13. Migration and Tier 4 disconnected deployment

Purpose

Map and validate legacy workbook data without partial writes, then prove a disconnected installation payload has not been altered.

Before you begin

• Sandbox tenant for COMMIT tests
• Real prebuilt API/web container archives
• A 3072-bit RSA private key under release-custodian control
• Its fingerprinted public key and trusted verifier transferred separately to the disconnected VM
• An isolated Kubernetes target with Docker, containerd or nerdctl plus Helm and kubectl

Procedure

1. 1

   Download the controlled XLSX template and review its Instructions, Items, Vendors and Opening Stock sheets.

2. 2

   Upload a legacy workbook with renamed columns, inspect automatic mapping, correct at least one mapping and revalidate it.

3. 3

   Include invalid JSON, duplicate identifiers, an unknown location and a formula; confirm every error identifies its sheet, row and field and COMMIT remains disabled.

4. 4

   Correct the workbook, inspect the five-row previews and run DRY_RUN; confirm no item, vendor or stock was written.

5. 5

   Use COMMIT only in the sandbox after a successful dry run and reconcile the job summary to created records.

6. 6

   Export the exact tagged API/web images, build the RSA-PSS bundle and record its signer key ID and media hashes.

7. 7

   On the disconnected VM, run the trusted verify-and-install wrapper with the out-of-band trusted-key directory and a new empty release directory; confirm a manifest-bound receipt is created before any image import.

8. 8

   Try an untrusted public key and alter one payload byte; confirm both fail before image import, including a payload altered after verification.

9. 9

   Retain old and new public keys during a signing-key rotation, prove bundles from both verify, then remove the retired key only after the release overlap window.

10. 10

    Confirm local image import, migration Job success, two non-root deployments, services and health probes without registry or Internet access.

Expected result

• Macros, formulas, external links, embedded objects and unsafe workbook sizes fail closed
• DRY_RUN never changes business tables
• COMMIT uses the same validator and is atomic
• Every preview and migration job remains attributable
• Private signing key is absent from the bundle and disconnected host
• Signer fingerprint must match an out-of-band trusted public key
• Verification receipt is bound to the exact manifest and all payload hashes are rechecked before import
• Untrusted, mismatched and tampered bundles fail closed
• Image pull policy remains Never and installation succeeds without external network access