docs(adr-0031 S3): require isolated debug template bundles #60

Open

L0GYKAL wants to merge 0 commits from docs/template-debug-contract into main

pull from: docs/template-debug-contract

merge into: L0GYKAL:main

L0GYKAL:main

L0GYKAL:docs/k3s-debug-golden-additive

L0GYKAL:fix/pr119-preserve-descriptor-v2

L0GYKAL:feat/minecraft-public-layer4

L0GYKAL:docs/k3s-sim-golden-contract

L0GYKAL:docs/remove-premature-thornhill-rule

L0GYKAL:fix/local-rpm-package-closures

L0GYKAL:fix/vm-heavy-runner-admission

L0GYKAL:feat/minecraft-l4-contract

L0GYKAL:feat/k3s-spoke-ci-profile

L0GYKAL:fix/readonly-credential-idmap

L0GYKAL:fix/native-parity-timeout-120

L0GYKAL:fix/allow-auxiliary-published-images

L0GYKAL:fix/template-source-feed-contract

L0GYKAL:fix/simulation-network-grant-contract

L0GYKAL:fix/generic-spoke-workflow-contract

L0GYKAL:audit/merged-strict-contract

L0GYKAL:fix/canonical-spoke-debug-cache-contract

L0GYKAL:fix/debug-only-spoke-pr-gate

L0GYKAL:fix/retire-published-candidate

L0GYKAL:fix/blade-readback-space-compat

L0GYKAL:fix/post-publish-readback-space

L0GYKAL:fix/restore-release-auth-after-cache

L0GYKAL:fix/image-assembly-timeout

L0GYKAL:fix/nonroot-systemd-credential-bind

L0GYKAL:fix/strict-image-cache-registry

L0GYKAL:fix/restore-release-contract

L0GYKAL:fix/nested-index-readback

L0GYKAL:fix/nested-index-publication

L0GYKAL:fix/operator-local-cache-transport

L0GYKAL:fix/preserve-publication-digests

L0GYKAL:fix/preserve-registry-readback

L0GYKAL:fix/signed-tag-release

L0GYKAL:fix/publication-measurement-evidence

L0GYKAL:fix/verify-canonical-resource-copy

L0GYKAL:fix/staged-resource-projection

L0GYKAL:ci/nexus-k3s-selinux

L0GYKAL:fix/canonical-simulation-resource-projection

L0GYKAL:fix/publication-template-binding

L0GYKAL:fix/publication-template-rust-env

L0GYKAL:fix/bounded-registry-readback

L0GYKAL:fix/oci-layout-root-selection

L0GYKAL:fix/digest-only-registry-readback

L0GYKAL:fix/http-registry-readback

L0GYKAL:fix/remove-publisher-broker

L0GYKAL:fix/release-report-emitted-image-set

L0GYKAL:ci/stable-release-gate

L0GYKAL:fix/config-only-runtime-enumerator

L0GYKAL:fix/config-only-empty-runtime

L0GYKAL:fix/nexus-rust-env

L0GYKAL:fix/ephemeral-vm-cleanup-contract

L0GYKAL:feat/admission-scheduler-readiness

L0GYKAL:feat/standardize-ci-contracts

L0GYKAL:docs/adr-0033-task-scoped-publisher

L0GYKAL:docs/adr-0032-spoke-dependencies

L0GYKAL:ci/rust-producer-rules-checkout

L0GYKAL:docs/adr-0031-reserved-metadata

L0GYKAL:ci/writable-nexus-cargo-cache

L0GYKAL:ci/split-conformance-runners

L0GYKAL:ci/standardized-spoke-image-workflow

L0GYKAL:ci/0031-simulation-admission

L0GYKAL:fix/vendored-template-validator

L0GYKAL:docs/adr-template-ci

L0GYKAL:docs/adr0030-bib-materializer

L0GYKAL:ci/0030-prebuilt-golden-artifacts

