IAM/Profile Clean Compose Smoke

Scope

This smoke proves the IAM/Profile runtime slice on a clean, isolated Docker Compose project. It starts service-owned Postgres databases, runs IAM/Profile migrations, boots iam-service and profile-service, and verifies the real HTTP health/readiness/JWKS endpoints.

This is clean-runtime evidence only. It does not approve default /api/auth*, profile, or KYC route promotion.

Run

Parser/self-test:

cd go-platform
IAM_PROFILE_CLEAN_COMPOSE_SELF_TEST=1 make test-iam-profile-clean-compose

Live clean Compose smoke:

cd go-platform
IAM_PROFILE_CLEAN_COMPOSE_CONFIRM=clean-runtime \
IAM_PROFILE_HOST_POSTGRES_PORT=55435 \
IAM_PROFILE_HOST_IAM_PORT=18081 \
IAM_PROFILE_HOST_PROFILE_PORT=18082 \
IAM_PROFILE_CLEAN_COMPOSE_ARTIFACT_DIR=output/qa/iam-profile-clean-compose-$(date +%Y%m%d-%H%M%S) \
make test-iam-profile-clean-compose

When the IAM/Profile/migrator images already exist locally, avoid a network image build by using local-image mode:

cd go-platform
IAM_PROFILE_CLEAN_COMPOSE_CONFIRM=clean-runtime \
IAM_PROFILE_CLEAN_COMPOSE_USE_LOCAL_IMAGES=1 \
IAM_PROFILE_IAM_IMAGE=hoctapaz/iam-service:local \
IAM_PROFILE_PROFILE_IMAGE=hoctapaz/profile-service:local \
IAM_PROFILE_MIGRATOR_IMAGE=hoctapaz/migrator:local \
IAM_PROFILE_HOST_POSTGRES_PORT=55435 \
IAM_PROFILE_HOST_IAM_PORT=18081 \
IAM_PROFILE_HOST_PROFILE_PORT=18082 \
IAM_PROFILE_CLEAN_COMPOSE_TIMEOUT=240 \
IAM_PROFILE_CLEAN_COMPOSE_ARTIFACT_DIR=output/qa/iam-profile-clean-compose-$(date +%Y%m%d-%H%M%S) \
make test-iam-profile-clean-compose

The script removes the isolated Compose project and volumes by default. Set IAM_PROFILE_CLEAN_COMPOSE_KEEP=1 only when debugging a failed run.

Latest Local Proof

On 2026-07-10, the build-mode clean Compose smoke passed with artifacts under:

output/qa/iam-profile-clean-compose-20260710-1555/

Artifact files:

• iam-health.json
• iam-ready.json
• iam-jwks.json
• profile-health.json
• profile-ready.json
• iam-service-migrations.status
• profile-service-migrations.status
• iam-profile-ports.override.yml

The run used:

• Docker Compose build mode for IAM, Profile, and migrator images
• Host ports 5543, 18081, and 18082
• Compose project hoctapaz-iam-profile-clean-20260710

The captured status files recorded:

• iam-service-migrations exited 0
• profile-service-migrations exited 0

The captured HTTP responses recorded:

• IAM /healthz: service=iam-service, status=ok, goVersion=go1.22.12
• IAM /readyz: service=iam-service, status=ready, checks.self=ok
• IAM JWKS: meta.status=symmetric-signing-compatibility
• Profile /healthz: service=profile-service, status=ok, goVersion=go1.22.12
• Profile /readyz: service=profile-service, status=ready, checks.self=ok

The command built the images in the isolated project, then removed the project, containers, network, and Postgres volume after the pass. The port/volume preflight confirmed no smoke resources remained afterward.

The earlier local-image/no-build proof remains useful when registry access is unavailable, but the latest evidence above proves the normal Compose build path on the current source tree.

Cutover Boundary

Use this smoke as clean service-runtime and migration-ordering evidence only. Default route promotion still requires production-like populated target validation with the captured backfill run report, UUID readiness/FK/promotion checks on the same target DSNs, gateway/browser proof through api-gateway, and rollback evidence.