feat: deploy polish — GCSG_ namespace, journald priorities, complete module #9

Merged

synapse merged 2 commits from feat/deploy-polish into develop

2026-08-21 19:24:26 +00:00

synapse commented

2026-08-21 18:36:55 +00:00

Owner

Implements the deploy-polish OpenSpec change — the four rough edges found in pre-deployment review, all operator-raised:

GCSG_ config namespace (was generic GATEWAY_*): total rename, zero stragglers, done at the last possible free moment (nothing deployed).
Truthful log levels (the tuwunel problem): under systemd, records now go to journald natively via tracing-journald — journalctl -p err/-p warning actually filter. Verified live in a transient unit (provoked warn visible at -p warning, -p err empty) and asserted in the VM e2e via a priority-5 info record, which stdout-text logging cannot produce. Dev terminals keep readable text. Note: tracing-journald's real mapping is info→5/debug→6 (spec corrected to reality during verification).
Module completeness: logLevel / upstreamTimeoutSeconds / staleMaxAgeSeconds options added — every binary knob reachable; VM test runs non-defaults of all three.
Configuration & Deployment book page: full env/option reference, copy-able NixOS example, production token recipe including GoatCounter's CLI permission gap (bit 64 — confirmed in upstream source, tracked for upstream contribution as issue j0p), journalctl + metrics guidance. Written for strangers.

Full gate green including the new VM assertions.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

Implements the `deploy-polish` OpenSpec change — the four rough edges found in pre-deployment review, all operator-raised: 1. **`GCSG_` config namespace** (was generic `GATEWAY_*`): total rename, zero stragglers, done at the last possible free moment (nothing deployed). 2. **Truthful log levels** (the tuwunel problem): under systemd, records now go to journald natively via tracing-journald — `journalctl -p err/-p warning` actually filter. Verified live in a transient unit (provoked warn visible at -p warning, -p err empty) and asserted in the VM e2e via a priority-5 info record, which stdout-text logging cannot produce. Dev terminals keep readable text. Note: tracing-journald's real mapping is info→5/debug→6 (spec corrected to reality during verification). 3. **Module completeness**: logLevel / upstreamTimeoutSeconds / staleMaxAgeSeconds options added — every binary knob reachable; VM test runs non-defaults of all three. 4. **Configuration & Deployment book page**: full env/option reference, copy-able NixOS example, production token recipe including GoatCounter's CLI permission gap (bit 64 — confirmed in upstream source, tracked for upstream contribution as issue j0p), journalctl + metrics guidance. Written for strangers. Full gate green including the new VM assertions. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse added 1 commit

2026-08-21 18:36:55 +00:00

feat: deploy polish — GCSG_ namespace, native journald priorities, complete module

ci / gate (pull_request) Failing after 54s

Details

831b660fca

- env vars renamed GATEWAY_* -> GCSG_* everywhere (pre-deployment, no
  migration burden); grep-verified zero stragglers
- tracing-journald under systemd (JOURNAL_STREAM detection): error->3,
  warn->4, info->5, debug->6 — journalctl -p filters truthfully now
  (verified live in a transient unit and asserted in the VM test via a
  priority-5 record, impossible for stdout text)
- module options logLevel / upstreamTimeoutSeconds / staleMaxAgeSeconds:
  every binary knob reachable; VM test sets non-defaults to prove wiring
- book: Configuration & Deployment page (full reference, NixOS example,
  prod token recipe incl. the upstream CLI bit-64 gap)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse added 1 commit

2026-08-21 19:21:29 +00:00

fix: allow AF_UNIX in the unit sandbox — journald needs it

ci / gate (pull_request) Successful in 23s

Details

3ce96a6032

RestrictAddressFamilies=[AF_INET,AF_INET6] made the native journald
layer die with EAFNOSUPPORT and silently fall back to stdout text,
flattening log priorities — exactly what the VM test's priority-5
assertion exists to catch (and did, in CI). systemd-run verification
missed it because transient units carry no sandbox.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T5j3dAJVcUjZv9k76sRTt9

synapse merged commit 6b18355531 into develop

2026-08-21 19:24:26 +00:00

synapse deleted branch feat/deploy-polish

2026-08-21 19:24:26 +00:00

synapse referenced this pull request from a commit

2026-08-21 19:24:27 +00:00

Merge pull request 'feat: deploy polish — GCSG_ namespace, journald priorities, complete module' (#9) from feat/deploy-polish into develop