coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T07 done: conventions enforced in CI; owner requests sent to six repos
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-06 00:38:57 +01:00
parent cd265b84a4
commit d0fb5dd4aa
2 changed files with 34 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -376,7 +376,7 @@
| task | NK-WP-0058-T04 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T05 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T06 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T07 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T07 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T08 | todo | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T09 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |
| task | NK-WP-0058-T10 | done | — | workplans/NK-WP-0058-bounded-execution-operability.md |

34
workplans/NK-WP-0058-bounded-execution-operability.md
View file

@ -479,7 +479,7 @@ The open check from 2026-11-05 on the overnight window is T11.
```task
id: NK-WP-0058-T07
status: todo
status: done
priority: medium
assignee: claude-code
state_hub_task_id: "a99424ed-ee8b-5db4-9fa7-2ae5fc32c39c"
@ -502,6 +502,38 @@ Prefer a lint or a test over prose, and remove the hard-coded and duplicated bit
**Done when:** the conventions are enforced by a test or lint in CI for the net-kingdom and rapp runbooks and tools,
and the owner requests for other repos are sent and recorded.
**Result, 2026-11-06.** `tools/conventions/lint.py` (`make conventions-lint`) has five rules:
- `server-side-apply`;
- `one-wait-condition`;
- `one-cluster-route`;
- `tool-numbered-receipts`;
- `managing-controller`, which reads the paths Argo owns from railiance-platform's `argocd/`.
Records (evidence, history, proposals, workplans, wiki) are not checked. Seven exceptions are listed in the tool,
each with its reason: two quoted or legacy texts, three node-local commands, three completed one-time runbooks, and
the inventory itself. The lint runs in net-kingdom's contract suite (with 14 tests) and in the rapp's packaging CI
(rapp `78ed50c`).
**Fixed here:**
- 21 runbook applies are now server-side.
- `portal-client-rollout.py` (and so `keycape-client.py` and the KeyCape rollout tools) and
`identity-provisioner-reconcile.py` use `NK_KUBECONFIG`, default `~/.kube/config-railiance01`. They no longer
use a second kubeconfig with a `--server` override to the same API.
- The T06 runbook's section 4 note and the bind-split runbook's `K=` line follow the same route.
- `bx` already numbers receipts and polls instead of using `kubectl wait`.
**Owner requests:**
- the lint findings in six repos: railiance-platform 57 (`c8371e0d`), audit-core 14 (`9e57fd89`),
informed-decision 4, including one `managing-controller` in its own release runbook (`7da9abe8`), approval-engine
3 (`41b19d89`), access-engine 2 (`abe7e149`) and key-cape 2 (`573f56a1`);
- warden stripping every token variable: ops-warden (`4acb653c`, from T10 O2);
- audit-core's seeder hard-coded path: the lint reports it under `one-cluster-route` in `9e57fd89`.
**Observed, not caused here:** `sso-mfa/k8s/keycape` and `sso-mfa/k8s/lldap` have 7 failing tests and 11 that can't
be collected (`warden` not importable), identical before and after this change. No CI runs them. That's a candidate
for an ad hoc task.
### Multi-repo worker protocol
```task