
    sbom = File.read!("ops/staging/generate-sbom.sh")

200	200		`priority = 900`
201	201
202	202		`source_ranges = ["35.235.240.0/20"]`
203		-	`target_tags = ["openagents-staging-fleet"]`
	203	+	`target_tags = ["openagents-staging-fleet", "openagents-staging-controller"]`
204	204
205	205		`allow {`
206	206		`protocol = "tcp"`

41	41		`exit 1`
42	42		`fi`
43	43
44		-	`if [ "$git_sha" != "$(git rev-parse --verify refs/remotes/origin/main)" ]; then`
45		-	`echo "production candidate must equal the fetched origin/main commit" >&2`
	44	+	`if ! git merge-base --is-ancestor "$git_sha" refs/remotes/origin/main; then`
	45	+	`echo "production candidate must remain in the fetched origin/main history" >&2`
46	46		`exit 1`
47	47		`fi`
48	48

60	60		`assert outputs =~ ~s("openagents@${instance_ip}" => instance_name)`
61	61		`end`
62	62
	63	+	`test "IAP SSH reaches the fleet and deploy controller" do`
	64	+	`terraform = File.read!("infra/staging/main.tf")`
	65	+
	66	+	`assert terraform =~`
	67	+	`~s(target_tags = ["openagents-staging-fleet", "openagents-staging-controller"])`
	68	+	`end`
	69	+
	70	+	`test "production preflight preserves a pinned candidate across later commits" do`
	71	+	`preflight = File.read!("ops/production/preflight.sh")`
	72	+
	73	+	`assert preflight =~ ~s(git merge-base --is-ancestor "$git_sha" refs/remotes/origin/main)`
	74	+	`refute preflight =~ "production candidate must equal the fetched origin/main commit"`
	75	+	`end`
	76	+
63	77		`test "candidate publication binds exact immutable registry and artifact identities" do`
64	78		`publisher = File.read!("ops/staging/publish-candidate.sh")`
65	79		`sbom = File.read!("ops/staging/generate-sbom.sh")`