tegwick
c12a8fbcfb
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e241-8285-7a63-8c0c-51c9cb824dc3
66 lines
4 KiB
Markdown
66 lines
4 KiB
Markdown
# Activity-core GitOps release lane
|
|
|
|
ACTIVITY-WP-0041 owns this lane; RPF-WP-0048 owns platform adoption. The founder
|
|
requested implementation on 2026-09-27. Adoption is authorized; the existing
|
|
24-hour healthy observation period and release-identity proof remain mandatory.
|
|
|
|
## Managed set and ownership
|
|
|
|
`k8s/gitops/kustomization.yaml` renders exactly nine resources: the API, worker
|
|
and event-router Deployments; API and worker-metrics Services; runtime config,
|
|
external definitions, report schemas and service-inventory ConfigMaps.
|
|
`scripts/render_gitops.py --check` verifies the generated projection against
|
|
`k8s/railiance/20-runtime.yaml`. Change that source and regenerate; after adoption,
|
|
never apply the mixed legacy directory directly. Migration/sync Jobs are deliberately
|
|
excluded. Sync definitions through the existing authenticated admin endpoint after
|
|
ConfigMap projection refresh; this is an explicit release verification step.
|
|
|
|
The baseline includes live backup wrapper mounts and the API's Temporal UI setting.
|
|
Dependencies stay with their existing owners: ESO/OpenBao secrets, verified backup
|
|
ConfigMap, storage, host-path contents, Temporal/NATS/databases, llm-connect, edge
|
|
relay, ingress/SSO and monitoring. ArgoCD must not prune or adopt them implicitly.
|
|
Namespace classification remains production-tier (platform target, no authoritative
|
|
rApp binding); MASON-WP-0006 is the mapping owner. Adoption does not invent a binding
|
|
or lower readiness requirements.
|
|
|
|
## Build and publication
|
|
|
|
The image workflow retrieves the full commit archive, builds the isolated test
|
|
stage, and publishes only `git-<full-sha>` plus its registry digest. Python's base
|
|
image digest, uv version and dependency lock are pinned. Deployments consume
|
|
`forgejo.coulomb.social/coulomb/activity-core@sha256:…`, independently for each
|
|
component. A commit tag is a lookup convenience, not an immutability guarantee.
|
|
Existing images are retained during metadata-only adoption; do not replace a
|
|
running component with newer code merely to complete adoption.
|
|
|
|
The pipeline uses its existing runner-held registry credentials. No credentials
|
|
are copied into Git or into the coding-agent session. Successful publication and
|
|
anonymous/cluster pull must be evidenced before the first digest promotion.
|
|
|
|
## Bounded routine authority — implementation boundary
|
|
|
|
Proposed executable scope `ACTIVITY-WP-0041-image-only-v1` is intentionally narrow:
|
|
only the three Deployment image fields and transition from Never to IfNotPresent
|
|
may change. No resource inventory, commands, mounts, environment, access, schema,
|
|
replicas, resources, migrations, definition behavior or budget changes are admitted.
|
|
Those changes require their owner review under the existing governance policy.
|
|
|
|
`scripts/check_gitops_promotion.py` refuses a non-digest image, widened diff,
|
|
missing independent review/checks, unadmitted identity, stale health evidence,
|
|
missing rollback revision, or less than 24 healthy hours. It is a **validator**,
|
|
not an authority issuer: evidence fields are not signatures. The release executor
|
|
must authenticate the CI/reviewer/health receipts and bind the exact candidate
|
|
revision before invoking it. A producer-supplied JSON file cannot grant access.
|
|
|
|
No unattended merge/deployment identity has been admitted by this change. Do not
|
|
mark this policy active or turn on automatic sync based only on these fixtures.
|
|
After identity proof and the observation period, enable only the activity-core
|
|
child's bounded promotion path; root-wide automation and destructive pruning stay
|
|
off. The existing root remains manually reconciled for unrelated applications.
|
|
|
|
A release must name the prior pinned revision before promotion, sync through
|
|
ArgoCD with pruning disabled, verify health and report-sink/schedule invariants,
|
|
and revert its source revision through ArgoCD on failure. Prove both successful
|
|
promotion and failed-health rollback before claiming unattended operation.
|
|
The 24-hour observation begins with the recorded successful adoption; a stateful
|
|
failure or unintended spec change invalidates that observation.
|