From e8fd86a1bd6e8f814d3e61920133dc7bf11420dc Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 1 Nov 2026 22:40:25 +0100 Subject: [PATCH] Retarget MAS-WP-0007 from teardown to a switchable facility. The founder withdrew retirement on 2026-11-01. The teardown task is cancelled. New tasks cover the facility contract, an on/off switch that keeps evidence and DNS, and offline tests. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd --- WORK-RECORDS.md | 7 +- ...AS-WP-0007-retire-live-test-environment.md | 68 --------- workplans/MAS-WP-0007-switchable-facility.md | 136 ++++++++++++++++++ 3 files changed, 141 insertions(+), 70 deletions(-) delete mode 100644 workplans/MAS-WP-0007-retire-live-test-environment.md create mode 100644 workplans/MAS-WP-0007-switchable-facility.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 0e27972..5173dfb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -14,7 +14,7 @@ | workplan | MAS-WP-0004 | finished | — | workplans/MAS-WP-0004-postfix-integration-profile.md | | workplan | MAS-WP-0005 | finished | — | workplans/MAS-WP-0005-spec-errata-v0-1-1.md | | workplan | MAS-WP-0006 | finished | — | workplans/MAS-WP-0006-address-composer.md | -| workplan | MAS-WP-0007 | active | — | workplans/MAS-WP-0007-retire-live-test-environment.md | +| workplan | MAS-WP-0007 | active | — | workplans/MAS-WP-0007-switchable-facility.md | | workplan | MAS-WP-0008 | finished | — | workplans/MAS-WP-0008-finalize-v0-2.md | | workplan | MAS-WP-0009 | finished | — | workplans/MAS-WP-0009-declare-v0-2-final.md | | workplan | MAS-WP-0010 | finished | — | workplans/MAS-WP-0010-mode-reference-implementation.md | @@ -60,7 +60,10 @@ | task | MAS-WP-0005-T13 | done | — | workplans/MAS-WP-0005-spec-errata-v0-1-1.md | | task | MAS-WP-0006-T01 | done | — | workplans/MAS-WP-0006-address-composer.md | | task | MAS-WP-0006-T02 | done | — | workplans/MAS-WP-0006-address-composer.md | -| task | MAS-WP-0007-T01 | wait | — | workplans/MAS-WP-0007-retire-live-test-environment.md | +| task | MAS-WP-0007-T01 | cancel | — | workplans/MAS-WP-0007-switchable-facility.md | +| task | MAS-WP-0007-T02 | todo | — | workplans/MAS-WP-0007-switchable-facility.md | +| task | MAS-WP-0007-T03 | todo | — | workplans/MAS-WP-0007-switchable-facility.md | +| task | MAS-WP-0007-T04 | todo | — | workplans/MAS-WP-0007-switchable-facility.md | | task | MAS-WP-0008-T01 | done | — | workplans/MAS-WP-0008-finalize-v0-2.md | | task | MAS-WP-0009-T01 | done | — | workplans/MAS-WP-0009-declare-v0-2-final.md | | task | MAS-WP-0009-T02 | done | — | workplans/MAS-WP-0009-declare-v0-2-final.md | diff --git a/workplans/MAS-WP-0007-retire-live-test-environment.md b/workplans/MAS-WP-0007-retire-live-test-environment.md deleted file mode 100644 index 3da1eed..0000000 --- a/workplans/MAS-WP-0007-retire-live-test-environment.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -id: MAS-WP-0007 -type: workplan -title: "Retire the MAS live test environment" -domain: communication -repo: mail-address-semantics -status: active -owner: claude -topic_slug: coulomb-social -created: "2026-10-18" -updated: "2026-10-19" -origin: residual -origin_ref: MAS-WP-0003 -state_hub_workstream_id: "03751989-8ed1-5a3f-bcc3-71aef8b375a6" ---- - -# Retire the MAS live test environment - -Residual of MAS-WP-0003. The live MX for `mas.coulomb.social` stays up for -follow-up validation (founder, 2026-10-18), capped at 300 sent replies. -Retire it once MAS-WP-0004 and MAS-WP-0005 no longer need it. Cluster-scoped -and external pieces do not disappear when the namespace is deleted. - -**Founder decision (2026-10-19): redeploy, then keep.