# Starter regional parity inventory

This inventory freezes the non-tenant regional opening contract used by the
Starter remote persona. It is review evidence, not a runtime checker. The
machine-readable companion snapshot is `SOURCE_EVIDENCE.yaml`; neither file
implements the cross-product staging synchronization workflow tracked
elsewhere.

## Evidence baseline

- `aws-shared-cd@57fa96f337548ce1b5c61834a33b38ef1c0ed4c0`
  - release branch `release-0.62`
  - `pool/eks-freetier/Pulumi.staging-us-east-1-f01.yaml`
  - `pool/eks-freetier/index.ts`
  - `pool/eks-freetier/serverless.ts`
- `aws-shared-provider@e49dba3de19c3461a6dc01eba4cdce3475c8de37`
  - release branch `release-0.78`
  - `cd/src/manager.ts`
  - `cd/src/tidb-gateway.ts`
  - `cd/projects/{manager,tidb-gateway,tidb-http-gateway}/Pulumi.staging.yaml`
  - `cd/manifests/tidb-worker/envs/staging-us-east-1-f01`
- `app-delivery@d4a4cb968a34bda2ef25af9ca9ffe67702422344`
  - branch `main`, frozen at the revision observed for this audit
  - the ApplicationSets and rendered environment paths listed below
- `qdrant-on-tidb@25441d2619a24e2a11d69dcb70a088c87d094eb4`
  - the selected staging AI gateway binary
- `qdrant-on-tidb@2ee48129c34611c6fbbfa4ea9462cbbe8fc624d5`
  - the selected staging FTS serving and index-update binaries
- live `staging-us-east-1-f01`: released ACS, both Starter agent CRs, and their
  VMAgent/Vector/operator workloads were verified read-only on 2026-07-27;
  Argo ownership revision remains unclaimed

The three deployment-code repositories above are authoritative for the areas
they own. The live cluster is a drift observation only: manual changes in live
staging do not redefine this contract. When source render and live state
disagree, Starter follows the frozen deployment-code render and records the
live difference separately. This snapshot does **not** claim that Argo CD had
already synchronized `app-delivery@3a2cc887`; that revision must be read from
the live Argo Application `status.sync.revision` after SSO is restored.

Kubernetes-version selectors are deliberately removed from the Starter
overlays. EKS version drift is the one infrastructure difference explicitly
excluded from this parity contract.

