ci: define additive k3s debug golden #119

Merged

L0GYKAL merged 18 commits from docs/k3s-debug-golden-additive into main 2026-10-25 15:35:47 +01:00

Conversation 0 Commits 18 Files changed 23 +1460 -75

L0GYKAL commented 2026-10-18 18:08:15 +02:00

Owner

Copy link

Outcome

Define a separate k3s-debug-golden CI image and debug VM artifact. Existing sim-golden and nexus-golden identities and bytes remain unchanged.

Descriptor v2 remains unchanged and closed to its authenticated top-level source-sha binding plus exactly the sim and nexus golden-artifact roles. The new artifact stays debug-only until a separate reviewed contract defines signed config-bundle binding, staging, verification, atomic activation, and rollback.

The generic image-producer workflow remains exactly 120 minutes. Any future 180-minute debug exception requires a dedicated shared workflow profile whose verifier proves that only a debug candidate materializes the third artifact.

This PR does not define or activate a live k3s-debug runner, does not authorize production lookup, and does not change either existing image.

Test-first evidence

• A 180-minute generic producer fixture is rejected.
• Descriptor-v2 release validation continues to require the exact source commit.
• bash scripts/tests/audit-spoke-ci.test.sh passes.
• bash scripts/tests/check-release-report.test.sh passes.
• git diff --check passes.

Supersedes the rejected interpretation in closed PR #118; it does not reopen or reuse that branch. No merge is authorized by this submission.

## Outcome Define a separate `k3s-debug-golden` CI image and debug VM artifact. Existing `sim-golden` and `nexus-golden` identities and bytes remain unchanged. Descriptor v2 remains unchanged and closed to its authenticated top-level `source-sha` binding plus exactly the `sim` and `nexus` golden-artifact roles. The new artifact stays debug-only until a separate reviewed contract defines signed config-bundle binding, staging, verification, atomic activation, and rollback. The generic image-producer workflow remains exactly 120 minutes. Any future 180-minute debug exception requires a dedicated shared workflow profile whose verifier proves that only a debug candidate materializes the third artifact. This PR does not define or activate a live `k3s-debug` runner, does not authorize production lookup, and does not change either existing image. ## Test-first evidence - A 180-minute generic producer fixture is rejected. - Descriptor-v2 release validation continues to require the exact source commit. - `bash scripts/tests/audit-spoke-ci.test.sh` passes. - `bash scripts/tests/check-release-report.test.sh` passes. - `git diff --check` passes. Supersedes the rejected interpretation in closed PR #118; it does not reopen or reuse that branch. No merge is authorized by this submission.

L0GYKAL added 1 commit 2026-10-18 18:08:15 +02:00

ci: define additive k3s debug golden ea8343f9b0

L0GYKAL added 1 commit 2026-10-18 18:24:58 +02:00

ci(adr-0030): bound third-artifact assembly timeout ffd4d2b9b3

L0GYKAL added 1 commit 2026-10-18 19:14:37 +02:00

ci(ADR-0030 §1, §3a): close descriptor and timeout contracts 22f7e9c085

L0GYKAL added 2 commits 2026-10-19 10:54:23 +02:00

docs(adr-0026-S2): keep K3s image activation-free 5b1a95dc63

docs(adr-0030-S3): retain standard image timeout 49b9735020

L0GYKAL added 1 commit 2026-10-20 12:46:21 +02:00

docs(adr-0030-S1): preserve descriptor v2 bytes c1aafde15d

L0GYKAL added 1 commit 2026-10-20 12:56:19 +02:00

test(adr-0030-S1): bind descriptor schema semantically bf963337fe

L0GYKAL added 1 commit 2026-10-20 13:00:56 +02:00

fix(publication): bind debug source inputs 0a5f73348a

L0GYKAL added 1 commit 2026-10-20 15:25:20 +02:00

ci: bind debug K3s artifact bundle member d6ae82fdbf

L0GYKAL added 1 commit 2026-10-20 15:31:17 +02:00

ci: require the derived K3s debug member d64360da85

L0GYKAL added 1 commit 2026-10-20 16:00:52 +02:00

ci: verify debug golden publication DAG b97924d3e1

L0GYKAL added 1 commit 2026-10-20 16:21:10 +02:00

docs(adr-0030): bind debug golden resource authority f71896e0eb

L0GYKAL added 1 commit 2026-10-21 12:28:31 +02:00

ci: bind direct K3s runner capacity 868a919817

L0GYKAL added 1 commit 2026-10-24 09:15:19 +02:00

ci(adr-0011-S2): allow complete additive image assembly b22cae016e

L0GYKAL added 1 commit 2026-10-24 10:41:26 +02:00

fix(adr-0030-S3): admit bounded K3s debug resize 886dc89244

L0GYKAL added 1 commit 2026-10-24 11:53:16 +02:00

fix(adr-0030-S3): verify debug K3s source projection 774818f05e

L0GYKAL added 1 commit 2026-10-24 12:57:49 +02:00

fix(adr-0030-S3): verify K3s manifest image pins 4df5492e29

L0GYKAL added 1 commit 2026-10-24 14:02:05 +02:00

fix(adr-0030-S3): publish additive K3s golden DAG 1b8905d33e

L0GYKAL merged commit ee9896588e into main 2026-10-25 15:35:47 +01:00

L0GYKAL referenced this pull request from a commit 2026-10-25 15:35:52 +01:00

Merge pull request 'ci: define additive k3s debug golden' (#119) from docs/k3s-debug-golden-additive into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

L0GYKAL/the-rules!119

No description provided.