# Approval plan: the db-reads/ lifecycle rule on the deployment buckets

Status: PREPARED, not applied. AGENTS.md's production rule applies: nothing
here is applied until Paul approves this scope.

## What and why

Two lifecycle rules on each deployment bucket, both filtered to the prefix
`db-reads/` (db region forward spec §5.7, §11.1, J4):

- `db-reads-expire`: current versions expire 1 day after creation;
  noncurrent versions expire 1 day after they become noncurrent; incomplete
  multipart uploads are aborted after 1 day.
- `db-reads-delete-markers`: expired object delete markers are removed.

The forwarded read protocol writes create-only objects under `db-reads/`
and deletes nothing. These rules are its only deletion. They must be in
place on a deployment's bucket before any console there sets
`CARLOS_DB_FORWARD=1`; without them `db-reads/` objects are never removed.

The module change is in `infra/modules/deployment-buckets/main.tf`, inside
the existing `aws_s3_bucket_lifecycle_configuration.deployment`, beside the
`geoip-noncurrent` rule, which is unchanged. The module test
`tests/db_reads.tftest.hcl` (T17) pins both rules and the GeoIP rule.

## Scope

| | Dev | Flagship |
|---|---|---|
| Account and region | the dev account (profile `kass`), eu-west-1 | the flagship account (profile `keymail`), eu-west-1 |
| Bucket | `carlos-dev-640012953448` | `carlos-flagship-271376211898` |
| Root | `platform-infrastructure` (tracks `main`) | `carlosframework/carloku-infrastructure` (modules at a release tag) |
| Resource | `aws_s3_bucket_lifecycle_configuration.deployment` inside the `deployment-buckets` module | the same |
| Change | two rules added; the `control/geoip/` rule unchanged | the same |

No IAM change, no new permission, no traffic change. Nothing outside
`db-reads/` is affected: the filter is the prefix, and no other key in the
bucket starts with it. A bucket's lifecycle configuration is replaced whole
by the apply, which is why the plan must show the GeoIP rule still there.

## Cost

Lifecycle expiration is free. Storage of `db-reads/` objects is at most a
few days of forwarded reads (a query's ciphertext is at most 64 MiB).

## Steps

Dev first (Paul's roll order), then the flagship:

1. Dev: in `platform-infrastructure`, `tofu init -upgrade`, then
   `tofu plan -target=<the deployment-buckets module address>` (find it
   with `grep -n 'deployment-buckets' *.tf`). The plan must show only the
   lifecycle configuration changing in place, with the two rules added and
   `geoip-noncurrent` kept. Apply with the same `-target` after approval.
2. Flagship: cut the platform release that carries this module change,
   push its tag to the GitHub mirror (`git push
   https://github.com/carlosframework/platform.git refs/tags/vX.Y.Z`), bump
   every `?ref=` in `carloku-infrastructure`, `tofu init -upgrade`, then the
   same targeted plan. Apply with the same `-target` after approval. A
   whole-root apply is not allowed (user_data drift restarts every box).

## Verification

`aws s3api get-bucket-lifecycle-configuration --bucket <deployment bucket>
--profile <the deployment's profile>` lists `geoip-noncurrent`,
`db-reads-expire` and `db-reads-delete-markers`, the last two filtered to
`db-reads/`.

## Rollback

Remove the two rules and apply the same targeted change. Until a rule is
back, `db-reads/` objects are not removed, so turn forwarding off
(`CARLOS_DB_FORWARD` unset on the console) first.

## Duration

Permanent while forwarding is in use. Plan 5 (spec §14) moves this traffic
to a bucket per region, which carries its own copy of these rules; these
then stay for any object written before the move.