Infra pins
Dependencies and runtimes · terraform pins. On a deployment this row is a control; the demo shows the row with the reading its source supports.
Evidence
- Running
- terraform >= 1.10.0; aws ~> 5.40; random ~> 3.6
- Built
- as declared in deploy/aws/versions.tf; applied by the admin from the workstation, never by the platform
- Latest known
- pinned as declared; provider releases checked 3 days ago
- Source
- deploy/aws/versions.tf
- Checked
- 3 days ago
- Cadence
- every 14 days
- Mode
- guided
- State
- current
- Backup unit
- Terraform state, versioned in the state bucket (S3-native locking).
- Recovery
- Guided: apply the previous plan.
The five steps
Plan, back up, apply, verify, recover — in guided mode. On a deployment each step runs, is verified and lands on the audit trail; every component on the demo is current, so every step reads done.
- ✓ done Plan The workstation CLI attaches the terraform plan to the checklist; the screen shows every resource it would change and the provider versions it would move to; the admin confirms.
- ✓ done Back up The state bucket keeps every state version; the admin records the state serial the plan was made against and the screen verifies it against the backend.
- ✓ done Apply The admin runs terraform apply on the reviewed plan from the workstation; neither mode applies Terraform from the platform.
- ✓ done Verify The state serial advanced by one, the healthcheck is green, and the RDS engine and bucket settings read what the plan said.
- ✓ done Recover The admin applies the previous plan against the previous state version; the screen verifies the serial and the healthcheck again before showing recovered.
Every row behind this reading (10)
| Pin | Value | File |
|---|---|---|
| terraform required_version | >= 1.10.0 | deploy/aws/versions.tf |
| provider aws (hashicorp/aws) | ~> 5.40 | deploy/aws/versions.tf |
| provider random (hashicorp/random) | ~> 3.6 | deploy/aws/versions.tf |
| base image | python:3.12-slim (floating tag) | Dockerfile |
| RDS engine | postgres 16 | deploy/aws/rds.tf |
| RDS backup retention | var.db_backup_retention_days (default 1) | deploy/aws/variables.tf |
| S3 versioning: audit | Enabled | deploy/aws/s3_audit.tf |
| S3 versioning: psychotherapy | Enabled | deploy/aws/s3_psychotherapy.tf |
| S3 versioning: store | Enabled | deploy/aws/s3_store.tf |
| viewer image | ${PHI_AI_IMAGE:-phi-ai:dev} | docker-compose.yml |
History
Applies and recoveries of this row, from the update journal. On a deployment every apply and every recovery lands here as it completes.
No apply or recovery recorded for this row. The demo's journal holds one completed update, of Running image.
Acknowledge: keep as is until <date> because <reason> — on a deployment this line is a form, audited as system.component_acknowledged; the demo shows the words.