## Inventory

| Source area | Selected staging contract | Starter implementation | Classification |
|---|---|---|---|
| Regional AWS substrate | VPC, EKS, EBS CSI, VPC CNI, Redis, RDS, S3 and KMS | Session-owned Terraform resources except RDS; Starter reuses the Dev Full `premium-metadb` contract | Implemented session-isolation/development equivalent |
| Load balancing | AWS Load Balancer Controller `1.8.1`; retained regional Services use its NLB annotations | Exact chart/app version with session Pod Identity/default tags; every retained NLB Service has a unique session-prefixed name and cleanup tags | Implemented; chart-managed webhook TLS is a delivery equivalent until the certificate boundary is resolved |
| Network policy | Calico `v3.25.1` enforces the regional `NetworkPolicy` graph | Exact Tigera chart and EKS provider mode, with activation waiting for Calico node/controller rollout | Implemented |
| Resource metrics | release deployment selects metrics-server `0.6.1` to back HPA | Exact app version through chart `3.8.2`, one replica under the microservice reduction rule | Implemented |
| Kubernetes scaling | f01 custom cluster-autoscaler on Kubernetes 1.32 | Upstream cluster-autoscaler chart `9.46.6` / app `1.32.0`, one replica, session Pod Identity, source behavior flags, discovery tags and one-node scale-out headroom per role group | Implemented functional equivalent; private f01 cost expander is unnecessary for the one-step homogeneous role groups |
| Node health | f01 node-problem-detector image/config | Exact multi-architecture image and kernel condition/event contract as a privileged node DaemonSet | Implemented; Docker monitor omitted because Starter AL2023 nodes use containerd, and the source metrics Service is outside the retained ACS/agent contract |
| Certificate/secret delivery | cert-manager, AWS PCA issuer, external-secrets, and kubed config/secret syncer | CP9 directly creates short-lived session TLS Secrets and private-input Secrets | Explicitly approved delivery-equivalence allowlist |
| Regional ingress | ingress-nginx `4.12.0`; selected regional-service and ops-service use Nginx Ingress | Exact chart version and source proxy-protocol behavior, one replica, session-prefixed/tagged NLB; direct regional-service/ops NLB/ExternalName wiring remains the retained functional path | Implemented; microservice replica reduction and direct route delivery are approved equivalents |
| Service mesh | The selected `release-0.62` f01 config does not select Istio | No mesh control plane | Source-disabled, not a gap |
| Regional applications | cluster-proxy, ops-service, regional-service, TiDB worker scaler, manager, inner gateway, gateway-controller and HTTP gateway | Real immutable staging image or reviewed source-build contract | Implemented |
| Inner SQL gateway | `release-0.78` gateway binary, infra MySQL/RDS/cache/DynamoDB path, max idle 30s, SQL/backend TLS, dynamic config and Redis TLS | Same binary/config/feature/TLS paths with the shared Dev Full metadb, session table/cluster/cert values and one replica | Implemented session-isolation/development equivalent |
| Gateway controller | `release-0.78` controller config with TiDB `v7.5.6-serverless`, infra MySQL enabled, both TLS-only skip prefixes, kubelet source version and metering/O11y callers | Same controller contract; direct AWS DynamoDB replaces the source regional proxy endpoint, and compatibility-only callers terminate at the narrow stubs | Implemented session-isolation/exclusion equivalent |
| HTTP gateway | `release-0.78` TLS args plus Pulumi-injected component/log/secret args, two staging replicas | Same real binary and args with a session-owned secret and one reduced replica/resources | Implemented under microservice reduction rule |
| Meta plane | independent `serverless_rds` audit RDS and 100 GiB `serverless_infra` RDS plus meta-store/meta-service | Real binaries share one Dev Full `premium-metadb`; two Secrets Manager connection contracts select separate `serverless_rds` and `serverless_infra` databases | Implemented development equivalent; no Starter RDS |
