Retarget MAS-WP-0007 from teardown to a switchable facility.
The founder withdrew retirement on 2026-11-01. The teardown task is cancelled. New tasks cover the facility contract, an on/off switch that keeps evidence and DNS, and offline tests. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
parent
ecd624c6fe
commit
e8fd86a1bd
3 changed files with 141 additions and 70 deletions
|
|
@ -14,7 +14,7 @@
|
|||
| workplan | MAS-WP-0004 | finished | — | workplans/MAS-WP-0004-postfix-integration-profile.md |
|
||||
| workplan | MAS-WP-0005 | finished | — | workplans/MAS-WP-0005-spec-errata-v0-1-1.md |
|
||||
| workplan | MAS-WP-0006 | finished | — | workplans/MAS-WP-0006-address-composer.md |
|
||||
| workplan | MAS-WP-0007 | active | — | workplans/MAS-WP-0007-retire-live-test-environment.md |
|
||||
| workplan | MAS-WP-0007 | active | — | workplans/MAS-WP-0007-switchable-facility.md |
|
||||
| workplan | MAS-WP-0008 | finished | — | workplans/MAS-WP-0008-finalize-v0-2.md |
|
||||
| workplan | MAS-WP-0009 | finished | — | workplans/MAS-WP-0009-declare-v0-2-final.md |
|
||||
| workplan | MAS-WP-0010 | finished | — | workplans/MAS-WP-0010-mode-reference-implementation.md |
|
||||
|
|
@ -60,7 +60,10 @@
|
|||
| task | MAS-WP-0005-T13 | done | — | workplans/MAS-WP-0005-spec-errata-v0-1-1.md |
|
||||
| task | MAS-WP-0006-T01 | done | — | workplans/MAS-WP-0006-address-composer.md |
|
||||
| task | MAS-WP-0006-T02 | done | — | workplans/MAS-WP-0006-address-composer.md |
|
||||
| task | MAS-WP-0007-T01 | wait | — | workplans/MAS-WP-0007-retire-live-test-environment.md |
|
||||
| task | MAS-WP-0007-T01 | cancel | — | workplans/MAS-WP-0007-switchable-facility.md |
|
||||
| task | MAS-WP-0007-T02 | todo | — | workplans/MAS-WP-0007-switchable-facility.md |
|
||||
| task | MAS-WP-0007-T03 | todo | — | workplans/MAS-WP-0007-switchable-facility.md |
|
||||
| task | MAS-WP-0007-T04 | todo | — | workplans/MAS-WP-0007-switchable-facility.md |
|
||||
| task | MAS-WP-0008-T01 | done | — | workplans/MAS-WP-0008-finalize-v0-2.md |
|
||||
| task | MAS-WP-0009-T01 | done | — | workplans/MAS-WP-0009-declare-v0-2-final.md |
|
||||
| task | MAS-WP-0009-T02 | done | — | workplans/MAS-WP-0009-declare-v0-2-final.md |
|
||||
|
|
|
|||
|
|
@ -1,68 +0,0 @@
|
|||
---
|
||||
id: MAS-WP-0007
|
||||
type: workplan
|
||||
title: "Retire the MAS live test environment"
|
||||
domain: communication
|
||||
repo: mail-address-semantics
|
||||
status: active
|
||||
owner: claude
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-10-18"
|
||||
updated: "2026-10-19"
|
||||
origin: residual
|
||||
origin_ref: MAS-WP-0003
|
||||
state_hub_workstream_id: "03751989-8ed1-5a3f-bcc3-71aef8b375a6"
|
||||
---
|
||||
|
||||
# Retire the MAS live test environment
|
||||
|
||||
Residual of MAS-WP-0003. The live MX for `mas.coulomb.social` stays up for
|
||||
follow-up validation (founder, 2026-10-18), capped at 300 sent replies.
|
||||
Retire it once MAS-WP-0004 and MAS-WP-0005 no longer need it. Cluster-scoped
|
||||
and external pieces do not disappear when the namespace is deleted.
|
||||
|
||||
**Founder decision (2026-10-19): redeploy, then keep.** The MX stays up for
|
||||
a second deployment (MAS-WP-0009) or for live validation of the mode
|
||||
contract. Retirement stays in backlog.
|
||||
|
||||
- 2026-10-19: redeployed `mas-mx` and `mas-statute` with image
|
||||
`mas-live:v0.2-a95f848`, side-loaded into k3s containerd. The previous
|
||||
image was `v0.2-a45f1a1`. The evidence (`events.jsonl`, 36 events, and
|
||||
`tickets.sqlite3`) was backed up before the rollout and is intact on the
|
||||
PVC. Checked: `mas discover` valid; the profile's relay control; TEM
|
||||
relay with null-sender discard; OpenDKIM/OpenDMARC running; the ticket
|
||||
service runs with `--max-sent 300 --require-dmarc-pass`; empty queue;
|
||||
relaying to the public IP refused with 554 (`x@other`, `x!y@other`,
|
||||
`a@mas...@other`).