L0GYKAL:ci/label-pulse-cold-start

L0GYKAL:ci/0027-authoritative-sim-plan

L0GYKAL:ci/optional-debug-images

L0GYKAL:ci/local-registry-publication

L0GYKAL:ci/0026-adaptive-nexus-memory

L0GYKAL:ci/0026-native-nexus-builds

L0GYKAL:ci/0025-resource-aware-bursts

L0GYKAL:ci/off-crucible

L0GYKAL:ci/0025-crucible-image-tiers

L0GYKAL:feat/spoke-conformance-and-oci-verification

L0GYKAL:ci/container-template-crucible-hostmode

L0GYKAL:docs/ci-0023-oci-spoke-config-bundle

L0GYKAL:docs/adr-0023-oci-spoke-config-distribution

L0GYKAL:docs/adr-0029-release-signing-flow

L0GYKAL:ci/howto-trigger-heavy-ci

L0GYKAL:ci/quadlet-only-host-mode

L0GYKAL:docs/adr-0025-rumdl

L0GYKAL:ci/lint-rumdl

L0GYKAL:docs/0028-distributed-worker-plane

L0GYKAL:ci/lint-runs-on-crucible-light

L0GYKAL:ci/lint-runs-on-crucible

L0GYKAL:feat/sim-test-tiers-allowlist

L0GYKAL:docs/adr-0026-api-error-envelope

L0GYKAL:ci/0025-runner-orchestrator

L0GYKAL:feat/spoke-ci-image-publish-template

L0GYKAL:adr/0024-watcher-local-spoke-image-builds

L0GYKAL:docs/adr-0011-s2-ci-pr-only-trigger

L0GYKAL:docs/adr-0023-spoke-runner-native-ci

L0GYKAL:ci/signed-tag-release-policy

L0GYKAL:docs/ci-log-howto-2026-06-11

L0GYKAL:docs/ci-log-access-guide

L0GYKAL:docs/adr-0011-s8-github-token-amendment

L0GYKAL:fix/spoke-ci-audit-clone-and-container-checks

L0GYKAL:docs/add-ci-log-access-to-index

L0GYKAL:feat/spoke-scaffolder

L0GYKAL:docs/adr-0011-amend-vfs-and-tag-gate-2026-06-12

L0GYKAL:fix/ci-0011-amendments-s4-s8-2026-06-10

L0GYKAL:feat/templates-and-stamper-in-the-rules-2026-06-10

L0GYKAL:fix/ci-0020-spoke-ci-test-mode-unit-2026-06-10

L0GYKAL:feat/adr-spoke-permissions-grant-2026-06-10

L0GYKAL:feat/index-and-subfolders-2026-06-10

L0GYKAL:feat/ci-0020-test-spoke-discriminator-2026-06-10

L0GYKAL:feat/adr-0022-amendments-per-operator-review-2026-06-10

L0GYKAL:feat/rule-21-declarative-reproducibility-2026-06-10

L0GYKAL:docs/adr-0012-amendment-band-0b-reality-2026-06-08

L0GYKAL:ci/lint-formatting-2026-06-08

L0GYKAL:docs/adr-0012-capacity-managed-ephemeral-runners-2026-06-08

Conversation 0 Commits - Files changed -

L0GYKAL commented 2026-08-24 02:40:47 +02:00

Owner

Copy link

Summary

• require the optional ci:debug label gate only after mandatory Spinner audit/template validation
• publish unsigned debug-pr-* bundles only from Nexus into the operator-local l0gykal/debug namespace
• keep optional diagnostics outside production release gates and require a Hub adoption decision record
• update the canonical stampable workflow and fail-closed behavioral audit fixtures

Cumulative base verification

Current origin/main is b41f19fbaf and contains PR55 eecbe886, PR56 aa80a244, PR58 02b4ac83, and PR59 b41f19f as ancestors. This PR is one commit on that exact cumulative base.