| VPA | `tidb-vpa/vpa-agent` DaemonSet | Real immutable staging image | Implemented |
| Metering | server, worker, RCU controller, HAProxy and regional AWS resources | Narrow Pushgateway-compatible endpoint for the retained gateway traffic-metric writer, with a sanitized call ledger | Explicit exclusion implemented; unknown methods/paths fail closed |
| O11y | regional O11y controller, Vector, VictoriaMetrics/vmagent and global backend | Released ACS, KubernetesAgent and SharedPoolAgent drive real VMAgent/Vector against the session-owned shared metrics backend; after the parent Agent is Normal, manager provisions child records through the authenticated Global Server control route; the narrow reader stub remains for unrelated regional compatibility callers | Implementation added; fresh CP9 proof pending; logs backend not deployed |
| Root TiDB cluster | TiDB Operator, root PD/TiKV/TiDB, CRDs/RBAC and TLS | Real components and immutable images | Implemented |
| PD microservices | two TSO, two scheduler and two resource-manager replicas; each requests 500m/4 GiB and limits 4 CPU/4 GiB | Exact replicas, `20260507-c7b45...` images, resources and configs; EKS selector removed | Implemented |
| PD ops helper | `pd-ctl-runner` | Exact PD image and helper command with session placement/TLS | Implemented |
| Keyspace ETCD | three groups, three replicas per group; request 500m/4 GiB, limit 2 CPU/4 GiB | Exact groups, replicas, resources and storage | Implemented |
| Shared TiKV capacity | three primary `r8g.xlarge` partitions plus standby and witness, one replica each; `gp3-500` 1 TiB primary plus 30 GiB raft-db and 5 GiB raft-wal; zero-replica `r8g.2xlarge` hot template | Exact image, replicas, storage and kernel config; session node labels replace staging fleet labels | Implemented |
| TiKV helpers | TiKV worker, TiKV API and cop-worker with HPA/PDB/config/TLS | Exact immutable image and workload configs | Implemented |
| CSE encryption and maintenance | session KMS key/ciphertext plus cse-backup, cse-archive and cse-dfsgc | Session-owned encrypted-key equivalent, exact worker topology and immutable images | Implemented |
| Data import worker | load-data-worker ConfigMap and zero-replica StatefulSet template | Exact template, resources, storage, CSE/TLS and metering-client contract | Implemented |
| Data cleaner | staging datacleaner CronJob, exact image/ops/delay/TLS | Exact functional contract with session placement | Implemented |
| Schema and replication | schema-manager, replication-worker, replication PD and replication CDC | Real fixed topology and immutable images | Implemented |
| DM | DM master and zero-replica worker template | Real fixed topology and immutable image | Implemented |
| TiFlash columnar | one read-node replica, service and HPA | Exact image, resources, replica and storage | Implemented |
| TiDB serving pools | default, vip, super-vip, canary variants and export variants | Nine frozen lane configs/templates; source minima are zero and default/vip/super-vip maxima are one | Implemented; readiness covers every positive runtime replica rather than inventing prewarmed Pods |
| Import/export | staging import ConfigMap/SA and export Job template/SA | Frozen templates and exact Pod Identity subjects | Implemented |
| AI/FTS | AI gateway, FTS server/index CronJob, Qdrant snapshot service, S3/IRSA and DNS | Optional `starter.ai_fts.enabled` capability with exact staging binaries/topology, session S3, Pod Identity, TLS and public DNS | Implemented; disabled by default, fail-closed before cloud mutation when enabled |
| Optional Cassandra proxy | No `cassandra-proxy` config in the selected staging stack | Not deployed | Source-disabled, not a gap |
| Optional TiFlash manager/autoscaler | No selected `tiflash-manager` or `tiflash-autoscale` config | Not deployed | Source-disabled, not a gap |
| Metadata isolation | namespace-wide deny of EC2 instance metadata | Namespace-wide deny policy preserving all other egress | Implemented |
| Dynamic tenant graph | tenant Gateways, clusters, branches, CDC and other controller outputs | Created only by the functional proof | Acceptance output, not static input |