|
||||
|
||||
- 2026-10-19: redeployed with image `mas-live:v0.2-480e69a`: MAS-WP-0012's
|
||||
one outbound path, and v0.2 final. The evidence was backed up first. The
|
||||
legacy outbox was imported once into `tickets-outbox.sqlite3`: 9 rows,
|
||||
4 sent, so 4 of 300 count toward the cap. The ticket service runs with
|
||||
`--max-sent 300 --require-dmarc-pass --email-held-duration-max 7d
|
||||
--emails-held-storage-max 100MB`. Checked: statute valid, 36 evidence
|
||||
events intact, TEM relay with null-sender discard, empty queue, relaying
|
||||
refused with 554. The migration was first tested in the image against a
|
||||
copy of the live volume.
|
||||
|
||||
## Retire the environment
|
||||
|
||||
```task
|
||||
id: MAS-WP-0007-T01
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "e0a65837-1769-5129-b258-fbaeb3047f62"
|
||||
```
|
||||
|
||||
Run when follow-up validation is done:
|
||||
1. Export the evidence (`/var/lib/mas/events.jsonl` and the ticket DB from
|
||||
the `mas-mx` pod) into the repo or an archive.
|
||||
2. Delete namespace `mas`.
|
||||
3. Notify ops-mason to remove OpenBao role `external-secrets-mas-tem-relay`,
|
||||
policy `workload-kv-read-mas-tem-relay` and KV path
|
||||
`platform/suppliers/scaleway/mas-tem-relay` (MASON-WP-0014 teardown).
|
||||
4. Founder: revoke the Scaleway TEM API key and remove the TEM domain.
|
||||
5. Founder: remove the `mas.coulomb.social` MX, A, SPF and DKIM records at
|
||||
IONOS, the `mas-fwd@coulomb.social` forward, and the
|
||||
`coulomb-social` Google Group if no longer used.
|
||||
6. Remove the side-loaded `mas-live:wp0003-*` images from k3s containerd.
|
||||
136
workplans/MAS-WP-0007-switchable-facility.md
Normal file
136
workplans/MAS-WP-0007-switchable-facility.md
Normal file
|
|
@ -0,0 +1,136 @@
|
|||
---
|
||||
id: MAS-WP-0007
|
||||
type: workplan
|
||||
title: "Operate MAS as a switchable facility"
|
||||
domain: communication
|
||||
repo: mail-address-semantics
|
||||
status: active
|
||||
owner: claude
|
||||
topic_slug: coulomb-social
|
||||
created: "2026-10-18"
|
||||
updated: "2026-11-01"
|
||||
origin: residual
|
||||
origin_ref: MAS-WP-0003
|
||||
state_hub_workstream_id: "03751989-8ed1-5a3f-bcc3-71aef8b375a6"
|
||||
---
|
||||
|
||||
# Operate MAS as a switchable facility
|
||||
|
||||
Residual of MAS-WP-0003. Namespace `mas` is the MAS facility for
|
||||
`mas.coulomb.social`, with replies through Scaleway TEM capped at 300.
|
||||
It stays. The 2026-10-19 retirement backlog is withdrawn.
|
||||
|
||||
**Founder decision (2026-11-01): keep it, and make it switchable.** Do not
|
||||
delete the namespace, revoke the TEM key, remove DNS, or tear down the
|
||||
OpenBao role. Operate the existing facility so mail and the statute can
|
||||
be turned off and back on without discarding evidence, credentials, or
|
||||
the public address.
|
||||
|
||||
The 2026-10-19 redeploy record stays part of this workplan:
|
||||
|
||||
- 2026-10-19: redeployed `mas-mx` and `mas-statute` with image
|
||||
`mas-live:v0.2-a95f848`, side-loaded into k3s containerd. The previous
|
||||
image was `v0.2-a45f1a1`. The evidence (`events.jsonl`, 36 events, and
|
||||
`tickets.sqlite3`) was backed up before the rollout and is intact on the
|
||||
PVC. Checked: `mas discover` valid; the profile's relay control; TEM
|
||||
relay with null-sender discard; OpenDKIM/OpenDMARC running; the ticket
|
||||
service runs with `--max-sent 300 --require-dmarc-pass`; empty queue;
|
||||
relaying to the public IP refused with 554 (`x@other`, `x!y@other`,
|
||||
`a@mas...@other`).
