chore(cutover): add legacy import copy helper #581

Merged

pdurlej merged 1 commit from codex/m01-legacy-import-copy-helper into main

2026-05-28 23:28:56 +02:00

codex commented

2026-05-28 23:27:05 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Adds an operator-run helper for preparing conservative /opt/pdurlej-platform/runtime/legacy-import copies before M01 service remount PRs.

This is intentionally a tool, not a runtime action. It defaults to dry-run, requires --yes for writes, supports --path for one service/family at a time, and never deletes or renames legacy paths.

What changed

Added scripts/cutover/prepare-legacy-import.sh.
Documented the dry-run/apply usage in scripts/cutover/README.md.
The helper covers the known live legacy bind-mount path set observed on RS2000.
It preserves ownership, modes, links, timestamps, ACLs, and xattrs where supported via rsync -aHAX --numeric-ids.

Safety

Dry-run by default.
--yes required for writes.
No delete, rename, quarantine, chmod sweep, restart, or compose/apply call.
No file contents printed.
--path allows small controlled batches instead of copying the whole legacy tree.
Hard-coded M01 roots prevent accidental broad path use:
- source: /opt/vps-home-platform-infra
- target: /opt/pdurlej-platform/runtime/legacy-import

Validation

bash -n scripts/cutover/prepare-legacy-import.sh => pass
scripts/cutover/prepare-legacy-import.sh --dry-run --path config/ntfy/server.yml on local Mac => safe SKIP for missing source
UV_CACHE_DIR=/private/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json => exit 0
git diff --check => pass

RS2000 read-only observation

A read-only SSH check showed:

/opt/pdurlej-platform/runtime/legacy-import exists.
env, config/integrations, and data/integrations already exist under the target.
Remaining legacy mounts still include product/config/data families such as OpenClaw mail config, Matrix, NP, Shelfmark, Traefik, Honcho init config, CoreDNS, ntfy, Vault, and audio/signal state.

No secret values or private file contents were collected.

Spec sources read

state/cutover/rs2000-live-data-config-migration.md
state/cutover/rs2000-post-soak-legacy-cleanup.md
scripts/cutover/README.md
scripts/cutover/backup-before-apply.sh
read-only RS2000 mount summary

Non-goals

Does not run the copy on RS2000.
Does not update Compose mounts.
Does not restart services.
Does not delete or quarantine legacy paths.
Does not claim DR/restore freshness.

Canary status: missing - fire canary 3+3 manually before merge ## Summary Adds an operator-run helper for preparing conservative `/opt/pdurlej-platform/runtime/legacy-import` copies before M01 service remount PRs. This is intentionally a tool, not a runtime action. It defaults to dry-run, requires `--yes` for writes, supports `--path` for one service/family at a time, and never deletes or renames legacy paths. ## What changed - Added `scripts/cutover/prepare-legacy-import.sh`. - Documented the dry-run/apply usage in `scripts/cutover/README.md`. - The helper covers the known live legacy bind-mount path set observed on RS2000. - It preserves ownership, modes, links, timestamps, ACLs, and xattrs where supported via `rsync -aHAX --numeric-ids`. ## Safety - Dry-run by default. - `--yes` required for writes. - No delete, rename, quarantine, chmod sweep, restart, or compose/apply call. - No file contents printed. - `--path` allows small controlled batches instead of copying the whole legacy tree. - Hard-coded M01 roots prevent accidental broad path use: - source: `/opt/vps-home-platform-infra` - target: `/opt/pdurlej-platform/runtime/legacy-import` ## Validation - `bash -n scripts/cutover/prepare-legacy-import.sh` => pass - `scripts/cutover/prepare-legacy-import.sh --dry-run --path config/ntfy/server.yml` on local Mac => safe SKIP for missing source - `UV_CACHE_DIR=/private/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` => exit 0 - `git diff --check` => pass ## RS2000 read-only observation A read-only SSH check showed: - `/opt/pdurlej-platform/runtime/legacy-import` exists. - `env`, `config/integrations`, and `data/integrations` already exist under the target. - Remaining legacy mounts still include product/config/data families such as OpenClaw mail config, Matrix, NP, Shelfmark, Traefik, Honcho init config, CoreDNS, ntfy, Vault, and audio/signal state. No secret values or private file contents were collected. ## Spec sources read - `state/cutover/rs2000-live-data-config-migration.md` - `state/cutover/rs2000-post-soak-legacy-cleanup.md` - `scripts/cutover/README.md` - `scripts/cutover/backup-before-apply.sh` - read-only RS2000 mount summary ## Non-goals - Does not run the copy on RS2000. - Does not update Compose mounts. - Does not restart services. - Does not delete or quarantine legacy paths. - Does not claim DR/restore freshness.

codex added this to the 01 - RS2000 closeout and legacy cleanup milestone

2026-05-28 23:27:05 +02:00

codex added the

cutover-gate

phase/03

class/security-sensitive

labels