Verification

• python3 scripts/lint-rules.py --all
• python3 scripts/test-lint-rules.py (14/14)
• all contract fixture commands from .forgejo/workflows/lint.yaml
• scripts/tests/audit-devbox-template-ci.test.sh
• git diff --check

All passed locally. No merge requested until Forge CI is exactly green.

## Summary - require the optional ci:debug label gate only after mandatory Spinner audit/template validation - publish unsigned debug-pr-* bundles only from Nexus into the operator-local l0gykal/debug namespace - keep optional diagnostics outside production release gates and require a Hub adoption decision record - update the canonical stampable workflow and fail-closed behavioral audit fixtures ## Cumulative base verification Current origin/main is b41f19fbafcfcb532840b24eb0e8bc1e387175fb and contains PR55 eecbe886, PR56 aa80a244, PR58 02b4ac83, and PR59 b41f19f as ancestors. This PR is one commit on that exact cumulative base. ## Verification - python3 scripts/lint-rules.py --all - python3 scripts/test-lint-rules.py (14/14) - all contract fixture commands from .forgejo/workflows/lint.yaml - scripts/tests/audit-devbox-template-ci.test.sh - git diff --check All passed locally. No merge requested until Forge CI is exactly green.

L0GYKAL added 1 commit 2026-08-24 02:40:47 +02:00

docs(adr-0031-S3): require isolated debug bundles be7ff0a4cd

L0GYKAL added 1 commit 2026-08-24 03:03:06 +02:00

fix(ci): avoid duplicate producer assembly d0c7be7063

L0GYKAL added 2 commits 2026-08-24 04:05:57 +02:00

docs(adr-0030-S3a): bind exact RPM closure identity 62fbdf7265

fix(ci): normalize pinned OCI pull references 1a1565442c

L0GYKAL added 1 commit 2026-08-24 04:15:47 +02:00

docs(adr-0030-S3a): bind package install reason e77b0ec115

L0GYKAL added 1 commit 2026-08-24 04:23:30 +02:00

fix(ci): preserve pinned multi-arch OCI roots 22e0966da1

L0GYKAL added 1 commit 2026-08-24 04:28:19 +02:00

fix(ci): preserve immutable OCI digest bytes b4888a7674

L0GYKAL added 1 commit 2026-08-24 04:39:22 +02:00

fix(ci): isolate replaceable candidate state f8cc61291e

L0GYKAL added 1 commit 2026-08-24 04:59:17 +02:00

fix(ci): retry immutable OCI copies in place 110bbdc631

L0GYKAL added 1 commit 2026-08-24 05:20:54 +02:00

fix(ci): gate optional Nexus publication work b5abd59063

L0GYKAL added 1 commit 2026-08-24 05:36:33 +02:00

fix(ci): verify authoritative spoke identity f2599708fc

L0GYKAL added 1 commit 2026-08-24 05:40:07 +02:00

fix(ci): normalize inline OCI descriptor data 981094736b

L0GYKAL added 1 commit 2026-08-24 06:17:52 +02:00

fix(ci): prevent duplicate publisher Rust work edd2e4a70a

L0GYKAL added 1 commit 2026-08-24 08:38:44 +02:00

fix(ci): consume controller publisher identity 3a86f333a2

L0GYKAL added 1 commit 2026-08-24 09:49:38 +02:00

fix(ci): preserve baked Rust in release parity 4b45d8195c

L0GYKAL added 1 commit 2026-08-24 10:36:26 +02:00

Merge remote-tracking branch 'origin/main' into docs/template-debug-contract 2d4e678896

Some checks are pending

Hide all checks

lint / lint (pull_request) Successful in 1m30s

Details

lint / release-gate (pull_request)

Required

This branch is already included in the target branch. There is nothing to merge.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin docs/template-debug-contract:docs/template-debug-contract

git switch docs/template-debug-contract

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

L0GYKAL/the-rules!60

No description provided.