IAM/Profile Target Validation Smoke

Scope

This smoke proves that the populated IAM/Profile fixture can be validated as an already-loaded target through the same IAM/Profile owner DSNs. It chains:

• test-iam-profile-backfill-populated
• test-iam-profile-live-populated-validation
• test-iam-profile-uuid-primary-key-readiness
• test-iam-profile-uuid-foreign-key-validation
• test-iam-profile-uuid-primary-key-promotion

This is same-target fixture evidence only. It is stronger than a standalone loader artifact because all validation commands query the same live target databases, but it is still not production-like target evidence and does not approve default route promotion.

Run

Use a temporary populated fixture container, keep it alive for the validation commands, then remove it after the run:

cd go-platform
STAMP=$(date +%Y%m%d-%H%M%S)
CONTAINER=hoctapaz-iam-profile-target-validation-${STAMP}
PORT=55436
ARTIFACT_ROOT=output/qa/iam-profile-target-validation-${STAMP}
IAM_DSN=postgres://postgres:[email protected]:${PORT}/hoctapaz_iam_db?sslmode=disable
PROFILE_DSN=postgres://postgres:[email protected]:${PORT}/hoctapaz_profile_db?sslmode=disable

IAM_PROFILE_BACKFILL_POPULATED_CONFIRM=populated-fixture \
IAM_PROFILE_BACKFILL_POPULATED_KEEP=1 \
IAM_PROFILE_BACKFILL_POPULATED_CONTAINER=${CONTAINER} \
IAM_PROFILE_BACKFILL_POPULATED_POSTGRES_PORT=${PORT} \
IAM_PROFILE_BACKFILL_POPULATED_ARTIFACT_DIR=${ARTIFACT_ROOT}/backfill \
make test-iam-profile-backfill-populated

IAM_PROFILE_LIVE_VALIDATION_CONFIRM=live-populated \
IAM_PROFILE_LIVE_VALIDATION_RUN_REPORT=${PWD}/${ARTIFACT_ROOT}/backfill/backfill-run.json \
IAM_PROFILE_LIVE_VALIDATION_REQUIRE_RUN_REPORT=1 \
IAM_PROFILE_LIVE_VALIDATION_ARTIFACT_DIR=${ARTIFACT_ROOT}/live-validation \
IAM_DATABASE_URL=${IAM_DSN} \
PROFILE_DATABASE_URL=${PROFILE_DSN} \
make test-iam-profile-live-populated-validation

IAM_PROFILE_UUID_PK_READINESS_CONFIRM=uuid-primary-key-readiness \
IAM_PROFILE_UUID_PK_READINESS_ARTIFACT_DIR=${ARTIFACT_ROOT}/uuid-readiness \
IAM_DATABASE_URL=${IAM_DSN} \
PROFILE_DATABASE_URL=${PROFILE_DSN} \
make test-iam-profile-uuid-primary-key-readiness

IAM_PROFILE_UUID_FK_VALIDATION_CONFIRM=uuid-foreign-key-validation \
IAM_PROFILE_UUID_FK_VALIDATION_ARTIFACT_DIR=${ARTIFACT_ROOT}/uuid-fk-validation \
IAM_DATABASE_URL=${IAM_DSN} \
PROFILE_DATABASE_URL=${PROFILE_DSN} \
make test-iam-profile-uuid-foreign-key-validation

IAM_PROFILE_UUID_PK_PROMOTION_CONFIRM=uuid-primary-key-promotion \
IAM_PROFILE_UUID_PK_PROMOTION_ARTIFACT_DIR=${ARTIFACT_ROOT}/uuid-pk-promotion \
IAM_DATABASE_URL=${IAM_DSN} \
PROFILE_DATABASE_URL=${PROFILE_DSN} \
make test-iam-profile-uuid-primary-key-promotion

docker rm -f ${CONTAINER}

Latest Local Proof

On 2026-07-10, the same-target fixture chain passed with artifacts under:

output/qa/iam-profile-target-validation-20260710/

Artifact directories:

• backfill/
• live-validation/
• uuid-readiness/
• uuid-fk-validation/
• uuid-pk-promotion/

The run used the same live target DSNs for all validation commands:

• IAM: hoctapaz_iam_db
• Profile: hoctapaz_profile_db
• Host port: 55436

The temporary container hoctapaz-iam-profile-target-validation-20260710 was removed after validation.

Evidence Summary

live-validation/summary.json recorded:

• status=passed
• IAM baseRows=4, migrationIdMapRows=63, orphanReferences=0
• Profile baseRows=4, migrationIdMapRows=17, orphanReferences=0
• Required migrator run report status passed
• 22 postload-reconciliation items across iam-service and profile-service
• failures=[]

This is still fixture-only evidence. It proves the same-target loader and metadata chain locally, but it does not satisfy the production-like target provenance required for default route promotion.

uuid-readiness/summary.json recorded:

• status=passed
• IAM readiness rows: 81
• Profile readiness rows: 39
• IAM/Profile blocking issues: 0

uuid-fk-validation/summary.json recorded:

• status=passed
• IAM constraints: 26
• Profile constraints: 10
• Unvalidated constraints: 0

uuid-pk-promotion/summary.json recorded:

• status=passed
• IAM promoted UUID PK table rows: 21
• Profile promoted UUID PK table rows: 9
• Legacy text foreign keys remaining: 0
• UUID foreign-key issues remaining: 0

Cutover Boundary

Use this smoke as same-target fixture evidence for the loader, UUID metadata views, FK validation, and promoted UUID primary-key metadata. Default route promotion still requires the same commands against production-like populated target DSNs, gateway/browser proof through api-gateway, rollback evidence, and final text-id cleanup planning.