feat(safety+audit+deploy): consistency_check + audit log file sink + deploy script
#2 Env switch safety:
- mcp_common/environment.py: nuova consistency_check() che previene
switch accidentali a mainnet. Solleva EnvironmentMismatchError se
resolved=mainnet senza creds["environment"]="mainnet" esplicito,
o se declared/resolved mismatch. Override via STRICT_MAINNET=false.
- Wirato in app_factory.run_exchange_main al boot.
- 6 nuovi test consistency.
#3 Audit log persistence:
- mcp_common/audit.py: TimedRotatingFileHandler aggiuntivo se env
AUDIT_LOG_FILE settato. Rotation midnight UTC, retention 30gg
default (AUDIT_LOG_BACKUP_DAYS). Format JSONL con SecretsFilter.
- docker-compose.prod.yml: bind mount /var/log/cerbero-mcp + env
AUDIT_LOG_FILE per i 4 servizi exchange (write endpoints).
- 2 nuovi test file sink.
#1 Deploy script:
- scripts/deploy.sh: idempotente, fa docker login + clone/pull repo +
copia secrets chmod 600 + crea .env + setup audit dir + pull image
+ up + smoke test pubblico HTTPS.
- DEPLOYMENT.md aggiornato: sezioni 2 (script), 3 (safety mainnet),
4 (audit log query), renumber sezioni successive.
Test: 488/488 verdi.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
AdrianoDev
a1110c8ecb