# Deployment preflight

This package records the Phase 0.6 / readiness B7 deployment contract and runs only read-only probes. It does not deploy, mutate configuration, create objects, query customer data, or print secret values.

## Validate the contract

```sh
python3 infra/preflight/validate_contract.py
```

Validation is local and performs no network access.

## Run probes

```sh
python3 infra/preflight/probe.py --output /path/to/redacted-preflight.json
```

A complete run may set these inputs:

- `PDF2HTML_API_HEALTH_URL`: safe API readiness URL on `api.press.zone`.
- `PDF2HTML_API_CORS_PROBE_URL`: safe endpoint that supports an `OPTIONS` preflight.
- `PDF2HTML_WORKER_EVIDENCE`: redacted worker evidence JSON.
- `PDF2HTML_POSTGRES_EVIDENCE`: redacted evidence from a read-only `@platform-modules/db` connectivity probe.
- `PDF2HTML_S3_LIFECYCLE_EVIDENCE`: redacted evidence that the private bucket and both 48-hour lifecycle paths were verified.
- the required secret names in `deployment-contract.json`; only presence is inspected, never values.

Missing input, inaccessible infrastructure, or absent evidence reports `BLOCKED`. It never becomes an inferred `PASS`. An HTTP error or contradictory evidence reports `FAIL`.

Evidence files imported by an `evidence` probe must use a parseable UTC timestamp no more than 24 hours old (with at most five minutes of future clock skew), the probe's exact read-only method, and all contract assertions:

- `cloudpanel-worker`: method `read-only health/status inspection`; `{"separate_process": true}`.
- `postgres-platform-db`: method `read-only @platform-modules/db connectivity probe`; `{"connected": true, "access": "@platform-modules/db"}`.
- `private-s3-lifecycle`: method `read-only bucket policy and lifecycle inspection`; `{"private": true, "source_ttl_hours": 48, "zip_ttl_hours": 48}`.

For example:

```json
{
  "probe_id": "cloudpanel-worker",
  "status": "PASS",
  "checked_at": "2026-08-23T12:00:00Z",
  "method": "read-only health/status inspection",
  "assertions": {"separate_process": true}
}
```

Evidence must contain only redacted assertions. Do not include connection strings, headers, cookies, object keys, private paths, response bodies, credentials, or secret values. The generated report records endpoint scheme/host/path and status metadata only; URL userinfo and query strings are removed.

`PASS` means the named layer was directly verified. `FAIL` means a direct check contradicted the contract. `BLOCKED` means access or sufficient evidence was unavailable.