coulomb/railiance-apps
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
104 commits 1 branch 0 tags 319 KiB
Commit graph

104 commits

This branch
This branch
All branches
Author SHA1 Message Date
tegwick
85e9163bb0 Point reuse-surface token export handoff at OpenBao path
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Primary operator fetch is bao kv get per RAILIANCE-WP-0011-T03; kubectl
remains break-glass when OpenBao is unreachable.
 2026-07-07 22:38:45 +02:00
tegwick
40f0cb741d Deploy reuse-surface runtime secrets via OpenBao External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 48s
Details 
Add openbao-reuse ClusterSecretStore handoff, reuse-surface-runtime
ExternalSecret, ESO token bootstrap script, and Makefile targets for
CCR-2026-0005 / RAILIANCE-WP-0011.
 2026-07-07 22:34:34 +02:00
tegwick
3a9236148a Add Forgejo T05 verify, operator bootstrap, and security hardening
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.
 2026-07-07 22:09:53 +02:00
tegwick
9b31f229e8 Document reuse-surface runtime secrets and Forgejo org webhook
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Add runbook coverage for REUSE_SURFACE_TOKEN and
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET in reuse-surface-env, plus an
idempotent make reuse-forgejo-webhook target that wires the coulomb org
push webhook to the hub receiver.
 2026-07-07 21:28:46 +02:00
tegwick
8f4486f978 Add SOPS-encrypted Forgejo runner registration secret
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Capture the in-cluster forgejo-runner-registration token into Git so
runner redeploys do not depend on a one-off kubectl create secret.
 2026-07-07 20:56:11 +02:00
tegwick
bcb05f5d95 Record e3ae22e deploy and flag /health ingress routing bug
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details 
Found while smoke-testing the REUSE-WP-0019-T01/T02 deploy: GET
/v1/federated works (200) but the exact-path /health rule 404s at the
Traefik edge, shadowed by the catch-all / rule to reuse-surface-landing.
Confirmed pod/service-level health is fine (direct port-forward works,
readiness/liveness probes pass, pod is 1/1 Ready) -- this is an ingress
routing config issue affecting external monitoring only, not the API
itself. Not fixed here; needs a Traefik router priority annotation on
charts/reuse-surface/templates/ingress.yaml, a deliberate change to shared
production ingress outside this task's scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-07 20:14:29 +02:00
tegwick
a2c0da13c2 Deploy reuse-surface e3ae22e (REUSE-WP-0019-T01/T02)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Image update for the forge-host-abstraction and hub-webhook work:
composed_at/stale tracking on GET /v1/federated, new POST
/v1/webhooks/forgejo receiver (fails closed to 503 until
REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET is added to the reuse-surface-env
Secret -- deliberately not added yet, needs separate explicit
authorization for a production secret write), and the migrated
activity-core/state-hub Forgejo raw URLs already visible in the composed
index.

Live-verified post-deploy: /v1/federated (61 capabilities, composed_at/
stale fields present), /v1/repos, and a forced POST /v1/federated/compose
recompose all correct.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-07 20:13:09 +02:00
tegwick
3e211a1cb4 Fix Forgejo IONOS SMTP: STARTTLS on smtp.ionos.de
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details 
Use PROTOCOL=smtp+starttls with the EU relay (smtp.ionos.de). Port 587 with
implicit TLS on smtp.ionos.com failed TLS handshake; .com auth also fails for
EU mailboxes. Document OpenBao PASSWD field mapping in operator docs.
 2026-07-07 16:40:12 +02:00
tegwick
d61173d66e Fix Forgejo mailer ESO field mapping and token bootstrap env
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 4s
Details 
Map OpenBao key PASSWD to Secret MAILER_PASSWD so ExternalSecret syncs
against the live coulombcore path. Allow non-interactive bootstrap via
OPENBAO_TOKEN_FILE for make forgejo-openbao-eso-token-apply.
