chore(consul-postgres-ha): drop implementation-process labels from docs + code

Removes the "Stage 1 / Stage 2 / Stage 4 / Phase 0" labels that crept
into comments, doc titles, and inline notes during development. Those
were process markers for ourselves, not vocabulary anyone reading
this example cold should care about. Substantive content (what's a
workaround, what's the principled fix, where to find the design)
preserved verbatim — only the labels are gone.

Also: coordinator/docker-compose.yaml was referencing a deleted
`../phase0/icetest` build context for the signaling service. Repointed
to the published GHCR image (`consul-postgres-ha-signaling:latest`),
matching how the rest of the example pulls its images.

Verified: mesh-conn tests pass, bootstrap-secrets/signaling/quic-on-ice
all build, terraform validate clean, shell entrypoints parse.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

consul-postgres-ha/ARCHITECTURE.md

@@ -333,9 +333,9 @@ format.
 - …all confidential traffic above it is **already encrypted by Envoy
   mTLS** (Layer 3), so the wire is safe even if someone could see the
   UDP datagrams.
-- **Consul gossip** is encrypted via `-encrypt` (Stage-1 workaround:
-  key generated in Terraform and broadcast via env; Stage-2
-  attestation will replace this with TEE-rooted material). RPC is
+- **Consul gossip** is encrypted via `-encrypt` (workaround: key
+  generated in Terraform and broadcast via env; attestation-rooted
+  admission will replace this with TEE-derived material). RPC is
   plaintext. Both are confined to inside the overlay, but a full
   setup would also configure TLS for RPC. See [ROBUSTNESS.md](ROBUSTNESS.md).
 

consul-postgres-ha/FAILOVER.md

@@ -1,8 +1,8 @@
-# Stage 4 — failover demo
+# Failover demo
 
 A reproducible recipe for the soft-kill leader-failover scenario, plus the
 measured timeline from a real run on the live cluster (2026-05-03).
-This demonstrates that stage 4's HA story is end-to-end working: Patroni
+This demonstrates that the HA story is end-to-end working: Patroni
 elects via Consul KV when the leader's lock expires, a replica is
 promoted, writes resume on the new leader, and the old leader rejoins
 cheaply (WAL replay + streaming, no full pg_basebackup) once it comes

consul-postgres-ha/PUBLISHING.md

@@ -1,6 +1,6 @@
-# Stage 4 — image publishing & verification
+# Image publishing & verification
 
-The stage-4 example needs four container images deployed in lockstep:
+This example needs four container images deployed in lockstep:
 `mesh-sidecar`, `patroni`, `webdemo`, `signaling`. CI publishes them to
 GHCR with Sigstore-backed GitHub Build Provenance; consumers pin by
 tag (or, better, by digest) and verify provenance with

consul-postgres-ha/README.md

@@ -27,7 +27,7 @@ peers' ICE candidates; no data ever passes through it once peers
 connect. Per-CVM and per-cluster secrets are split: the TURN HMAC is
 derived per-CVM from dstack KMS, while cluster-wide-identical
 material (gossip key, Patroni passwords) is generated in Terraform
-and broadcast via env until Stage-2 attestation-admission lands.
+and broadcast via env until attestation-rooted admission lands.
 Connect CA uses Consul's built-in CA provider — root in Raft, no
 external derivation needed.
 
@@ -142,11 +142,11 @@ and the Terraform structure as-is.
   admission credential is the next architectural step.
 * The cluster's gossip key, Patroni superuser password, and
   replication password are **generated in Terraform and broadcast
-  via env to every CVM**. This is a Stage-1 workaround — those
-  bytes live in `terraform.tfstate` and pass through whoever runs
-  `apply`. Stage-2 attestation-admission
+  via env to every CVM** — a workaround, because those bytes live
+  in `terraform.tfstate` and pass through whoever runs `apply`. The
+  attestation-rooted admission design
   ([`design/attestation-admission.md`](design/attestation-admission.md))
-  replaces this with TEE-rooted material that no human ever sees.
+  replaces this with TEE-derived material that no human ever sees.
 