** The MX stays up for -a second deployment (MAS-WP-0009) or for live validation of the mode -contract. Retirement stays in backlog. - -- 2026-10-19: redeployed `mas-mx` and `mas-statute` with image - `mas-live:v0.2-a95f848`, side-loaded into k3s containerd. The previous - image was `v0.2-a45f1a1`. The evidence (`events.jsonl`, 36 events, and - `tickets.sqlite3`) was backed up before the rollout and is intact on the - PVC. Checked: `mas discover` valid; the profile's relay control; TEM - relay with null-sender discard; OpenDKIM/OpenDMARC running; the ticket - service runs with `--max-sent 300 --require-dmarc-pass`; empty queue; - relaying to the public IP refused with 554 (`x@other`, `x!y@other`, - `a@mas...@other`). - -- 2026-10-19: redeployed with image `mas-live:v0.2-480e69a`: MAS-WP-0012's - one outbound path, and v0.2 final. The evidence was backed up first. The - legacy outbox was imported once into `tickets-outbox.sqlite3`: 9 rows, - 4 sent, so 4 of 300 count toward the cap. The ticket service runs with - `--max-sent 300 --require-dmarc-pass --email-held-duration-max 7d - --emails-held-storage-max 100MB`. Checked: statute valid, 36 evidence - events intact, TEM relay with null-sender discard, empty queue, relaying - refused with 554. The migration was first tested in the image against a - copy of the live volume. - -## Retire the environment - -```task -id: MAS-WP-0007-T01 -status: wait -priority: medium -state_hub_task_id: "e0a65837-1769-5129-b258-fbaeb3047f62" -``` - -Run when follow-up validation is done: -1. Export the evidence (`/var/lib/mas/events.jsonl` and the ticket DB from - the `mas-mx` pod) into the repo or an archive. -2. Delete namespace `mas`. -3. Notify ops-mason to remove OpenBao role `external-secrets-mas-tem-relay`, - policy `workload-kv-read-mas-tem-relay` and KV path - `platform/suppliers/scaleway/mas-tem-relay` (MASON-WP-0014 teardown). -4. Founder: revoke the Scaleway TEM API key and remove the TEM domain. -5. Founder: remove the `mas.coulomb.social` MX, A, SPF and DKIM records at - IONOS, the `mas-fwd@coulomb.social` forward, and the - `coulomb-social` Google Group if no longer used. -6. Remove the side-loaded `mas-live:wp0003-*` images from k3s containerd. diff --git a/workplans/MAS-WP-0007-switchable-facility.md b/workplans/MAS-WP-0007-switchable-facility.md new file mode 100644 index 0000000..5546cf5 --- /dev/null +++ b/workplans/MAS-WP-0007-switchable-facility.md @@ -0,0 +1,136 @@ +--- +id: MAS-WP-0007 +type: workplan +title: "Operate MAS as a switchable facility" +domain: communication +repo: mail-address-semantics +status: active +owner: claude +topic_slug: coulomb-social +created: "2026-10-18" +updated: "2026-11-01" +origin: residual +origin_ref: MAS-WP-0003 +state_hub_workstream_id: "03751989-8ed1-5a3f-bcc3-71aef8b375a6" +--- + +# Operate MAS as a switchable facility + +Residual of MAS-WP-0003. Namespace `mas` is the MAS facility for +`mas.coulomb.social`, with replies through Scaleway TEM capped at 300. +It stays. The 2026-10-19 retirement backlog is withdrawn. + +**Founder decision (2026-11-01): keep it, and make it switchable.** Do not +delete the namespace, revoke the TEM key, remove DNS, or tear down the +OpenBao role. Operate the existing facility so mail and the statute can +be turned off and back on without discarding evidence, credentials, or +the public address. + +The 2026-10-19 redeploy record stays part of this workplan: + +- 2026-10-19: redeployed `mas-mx` and `mas-statute` with image + `mas-live:v0.2-a95f848`, side-loaded into k3s containerd. The previous + image was `v0.2-a45f1a1`. The evidence (`events.jsonl`, 36 events, and + `tickets.sqlite3`) was backed up before the rollout and is intact on the + PVC. Checked: `mas discover` valid; the profile's relay control; TEM + relay with null-sender discard; OpenDKIM/OpenDMARC running; the ticket + service runs with `--max-sent 300 --require-dmarc-pass`; empty queue; + relaying to the public IP refused with 554 (`x@other`, `x!y@other`, + `a@mas...