From 0653ae384b1d389c694ea89a723ed8c6cf4a75a5 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 27 Sep 2026 13:26:36 +0200 Subject: [PATCH] Enable frontend reporting and record permanent GitOps adoption path Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e241-8285-7a63-8c0c-51c9cb824dc3 --- k8s/railiance/20-runtime.yaml | 19 ++-- workplans/ACTIVITY-WP-0041-gitops-adoption.md | 92 +++++++++++++++++++ 2 files changed, 101 insertions(+), 10 deletions(-) create mode 100644 workplans/ACTIVITY-WP-0041-gitops-adoption.md diff --git a/k8s/railiance/20-runtime.yaml b/k8s/railiance/20-runtime.yaml index bfa82cb..48ee81f 100644 --- a/k8s/railiance/20-runtime.yaml +++ b/k8s/railiance/20-runtime.yaml @@ -55,10 +55,10 @@ data: --- id: frontend-patterns-daily name: Frontend Patterns Daily Review - enabled: false + enabled: true owner: frontend-patterns governance: custodian - status: proposed + status: active trigger: type: cron cron_expression: "0 2 * * *" @@ -78,7 +78,7 @@ data: reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim - an improvement has happened. Enable after live report-sink proof. + an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-daily-report @@ -99,10 +99,10 @@ data: --- id: frontend-patterns-monthly name: Frontend Patterns Monthly Review - enabled: false + enabled: true owner: frontend-patterns governance: custodian - status: proposed + status: active trigger: type: cron cron_expression: "0 9 1 * *" @@ -122,7 +122,7 @@ data: reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim - an improvement has happened. Enable after live report-sink proof. + an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-monthly-report @@ -143,10 +143,10 @@ data: --- id: frontend-patterns-weekly name: Frontend Patterns Weekly Review - enabled: false + enabled: true owner: frontend-patterns governance: custodian - status: proposed + status: active trigger: type: cron cron_expression: "0 3 * * 2" @@ -166,7 +166,7 @@ data: reporting; no LLM calls or repository mutations. Source collection is pinned to Git revisions. Outcome assertions remain unverified. The weekly report explicitly carries the blocked executor dependency; it does not emit unexecutable ops_run work or claim - an improvement has happened. Enable after live report-sink proof. + an improvement has happened. Enabled after live report-sink proof on 2026-09-27. ```instruction id: frontend-patterns-weekly-report @@ -183,7 +183,6 @@ data: author: activity-core topic_id: fe2aaa78-9c20-4feb-b3d2-4fe0529572a3 ``` - weekly-forgejo-package-prune.md: | --- id: weekly-forgejo-package-prune diff --git a/workplans/ACTIVITY-WP-0041-gitops-adoption.md b/workplans/ACTIVITY-WP-0041-gitops-adoption.md new file mode 100644 index 0000000..0e52181 --- /dev/null +++ b/workplans/ACTIVITY-WP-0041-gitops-adoption.md @@ -0,0 +1,92 @@ +--- +id: ACTIVITY-WP-0041 +type: workplan +title: "Remove recurring deployment exceptions through governed GitOps adoption" +domain: infotech +repo: activity-core +status: ready +owner: codex +topic_slug: activity-core +created: "2026-09-27" +updated: "2026-09-27" +--- + +Origin: founder asked what must change to avoid the scoped deployment exception +for frontend-patterns reporting (ACTIVITY-WP-0040 / FEP-WP-0008). This is the +reviewed implementation handoff, not permission to adopt additional live objects. +The exception is recorded as State Hub decision +e5dd02cb-b5b2-45c8-a600-748ea2ffd31b and does not change estate policy. + +## Reconcile live state with deployable source and publish reproducible images + +```task +id: ACTIVITY-WP-0041-T01 +status: todo +priority: high +``` + +Owner activity-core, with railiance-platform for image distribution. Inventory +all resources and external ownership first. Separate runtime declarations from +one-shot migration/sync Jobs; prevent hooks from rerunning accidentally. Capture +live backup wrappers/mounts and other deliberate patches missing from the main +runtime manifest. The 2026-09-27 worker diff preserved live backup mounts through +three-way apply; that is not proof a fresh render fully describes the runtime. + +Replace workstation-only image imports and mutable/local tags with reproducible +CI builds, registry publication and immutable digests. Keep worker/API compatibility +checks and pin both independently. Add a projection check that frontend-patterns +source definitions exactly match the external-definition ConfigMap. Render and +server-dry-run the proposed managed set; no unintended spec change or pruning. + +## Adopt the declared resource set into railiance01 ArgoCD + +```task +id: ACTIVITY-WP-0041-T02 +status: wait +priority: high +``` + +Owner railiance-platform for AppProject/root Application; activity-core for its +resource set. Follow RPF-WP-0044's existing per-app adoption procedure in a dedicated +activity-core adoption record (activity-core is not one of that plan's four apps). +Create a least-privilege project/source allowance and child Application with a +pinned revision, initially no automated sync, finalizer or pruning. Verify repo +access, metadata-only adoption, healthy worker/API and unchanged existing schedules. +Observe at least 24 hours before enabling automation, following the existing policy. + +Record namespace/resource-to-binding classification with the MASON-WP-0006 mapping +owner. An explicit mapping improves routing; it must not downgrade a production +target to bypass the GitOps path. Keep secrets under existing ESO/OpenBao custody. +The founder-approved exception covers WP0040 only; adoption activation is a separate +one-time governance decision. + +## Establish standing authority for bounded routine releases + +```task +id: ACTIVITY-WP-0041-T03 +status: wait +priority: high +``` + +Owner estate governance with activity-core and railiance-platform. ArgoCD adoption +alone still leaves manual root/child sync and per-change founder go-ahead under +current policy. To meet monthly-only human review, approve once the exact autonomous +scope: who may merge which paths, mandatory tests/review, allowed images/definitions, +resource/spend ceilings, stop conditions, rollback and audit retention. Bind the +execution identity to those grants; do not infer standing authority from one rollout. + +Then permit automated promotion/sync within that scope, after the adoption soak; +keep pruning disabled until the complete tracked set is proven. Changes to access, +secrets, schema/maturity rules, destructive operations or budget ceilings remain in +the monthly decision packet. Failed routine checks stop/retry/roll back automatically +and produce visible evidence rather than asking the founder to approve each run. +Prove one normal release and one failed health-check rollback through Git/ArgoCD. + +## Acceptance + +A normal authorized change builds/tests, publishes a digest, updates reviewed source, +merges and reconciles through ArgoCD, verifies health, and records evidence without +kubectl apply or a fresh founder exception. Failure recovers through the declared +rollback path. Human involvement is limited to the agreed monthly policy review. +GLAS-WP-0012/HFACT-WP-0001 readiness remains a separate prerequisite for automated +pattern editing; completing this plan does not imply that executor is admitted.