 2026-07-07 15:21:40 +02:00
tegwick
844a3503bb Add interim coulombcore OpenBao token bootstrap for Forgejo mailer ESO 
Document two OpenBao instances and add forgejo-openbao-eso-token-apply for
ClusterSecretStore openbao-forgejo on bao.coulomb.social.
 2026-07-07 14:35:49 +02:00
tegwick
d5bb4f66f2 Wire Forgejo SMTP password from OpenBao via External Secrets
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details 
Add forgejo-mailer ExternalSecret, inject GITEA__mailer__PASSWD from the
synced Secret, remove mailer from SOPS overlay, and add ESO bootstrap targets.
 2026-07-07 14:30:02 +02:00
tegwick
24c8882b69 Enable IONOS SMTP mailer for Forgejo on railiance01
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Wire forgejo@coulomb.social via smtp.ionos.com:587 in Helm values and add
SOPS-encrypted mailbox password overlay for forgejo-deploy.
 2026-07-07 02:42:46 +02:00
tegwick
efb095ea2c Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details 
Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-06 19:50:53 +02:00
tegwick
a74df4001b Add Forgejo CI smoke workflow (enablement template)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
2026-07-04 12:49:57 +02:00
tegwick
28cbd3187c Fix in-cluster runner startup and readiness probes 
Wait for DinD before starting forgejo-runner daemon; use TCP/_ping
probes so the Deployment reports available once both containers are up.
 2026-07-03 22:32:34 +02:00
tegwick
0f0b340754 Add in-cluster Forgejo Actions runner manifests (ADR-004) 
DinD sidecar + forgejo-runner Deployment with PVC-backed registration
state. Makefile targets for registration secret, deploy, and status.
 2026-07-03 22:29:27 +02:00
tegwick
f49be83f7e Enable Forgejo Actions and Recreate deployment strategy 
Actions are required for CI runners. Recreate avoids leveldb queue lock
contention on the shared PVC during Helm upgrades.
 2026-07-03 21:44:57 +02:00
tegwick
75698636c6 Deploy Forgejo on railiance01 using gitea-charts/gitea 12.5.0 
Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which
Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming).
Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).
 2026-07-03 21:28:37 +02:00
tegwick
6d00232865 Regenerate agent instructions: workstream -> workplan terminology 
Registration guidance now prescribes file-first + fix-consistency (C-06)
instead of manual create_workplan/create_workstream calls; progress-event
examples use workplan_id; legacy field names annotated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 01:47:46 +02:00
tegwick
8db47c8200 Archive closed workplans to workplans/archived/ (ADR-001) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 00:25:41 +02:00
tegwick
0ef387b8e5 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-07-02:
  - update .custodian-brief.md for railiance-apps
 2026-07-02 00:23:25 +02:00
tegwick
eedfb89c18 Repo hygiene: fill stack-and-commands, normalize workplan statuses 
- Fill .claude/rules/stack-and-commands.md (was an empty TODO template)
- Normalize workplan frontmatter statuses to canonical vocabulary
  (completed/done -> finished) per ADR-001

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-02 00:21:48 +02:00
tegwick
bf7ffa0df6 Normalize agent instructions and workplan frontmatter (STATE-WP-0067) 
- Align agent files with on-disk workplan prefixes (infer from workplan ids)
- Set workplan domain to registered domain_slug; add topic_slug where applicable
- Repair frontmatter delimiter formatting; migrate legacy task status literals
- Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates
 2026-06-22 23:16:27 +02:00
tegwick
1ba7f20627 Add .repo-classification.yaml (CUST-WP-0050 T11 agent first-pass) 2026-06-22 17:47:39 +02:00
tegwick
f5d50842bb Add credential routing instructions for all agent runtimes 
Propagate shared credential-routing section (Codex, Claude, Grok, llm-connect)
from state-hub template via scripts/propagate_credential_routing.py.