@other`). + +- 2026-10-19: redeployed with image `mas-live:v0.2-480e69a`: MAS-WP-0012's + one outbound path, and v0.2 final. The evidence was backed up first. The + legacy outbox was imported once into `tickets-outbox.sqlite3`: 9 rows, + 4 sent, so 4 of 300 count toward the cap. The ticket service runs with + `--max-sent 300 --require-dmarc-pass --email-held-duration-max 7d + --emails-held-storage-max 100MB`. Checked: statute valid, 36 evidence + events intact, TEM relay with null-sender discard, empty queue, relaying + refused with 554. The migration was first tested in the image against a + copy of the live volume. + +## What the facility is + +Durable parts stay when the facility is off. The power switch must not +delete or edit them: + +- namespace `mas` +- PVC `mas-evidence` (`events.jsonl`, `tickets.sqlite3`, the outbox DB) +- Services `mas-smtp` (LoadBalancer) and `mas-statute` +- Ingress `mas-statute` and its TLS secret +- ExternalSecret `mas-relay`, its SecretStore, and ServiceAccount +- OpenBao role `external-secrets-mas-tem-relay`, policy + `workload-kv-read-mas-tem-relay`, and KV path + `platform/suppliers/scaleway/mas-tem-relay` +- DNS for `mas.coulomb.social`, the TEM domain, and the TEM API key + +Switchable parts are the two Deployments, `mas-mx` and `mas-statute`. +Off means both `replicas: 0`. The LoadBalancer keeps its address and has +no ready pods, so port 25 takes no mail, and the statute ingress has no +backend. On means both `replicas: 1` and ready, on the same PVC and image. + +Known limits, unchanged by this workplan: one replica, a side-loaded +image, snakeoil SMTP TLS, and the 300-reply cap. A later decision can +raise any of those. This workplan does not roll a new image and does not +turn the live facility off. + +## Retire the teardown + +```task +id: MAS-WP-0007-T01 +status: cancel +priority: medium +state_hub_task_id: "e0a65837-1769-5129-b258-fbaeb3047f62" +``` + +Cancelled 2026-11-01. The founder withdrew retirement. Do not export for +teardown, delete namespace `mas`, ask ops-mason to remove the OpenBao +role, revoke the Scaleway TEM key, remove DNS, or delete the side-loaded +images. + +## Record the facility contract + +```task +id: MAS-WP-0007-T02 +status: todo +priority: high +``` + +Update the current-direction docs so they describe a kept, switchable +facility. `SCOPE.md` and INTENT.md phase-2 criterion 5 stop saying the +live environment is retired. `deploy/railiance/` states the durable and +switchable parts and the limits above. The release-unit note stops +calling this something other than the operated facility. Historical +workplans and `history/` stay as they were. + +## Add the power switch + +```task +id: MAS-WP-0007-T03 +status: todo +priority: high +``` + +Add an operator command, `on`, `off`, and `status`, that scales only +`deploy/mas-mx` and `deploy/mas-statute`. It records the desired power on +namespace `mas` as annotation `mas.coulomb.social/power`. The supported +apply path reads that annotation and renders `replicas: 0` when the +facility is off, so a later apply does not turn it back on. Missing +annotation means on, which matches the manifest and the live facility. +The command must not delete the namespace, volume, secrets, services, or +ingress. + +On the cluster, record `power=on` to match the running facility. Do not +scale it to 0 and do not roll a new image. + +## Test the switch offline + +```task +id: MAS-WP-0007-T04 +status: todo +priority: high +``` + +Test the render without a cluster. Power `off` sets both Deployment +replicas to 0 and leaves the Service, PVC, Ingress, and ExternalSecret +in place. Power `on` leaves `replicas: 1`. The image placeholder is +replaced. The operator command has no delete of those durable objects.