PR B: make provisioning master the single source of truth (recreate prod & test deliberately)

[rdhyee]

Why: The 6/17 cutover deployed prod from feature/prod-green (never merged); test's full 4.2 config likewise sits on unmerged branches. Result: master cannot describe either machine, and every --tags config deploy from master partially rolls back the cutover — the exact mechanism of the 6/26 silent Beat-schedule revert (#37, Gluejar/regluit#1140, fixed by #55). Consensus scope from the 2026-07-01 analysis session (CC + Codex converged; RY approved).

Goal

After this work: one command sequence, from provisioning master, on a fresh Ubuntu 24.04 box + fresh prod-snapshot RDS → a working unglue.it. Master recreates reality deliberately; every intended environment difference is a named variable; anything else is drift.

Scope

1. Master ↔ prod template parity (beyond Restore the 2026-06-11 Beat decision under Celery-5 setting names (fixes the silent 6/26 revert) #55's settings fix): reconcile every rendered file; acceptance: setup-prod.yml --check --diff against prod ≈ no-op (modulo timestamps).
2. Test config into master: fold the unmerged 4.2 test provisioning (feature/prod-green d45b0cd/354a1e0 lineage) into master with explicit group_vars/test.
3. Deliberate-delta table for test (each a named group_var, documented): own RDS (never prod — Restore the 2026-06-11 Beat decision under Celery-5 setting names (fixes the silent 6/26 revert) #55's guard enforces), outbound-email squelch (disable_admin_emails is NOT sufficient; test DB = prod snapshot with real user addresses), Beat schedule empty (deploy_type), test cert/DNS, smaller instance.
4. App-branch mode switch documented: test defaults to app git_branch: master (staging gate for the release queue). Flipping to git_branch: production = byte-faithful prod-rehearsal mode; the flip must be intentional, visible, and verified after deploy.
5. 24.04 bootstrap fix: setup-prod.yml still raw-installs python3.8 — dead on Ubuntu 24.04; a from-scratch build fails at task 1.
6. Kill list (close/supersede/delete once parity is proven): PRs Infrastructure cutover for Django 4.2 / Python 3.12 + security remediation #25, Fix duplicate refresh_acqs key in prod Beat schedule #38, pip: --exists-action=w so editable-checkout conflicts never hang deploys #39; branches feature/prod-green, feature/maintenance-mode; app repo branch test.unglue.it (stale 1.11-era, 12 ahead/69 behind, inert but a booby trap).
7. Acceptance gate = OOM hardening: activate mod_wsgi daemon mode on prod (+ reproducible-from-scratch staging) #45's criterion, run on TEST first: tear down test.unglue.it, rebuild entirely from master + explicit test vars, restore fresh prod snapshot, smoke. Zero prod risk; scripts the manual infra steps (EC2/RDS/DNS/cert) as they're performed. Only after this passes does test-first become standing policy for config changes.

Sequencing

#55 (restore Beat decision) → deploy + verify on prod → this issue → test teardown/rebuild proof → test-first policy.

Refs: #45 (from-scratch acceptance criterion), #55, #37, #38, #25, #39, Gluejar/regluit#1140, Gluejar/regluit#1171 (the app-repo precedent this mirrors).

🤖 Generated with Claude Code

https://claude.ai/code/session_017f8mDXQDLfw3A34ynseDyc

[rdhyee]

Codex formal scope review: needs-changes → scope amended below (4 findings, all repo-verified):

1. Add: full-provision entrypoint for test — setup-prod.yml is hardcoded to regluit-prod; deploy.yml is code-only by design. The teardown/rebuild acceptance gate requires a setup-test.yml or a parameterized full playbook. Without it, item 7 is not executable from master.
2. Broaden item 5: not just the raw python3.8 bootstrap — the role also hardcodes py3.8-era venv paths and dead package names (python-dev, mysql-client). Scope = the entire full-provision path works on Ubuntu 24.04. Much of this exists in Infrastructure cutover for Django 4.2 / Python 3.12 + security remediation #25's feature/parameterize-python-version branch → port selectively.
3. Clarify items 2/6: feature/prod-green is NOT an ancestor of master and is older than the OOM/monitoring/dump work — never merge it wholesale; port needed lineage selectively, then delete.
4. Sharpen item 3: outbound-email squelch needs a named mechanism (console/file email backend, or test-only creds with SES send-deny) plus an acceptance smoke check — disable_admin_emails only empties ADMINS; all normal outbound paths remain live against a prod-snapshot DB of real addresses.

Sequencing amendment implied by (1): B0 = drift audit (setup-prod.yml --check --diff vs prod — safe now that all secret-rendering tasks are no_log) → B1 prod template parity → B2 test config + email squelch + setup-test entrypoint → B3 full 24.04 provision path (port from #25) → B4 kill list (only after B1–B3 prove master carries everything) → acceptance: --check --diff ≈ no-op + test teardown/rebuild (#45).

Provenance: CC (Fable 5) authored scope; Codex (gpt-5.x) formal review against the repo; both AI outputs empirically spot-checked per the session's tiebreak discipline.