The exclusion stub contract is deliberately narrow. Manager's child O11y
provisioning follows staging through the authenticated Global Server control
route and does not use the stub. Retained O11y readers such as
gateway-controller may call the stub only at `GET /api/v1/query` or
`GET /api/v1/query_range`. Gateway Pods retain their normal Prometheus writer
and may call only `PUT /metrics/job/<job>/<label>/<value>...`. TiDB/TiKV metric
pushes continue to the real retained serverless meta service and are not part
of this exclusion. The stub records only method, path, query-key names, body
size/digest, contract version, and acceptance; it never records raw queries or
payloads. Unknown methods, paths, or malformed required fields return an error
and remain visible as rejected ledger entries.

## App-delivery ownership evidence

At the frozen `app-delivery` revision, these ApplicationSets explicitly select
the target cluster. Every selected path rendered successfully during the
audit. `targetRevision: HEAD` proves repository ownership but not the live
revision, so the last column remains unverified until the Argo Application
status is readable.

| ApplicationSet | Environment path | Destination | Primary owned workload/image | Live Argo revision |
|---|---|---|---|---|
| `vpa-agent` | `vpa-agent/envs/staging-us-east-1-f01` | `tidb-vpa` | DaemonSet `vpa-agent`; `vpa-agent:b004fee...` | Blocked |
| `tidb-worker` | `tidb-worker/envs/staging-us-east-1-f01` | `tidb-worker` | Deployment `scaler`; `tidb-worker:release-0.78-73aadde...` and `scaler-config` | Blocked |
| `serverless-meta-service` | `serverless-meta-service/envs/staging-us-east-1-f01` | `tidb-admin` | Deployment `serverless-meta-server`; `serverless-metering:c2397c...` | Blocked |
| `serverless-meta-store` | `serverless-meta-store/envs/staging-us-east-1-f01` | `tidb-admin` | Deployment `meta-store`; `meta-server:e228f9...` | Blocked |
| `serverless-ops-service` | `serverless-ops-service/envs/staging-us-east-1-f01` | `tidb-admin` | Deployment `ops-service`; `ops-service:f97d83...` | Blocked |
| `serverless-regional-service` | `serverless-regional-service/envs/staging-aws-us-east-1` | `tidb-management-service` | Deployment `new-serverless-regional-service`; `serverless-staging-32a858...` | Blocked |
| `serverless-metering` | `serverless-metering/envs/staging-us-east-1-f01` | `serverless-metering` | Server/worker/RCU StatefulSets and HAProxy; explicit Starter exclusion | Blocked |
| `o11y-agent-control-server-ng` | `staging/nextgen-regional-control-plane/o11y-agent-control-server/envs/staging-aws-us-east-1-f01` | `observability` | Released ACS, serverless templates, KubernetesAgent and SharedPoolAgent CRDs | Live workload contract verified; Argo revision unclaimed |

The future read-only reverse check is defined, but not automated here: match
rendered kind/namespace/name against Argo tracking annotations or instance
labels and `managedFields`, then record the owning Application's
`status.sync.revision`. No live ownership was inferred from directory names.

## Allowed differences

Only these differences are pre-approved:

1. real metering is replaced by the reviewed exclusion stub;
2. the released Starter O11y agents use the session-owned shared metrics backend; logs remain not deployed and the narrow reader stub remains for unrelated regional compatibility callers;
3. Kubernetes/EKS version selectors are ignored;
4. session names, addresses, credentials, certificates and cloud resource IDs
   are session-owned equivalents;
5. microservice replicas and requests/limits may be smaller when the real
   binary, config, protocol, feature and readiness paths are preserved.
6. cert-manager/AWS PCA issuer, external-secrets and kubed controllers are
   replaced by CP9's direct session certificate, Secret and config delivery.
7. Starter uses the Dev Full `premium-metadb` MySQL deployment with separate
   `serverless_rds` and `serverless_infra` databases instead of provisioning
   two regional RDS instances.

TiDB cluster/data-plane replicas, resources and kernel configuration are not
covered by the microservice reduction exception.

## Live AI/FTS fixture boundary

The core Starter product does not require hosted embedding or AI/FTS. They are
disabled by default and activated only with `starter.ai_fts.enabled: true`.
When disabled, cp9 omits the AI Gateway/FTS workloads, public DNS, TiDB hosted
embedding configuration, and inference secret wiring.

When enabled, the selected binaries require a hosted-inference API key, a real
`ai` database user, and a real account-central JWT issuer bound to an
organization and cluster. Starter never copies the staging values. Before any
cloud mutation, activation requires the session-safe private inputs
`CP9_STARTER_INFERENCE_SERVICE_API_KEY`, `CP9_STARTER_AI_GATEWAY_USERNAME`,
`CP9_STARTER_AI_GATEWAY_PASSWORD`, `CP9_STARTER_FTS_JWT_HOST`,
`CP9_STARTER_FTS_JWT_AUTH_TOKEN`, `CP9_STARTER_FTS_JWT_ORG_ID`, and
`CP9_STARTER_FTS_JWT_CLUSTER_ID`. They are materialized only as a Kubernetes
Secret. `LOCALHOST` and the Feishu notifier are deliberately not enabled.