This overview is for an authorized operator of Lanning source tag v0.2.0. Use it to review deployment prerequisites and diagnose the failing boundary. The qualification used a tagged source build and disposable development services; it does not certify a production deployment, real user account or full cross-store disaster-recovery rehearsal. The availability guide states which domain workflows remain unmounted or unqualified.
Establish the deployment identity
Record the application binary hash, source/release identifier, contract identity, database migration head and dependency versions. Keep server and worker builds aligned. An operator needs approved PostgreSQL, Geode, object storage and ThreadID services, a reviewed TLS/egress policy and tenant/namespace assignments.
The tagged executable is sonny-upstream. Its registered commands include
serve, worker, migrate, import, reconcile, capability-check and
retrieval-tombstone. They are not commands added to the Sonny client. This
release does not implement sonny-upstream --version; use the build/contract
identity supplied with the authorized artifact and exposed by the deployment.
The process validates shared configuration before invoking a command’s
operation. An empty environment made even capability-check and migrate version
refuse with missing SONNY_UPSTREAM_OIDC_AUDIENCE. Supplying only a Geode or
migration DSN does not establish a complete command environment.
Review configuration by purpose
| Purpose | Tagged configuration contract |
|---|---|
| Listener and TLS | SONNY_UPSTREAM_HTTP_ADDR defaults to 0.0.0.0:8080; serve requires the configured TLS certificate/key pair. |
| Verified identity | OIDC issuer, discovery URL, client ID/secret, PAM base URL, audience and trusted-issuer mapping. Configure the resource’s actual approved values, not tutorial credentials. |
| Security events | SONNY_UPSTREAM_OIDC_SET_AUDIENCE is a separate receiver audience. An API audience is not an implicit grant to submit revocation events. |
| PostgreSQL runtime | SONNY_UPSTREAM_POSTGRES_DSN uses the least-privilege runtime role. It must not own tenant tables or bypass row-level security. |
| Migrations | SONNY_UPSTREAM_POSTGRES_MIGRATE_DSN is a separate schema-owner authority required by migration operations, not an extra credential to give the serving process. |
| Geode | SONNY_UPSTREAM_GEODE_DSN and capability/profile compatibility; the graph setting defaults to sonny. |
| Objects and encryption | Endpoint, bucket, account access, encryption/master-key handling and separately administered key recovery. A database dump alone is insufficient. |
| Retrieval | Disabled by default. Platform tenant, admitted adapters, tenant policy and quotas are additional requirements; the tag’s empty production adapter registry remains a blocker to a useful retrieval workflow. |
The qualified tag retains SONNY_UPSTREAM_* names. Production rejects the
development secrets checked by its loader; non-development modes reject insecure
identity options. The local test stack uses
explicit development exceptions and reduced PostgreSQL crash durability; those
settings are not production deployment advice or proof of crash recovery.
Separate health, readiness and authorization
Liveness means the process can answer its shallow probe. Readiness also depends on the required capability/profile and services. A live process can therefore be unready. Inspect startup/readiness diagnostics and identify the failing store, identity configuration or capability requirement before changing policy.
The common version/contract route is authenticated in this tag. An unauthenticated probe is not a valid version lookup. Generated routes and client methods must also be mounted by the serving build; a successful storage migration does not make every schema name a usable API.
Distinguish acceptance, execution and recovery
For an available operation that returns a job identifier, retain it and inspect the operation’s supported state/result interface. Acceptance is not completion. The job foundation uses fenced attempts, heartbeats, bounded retry budgets, cancellation and idempotent finalization. Recovery must respect the attempt and lease; manually repeating a request can have a different effect from resuming it.
The transactional outbox provides at-least-once projection with idempotent handlers. Consumers need their event identity and deduplication policy. Exhausted or parked work needs inspection and deliberate operator recovery; it is not evidence that an event was delivered exactly once. A foundation test does not establish that every proposed domain handler or external event stream is shipped.
Quotas are server-side controls, not model suggestions. Review the dimensions exposed by your release: the tagged generic admin quota API covers six dimensions, while additional retrieval dimensions have separate provisioning requirements. A missing configured retrieval ceiling can refuse a call rather than mean unlimited/free access. Inspect the actual policy and audit identity.
Back up an administered service
Treat PostgreSQL, Geode, objects, encryption/key references and dependency versions as a coordinated recovery set. Decide the recovery point, pause/drain policy, legal-hold handling, acceptable loss and a separate restore target before taking or replacing data. Record and verify a manifest; independent uncoordinated copies can restore references to objects they do not contain.
The tagged PostgreSQL backup path requires a separately provisioned, read-only RLS-exempt backup role. The runtime role is intentionally insufficient, and the schema owner is not an interchangeable backup identity under FORCE RLS. Keep passwords out of DSN arguments; the backup contract separates the DSN and password input. Registration of the production backup identity is an operator prerequisite, not a side effect of running migrations.
Geode backup requires verified TLS and a readable CA certificate. The tagged integration snapshot test failed at that prerequisite: its constructed environment did not provide the CA file required by the backup script. PostgreSQL capture/recovery passed, but that result does not establish a complete cross-store snapshot. Provision the authorized backup environment and validate the full manifest before relying on it; do not bypass certificate verification.
Restore only into an explicitly owned recovery environment using the authorized release procedure. That procedure restores objects and Geode before making PostgreSQL pointers authoritative, checks recorded digests/pointer ordering, restores grants/FORCE RLS and requires a measured verification drill. It can alter cluster roles and whole-store contents. The ordinary integration harness’s database isolation is insufficient authority to run that replacement against shared stores, so its guarded backup tests do not certify the full restore.
Retention, deletion and upgrades
Agree on retention and legal holds before publishing team material. Deleting a row, tombstoning an item, purging a derived cache, removing an object and expiring backups are different operations. Check their supported status/evidence and the remaining copies; do not promise immediate erasure across exports or replicas.
Apply the release’s migration plan with its owner authority and a verified recovery set. v0.2.0 adds retrieval migrations 1200–1206; the tagged upgrade notes place prerequisites on enabling retrieval and warn about state-dependent rollback limits. Do not run a downgrade merely because a down file exists.
A migration/version change is separate from the later product rename. Preserve environment keys, roles, volumes and data until the authorized migration procedure explicitly changes them. Continue with Lanning’s service boundaries , local Memory and mesh operations .