 ## Filed upstream
 

consul-postgres-ha/ROBUSTNESS.md

@@ -51,7 +51,7 @@ ours, they're the parts that *must* be made robust by hand.
 | Coordinator host dies             | New peers can't bootstrap. **Existing ICE pairs keep working** (no data flows through this box once handshake is done). New retries from existing peers fail until it's back. | bring it back; peers reconnect on their own. |
 | Coordinator ufw / network change  | Same as above.                                                       | restore ports 3478/udp+tcp, 5349/tcp, 7000/tcp, 49152-49999/udp. |
 | TURN shared secret leaks          | Anyone can use the box as an open TURN relay (cost / abuse risk).    | rotate `TURN_SHARED_SECRET` in coordinator + every CVM env, redeploy. |
-| Signalling broker is unauthenticated | Any external actor can publish/poll messages, spoof candidates, intercept ICE handshakes. Currently low-impact only because we're solo. | gate `/publish` + `/poll` on attestation-derived identity (Stage 4 work). |
+| Signalling broker is unauthenticated | Any external actor can publish/poll messages, spoof candidates, intercept ICE handshakes. Currently low-impact only because we're solo. | gate `/publish` + `/poll` on attestation-derived identity. |
 | dstack provider NAT changes type (e.g. cone → symmetric) | ICE picks TURN relay path. ~150 ms RTT instead of ~6 ms. **Functionality unchanged.** | none needed; coturn covers this fallback. |
 | Underlying CVM dies               | That peer's services drop out. Consul will mark it `failed` after gossip timeout, Envoy LB removes it within seconds. | redeploy; the rest of the cluster is unaffected. |
 
@@ -200,7 +200,7 @@ The mitigations are mostly testing discipline:
 | Envoy sidecar dies               | All in-flight mTLS connections through it drop. App's calls to `127.0.0.1:19000` get connection refused. | container restart. ~5 s downtime per peer. |
 | Connect CA root expiry           | All sidecar leaf certs go invalid; whole mesh stops. | `consul connect ca set-config` to rotate root, or default 5-year root won't bite us in this experiment. |
 | Connect intention misconfigured (e.g. accidental deny) | Some traffic blocked silently. Sidecar denies are reported as `RBAC: access denied` in Envoy logs. | rotate intention; xDS picks it up in seconds (already demoed). |
-| **RPC TLS not set** | RPC is plaintext on the overlay. Threat is bounded by the QUIC overlay below it (peer ⇄ peer end-to-end encrypted), so on-the-wire taps don't see it; in-CVM containers that bind `127.0.0.1` to the agent's RPC port would. | Stage-2 work: derive a small CA from attestation-rooted material and configure Consul TLS using it. |
+| **RPC TLS not set** | RPC is plaintext on the overlay. Threat is bounded by the QUIC overlay below it (peer ⇄ peer end-to-end encrypted), so on-the-wire taps don't see it; in-CVM containers that bind `127.0.0.1` to the agent's RPC port would. | Derive a small CA from attestation-rooted material and configure Consul TLS using it — design lives in `design/attestation-admission.md`. |
 | ttl.sh image expiry | After 24h, a CVM restart can't pull our images. New deploys silently fail to pull. | move to a real registry (GHCR, Phala internal, local registry on the public box). |
 
 ### Risk shape
@@ -232,13 +232,13 @@ depth.
 - **Real registry** — Sigstore-attested GHCR images via
   `.github/workflows/consul-postgres-ha-publish.yml`. See
   `PUBLISHING.md`.
-- **Gossip key wired in (Stage-1 workaround)** — `cluster.tf`
+- **Gossip key wired in (workaround)** — `cluster.tf`
   generates a `random_bytes` and broadcasts it to every CVM via
   env; `mesh-sidecar/entrypoint.sh` passes it as
   `consul agent -encrypt=…`. Same shape used for the Patroni
   superuser + replication passwords. The keys live in
   `terraform.tfstate`; eliminating that exposure is part of the
-  Stage-2 attestation-admission work
+  attestation-admission work
   (`design/attestation-admission.md`).
 
 ## Cross-layer concerns
@@ -312,7 +312,7 @@ are the next plateau.
 
 The deeper open question — **anyone with `terraform.tfstate` can
 read the cluster's gossip key and Patroni passwords** — is
-deliberately deferred to Stage 2 (attestation admission), where
+deliberately deferred to the attestation-admission work, where
 peers prove TEE residency and shared cluster material is rooted
 in attestation rather than handed in by the deployer.
 