 2026-06-18 22:48:39 +02:00
tegwick
bcd9958b3c Add capability registry scaffold (REUSE-WP-0014-T06 B04) 2026-06-16 01:56:14 +02:00
tegwick
6abf75365b Harden inter-hub production deploy trigger 2026-06-15 22:44:13 +02:00
tegwick
088bc35342 Promote adhoc workplans to numbered Railiance plans 2026-06-15 22:17:23 +02:00
tegwick
c7d49d3102 Handle app deployment guardrail suggestions 2026-06-15 22:07:03 +02:00
tegwick
a1a1016b84 Fix reuse surface workplan hub linkage 2026-06-15 16:03:21 +02:00
tegwick
83a8a4ad37 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-15:
  - update .custodian-brief.md for railiance-apps
 2026-06-15 15:58:45 +02:00
tegwick
b859530fcf Add reuse service landing page 2026-06-15 15:40:57 +02:00
tegwick
b76cdb53a8 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-15:
  - update .custodian-brief.md for railiance-apps
 2026-06-15 13:56:05 +02:00
tegwick
35256c3ab9 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-15:
  - update .custodian-brief.md for railiance-apps
 2026-06-15 13:29:35 +02:00
tegwick
07ad27176e Note bootstrap removal and DNS propagation on production IP 2026-06-15 10:31:16 +02:00
tegwick
7c05877f1e Correct reuse-surface target: Railiance01 92.205.62.239 
Document production vs CoulombCore bootstrap IPs and deploy via
config-hosteurope. Public DNS for reuse.coulomb.social still wrong.
 2026-06-15 10:24:32 +02:00
tegwick
77aa0d76f5 Finish RAILIANCE-WP-0007: reuse-surface hub deployed on railiance01 
Helm revision 3 with image cb7a6e4. Runbook updated with TLS/DNS operator
guidance and smoke-check commands.
 2026-06-15 10:15:36 +02:00
tegwick
4c8a12a8a0 Bump reuse-surface image to cb7a6e4 (schema packaging fix) 2026-06-15 10:13:52 +02:00
tegwick
083e242230 Fix reuse-surface deploy: disable service links, pin image ae41395 2026-06-15 10:09:30 +02:00
tegwick
37a5c2f690 Record reuse.coulomb.social DNS; add deploy runbook; close T03 2026-06-15 09:45:17 +02:00
tegwick
25d6a2484e Rename reuse deployment to coulomb.social conventions 
Chart charts/reuse-surface, namespace reuse, host reuse.coulomb.social,
image gitea.coulomb.social/coulomb/reuse-surface, secret reuse-surface-env.
Makefile targets reuse-dry-run/deploy/status/logs.
 2026-06-15 09:02:02 +02:00
tegwick
19b65de4bd chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-15:
  - update .custodian-brief.md for railiance-apps
 2026-06-15 08:48:37 +02:00
tegwick
3dfa75d789 Add RAILIANCE-WP-0007: reuse-surface hub Helm chart on railiance01 
Companion to reuse-surface REUSE-WP-0011. Scaffold charts/reuse-surface-hub
with PVC, ingress template, values file, and Makefile deploy targets.
 2026-06-15 08:48:16 +02:00
tegwick
1bd852d177 feat(inter-hub): add Railiance app chart handoff 2026-06-14 16:47:36 +02:00
tegwick
2b46f85c55 Close issue-core package blocker 2026-06-05 20:42:31 +02:00
tegwick
a279793832 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-05:
  - update .custodian-brief.md for railiance-apps
 2026-06-05 20:36:41 +02:00
tegwick
9c2713f9c4 Close S5 app readiness workplan 2026-06-05 17:59:35 +02:00
tegwick
3e2eae6b14 chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-05:
  - update .custodian-brief.md for railiance-apps
 2026-06-05 17:56:21 +02:00
tegwick
0ae9bca830 Decommission forge compatibility pointers 2026-06-05 17:33:52 +02:00
tegwick
1fa503c16d chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-06-05:
  - update .custodian-brief.md for railiance-apps
 2026-06-05 17:30:08 +02:00