|
||||
|
||||
- 2026-10-19: redeployed with image `mas-live:v0.2-480e69a`: MAS-WP-0012's
|
||||
one outbound path, and v0.2 final. The evidence was backed up first. The
|
||||
legacy outbox was imported once into `tickets-outbox.sqlite3`: 9 rows,
|
||||
4 sent, so 4 of 300 count toward the cap. The ticket service runs with
|
||||
`--max-sent 300 --require-dmarc-pass --email-held-duration-max 7d
|
||||
--emails-held-storage-max 100MB`. Checked: statute valid, 36 evidence
|
||||
events intact, TEM relay with null-sender discard, empty queue, relaying
|
||||
refused with 554. The migration was first tested in the image against a
|
||||
copy of the live volume.
|
||||
|
||||
## What the facility is
|
||||
|
||||
Durable parts stay when the facility is off. The power switch must not
|
||||
delete or edit them:
|
||||
|
||||
- namespace `mas`
|
||||
- PVC `mas-evidence` (`events.jsonl`, `tickets.sqlite3`, the outbox DB)
|
||||
- Services `mas-smtp` (LoadBalancer) and `mas-statute`
|
||||
- Ingress `mas-statute` and its TLS secret
|
||||
- ExternalSecret `mas-relay`, its SecretStore, and ServiceAccount
|
||||
- OpenBao role `external-secrets-mas-tem-relay`, policy
|
||||
`workload-kv-read-mas-tem-relay`, and KV path
|
||||
`platform/suppliers/scaleway/mas-tem-relay`
|
||||
- DNS for `mas.coulomb.social`, the TEM domain, and the TEM API key
|
||||
|
||||
Switchable parts are the two Deployments, `mas-mx` and `mas-statute`.
|
||||
Off means both `replicas: 0`. The LoadBalancer keeps its address and has
|
||||
no ready pods, so port 25 takes no mail, and the statute ingress has no
|
||||
backend. On means both `replicas: 1` and ready, on the same PVC and image.
|
||||
|
||||
Known limits, unchanged by this workplan: one replica, a side-loaded
|
||||
image, snakeoil SMTP TLS, and the 300-reply cap. A later decision can
|
||||
raise any of those. This workplan does not roll a new image and does not
|
||||
turn the live facility off.
|
||||
|
||||
## Retire the teardown
|
||||
|
||||
```task
|
||||
id: MAS-WP-0007-T01
|
||||
status: cancel
|
||||
priority: medium
|
||||
state_hub_task_id: "e0a65837-1769-5129-b258-fbaeb3047f62"
|
||||
```
|
||||
|
||||
Cancelled 2026-11-01. The founder withdrew retirement. Do not export for
|
||||
teardown, delete namespace `mas`, ask ops-mason to remove the OpenBao
|
||||
role, revoke the Scaleway TEM key, remove DNS, or delete the side-loaded
|
||||
images.
|
||||
|
||||
## Record the facility contract
|
||||
|
||||
```task
|
||||
id: MAS-WP-0007-T02
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Update the current-direction docs so they describe a kept, switchable
|
||||
facility. `SCOPE.md` and INTENT.md phase-2 criterion 5 stop saying the
|
||||
live environment is retired. `deploy/railiance/` states the durable and
|
||||
switchable parts and the limits above. The release-unit note stops
|
||||
calling this something other than the operated facility. Historical
|
||||
workplans and `history/` stay as they were.
|
||||
|
||||
## Add the power switch
|
||||
|
||||
```task
|
||||
id: MAS-WP-0007-T03
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Add an operator command, `on`, `off`, and `status`, that scales only
|
||||
`deploy/mas-mx` and `deploy/mas-statute`. It records the desired power on
|
||||
namespace `mas` as annotation `mas.coulomb.social/power`. The supported
|
||||
apply path reads that annotation and renders `replicas: 0` when the
|
||||
facility is off, so a later apply does not turn it back on. Missing
|
||||
annotation means on, which matches the manifest and the live facility.
|
||||
The command must not delete the namespace, volume, secrets, services, or
|
||||
ingress.
|
||||
|
||||
On the cluster, record `power=on` to match the running facility. Do not
|
||||
scale it to 0 and do not roll a new image.
|
||||
|
||||
## Test the switch offline
|
||||
|
||||
```task
|
||||
id: MAS-WP-0007-T04
|
||||
status: todo
|
||||
priority: high
|
||||
```
|
||||
|
||||
Test the render without a cluster. Power `off` sets both Deployment
|
||||
replicas to 0 and leaves the Service, PVC, Ingress, and ExternalSecret
|
||||
in place. Power `on` leaves `replicas: 1`. The image placeholder is
|
||||
replaced. The operator command has no delete of those durable objects.
|
||||
Loading…
Add table
Add a link
Reference in a new issue