@@ -328,9 +328,9 @@ in attestation rather than handed in by the deployer.
 - **Real registry** — Sigstore-attested GHCR images via
   `.github/workflows/consul-postgres-ha-publish.yml`.
 - **Gossip key + Patroni passwords are now cluster-wide identical
-  (Stage-1 workaround)** — generated in Terraform and broadcast
-  to every phala_app via env. Stage-2 attestation will replace
-  this with TEE-rooted material.
+  (workaround)** — generated in Terraform and broadcast to every
+  phala_app via env. Attestation-rooted admission will replace
+  this with TEE-derived material.
 
 ## "Are we playing too many tricks?"
 

consul-postgres-ha/bootstrap-secrets/main.go

@@ -1,4 +1,4 @@
-// bootstrap-secrets — stage 4 init container.
+// bootstrap-secrets — init container.
 //
 // One-shot. Runs to completion before any other service starts on a CVM.
 // Responsibilities:
@@ -28,9 +28,8 @@
 //      `condition: service_completed_successfully` can release the
 //      next services.
 //
-// The keystone of the stage-4 design is here: this is the only piece
-// that holds plaintext secret material, and it does so entirely
-// inside the TEE. The deploy host never sees them.
+// This is the only piece that holds plaintext secret material, and
+// it does so entirely inside the TEE. The deploy host never sees them.
 
 package main
 
@@ -71,14 +70,14 @@ func main() {
 
 	// 2. Derive per-app secrets via dstack KMS.
 	//
-	// Stage-1 WORKAROUND scope note: gossip key, Patroni superuser
-	// password, and Patroni replication password are NOT derived
-	// here — they would be different bytes on every CVM (each CVM
-	// is its own phala_app with its own app_id, and GetKey is rooted
-	// at app_id), so per-CVM derivation can't produce the
-	// cluster-wide identical material those consumers need. They
-	// come from Terraform-generated env instead. See cluster.tf and
-	// design/attestation-admission.md for the Stage-2 fix.
+	// WORKAROUND scope note: gossip key, Patroni superuser password,
+	// and Patroni replication password are NOT derived here — they
+	// would be different bytes on every CVM (each CVM is its own
+	// phala_app with its own app_id, and GetKey is rooted at app_id),
+	// so per-CVM derivation can't produce the cluster-wide identical
+	// material those consumers need. They come from Terraform-
+	// generated env instead. See cluster.tf and
+	// design/attestation-admission.md for the principled fix.
 	//
 	// What's still derived here is intentionally narrow:
 	//   turn:    handed to mesh-conn for coturn auth (the actual
@@ -216,7 +215,7 @@ func mustEnv(k string) string {
 // First match wins. Returns the slot index. Slot ownership is
 // permanent for the InstanceID's lifetime; cleanup of stale slots
 // (when an instance is permanently retired) is a separate operator
-// task — note in stage-4 README.
+// task — see the example README.
 func claimOrdinal(cfg *Config, instanceID string) (int, error) {
 	if cfg.ConsulHTTPAddr == "" {
 		return 0, fmt.Errorf("CONSUL_HTTP_ADDR required for non-coordinator role")

