coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Move portal workloads to registry digests
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-07-30 00:25:16 +02:00
parent 52b57c99f7
commit f854969a01
6 changed files with 42 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/NK-WP-0023-user-engine-portal-platform-integration.md
View file

@ -194,6 +194,25 @@ The remaining production gaps are registry publication and an independently
custodied/off-node backup copy; the current PVC shares reef-railiance's single
failure domain, so T05 remains in progress.
2026-07-30 follow-up: both former gaps are implemented. The activity-core
ExternalSecret boundary published the portal and provisioner images to
`forgejo.coulomb.social` without exposing the package credential. Anonymous
digest inspection passed, and both live Deployments now pull immutable public
digests. The prior verified portal image is also published by digest;
rollback/roll-forward passed without node-local image reliance.
The established Option A activity-core lane produced and uploaded
`user-engine-pg-user_engine-20260729T220653Z.dump.age` to independent
Nextcloud custody. The plaintext dump was removed immediately and only
non-secret sizes and the artifact name were recorded. The local isolated
restore drill already proves the same logical dump/restore path.
The final T05 custody residual is narrower: `user-engine-runtime/proxy-secret`
and `identity-provisioner-client/token` remain bootstrap Kubernetes Secrets.
They must move to an OpenBao-owned path plus ExternalSecret and a rotation
procedure. Creating that new write/custody lane requires the ops-mason
executive approval gate; registry and backup work do not remain open.
## T06 - Prove role-scoped administration and failure safety
```task