consul-postgres-ha/cluster-example/cluster.tf

@@ -31,7 +31,7 @@ terraform {
 
 provider "phala" {}
 
-# ---------- Cluster-wide shared secrets (Stage-1 WORKAROUND) ----------
+# ---------- Cluster-wide shared secrets (WORKAROUND) ----------
 #
 # These three secrets MUST be byte-identical across every CVM that
 # joins the cluster (gossip auth, Patroni replication, Patroni superuser).
@@ -41,11 +41,12 @@ provider "phala" {}
 # phala_app.coordinator/worker) and dstack's GetKey() is rooted at
 # app_id, so per-CVM derivation produces DIFFERENT bytes on each peer.
 #
-# Until Stage-2 attestation-rooted admission lands (see
+# Until attestation-rooted admission lands (see
 # `consul-postgres-ha/design/attestation-admission.md`), we generate
 # them in Terraform and hand the same bytes to every phala_app via
 # env. Trade-off accepted: anyone with read access to terraform.tfstate
-# (or the apply host's memory) sees plaintext keys. Stage 2 closes this.
+# (or the apply host's memory) sees plaintext keys. The attestation
+# work closes this.
 #
 # Connect CA root is NOT in this list — Consul's built-in CA provider
 # generates the root in Raft on first quorum, no external derivation
@@ -193,7 +194,7 @@ resource "phala_app" "coordinator" {
     TURN_HOST           = var.external_coordinator_host
     TURN_SHARED_SECRET  = var.external_turn_secret
     MESH_SIDECAR_IMAGE  = var.mesh_sidecar_image
-    # Stage-1 WORKAROUND — see `random_bytes` block at top of file.
+    # WORKAROUND — see `random_bytes` block at top of file.
     GOSSIP_KEY           = random_bytes.gossip_key.base64
     MESH_CONN_RELAY_ONLY = var.mesh_conn_relay_only
     MESH_CONN_DEBUG_ICE  = var.mesh_conn_debug_ice
@@ -237,7 +238,7 @@ resource "phala_app" "worker" {
     MESH_SIDECAR_IMAGE = var.mesh_sidecar_image
     WEBDEMO_IMAGE      = var.webdemo_image
     PATRONI_IMAGE      = var.patroni_image
-    # Stage-1 WORKAROUND — see `random_bytes` block at top of file.
+    # WORKAROUND — see `random_bytes` block at top of file.
     GOSSIP_KEY             = random_bytes.gossip_key.base64
     PATRONI_SUPERUSER_PW   = random_bytes.patroni_superuser_pw.hex
     PATRONI_REPLICATION_PW = random_bytes.patroni_replication_pw.hex

consul-postgres-ha/cluster-example/rollout.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Stage 4 — workload-aware rolling update driver.
+# Workload-aware rolling update driver.
 #
 # Until phala-cloud#243 lands `phala_app.update_policy`, the platform's
 # in-place app update touches all replicas in unspecified order. That's

consul-postgres-ha/compose/coordinator.yaml

@@ -55,8 +55,8 @@ services:
       - SIGNALING_URL=${SIGNALING_URL}
       - TURN_HOST=${TURN_HOST}
       - TURN_SHARED_SECRET=${TURN_SHARED_SECRET}
-      # Stage-1 WORKAROUND: gossip key generated in Terraform and
-      # broadcast identically to every CVM. See cluster.tf.
+      # WORKAROUND: gossip key generated in Terraform and broadcast
+      # identically to every CVM. See cluster.tf.
       - GOSSIP_KEY=${GOSSIP_KEY}
       # See worker.yaml for the rationale on MESH_CONN_RELAY_ONLY.
       - MESH_CONN_RELAY_ONLY=${MESH_CONN_RELAY_ONLY:-}

consul-postgres-ha/compose/worker.yaml

@@ -40,8 +40,8 @@ services:
       - SIGNALING_URL=${SIGNALING_URL}
       - TURN_HOST=${TURN_HOST}
       - TURN_SHARED_SECRET=${TURN_SHARED_SECRET}
-      # Stage-1 WORKAROUND: gossip key generated in Terraform and
-      # broadcast identically to every CVM. See cluster.tf.
+      # WORKAROUND: gossip key generated in Terraform and broadcast
+      # identically to every CVM. See cluster.tf.
       - GOSSIP_KEY=${GOSSIP_KEY}
       # MESH_CONN_RELAY_ONLY=1 forces ICE to gather only Relay
       # candidates, routing all peer traffic through the coturn server.
@@ -71,8 +71,8 @@ services:
     # CLUSTER_NAME drives Patroni's `scope` — every peer's patroni
     # must use the same value to land in the same cluster. Postgres
     # binds the canonical 127.0.0.1:5432; Patroni REST on 127.0.0.1:8008.
-    # Stage-1 WORKAROUND: superuser + replication passwords generated
-    # in Terraform and broadcast identically to every worker. See
+    # WORKAROUND: superuser + replication passwords generated in
+    # Terraform and broadcast identically to every worker. See
     # cluster.tf.
     environment:
       - CLUSTER_NAME=${CLUSTER_NAME}