Record identity plan export and pending review-guard correction #50

Merged

gitchegumi merged 1 commit from kiyi/identity-plan-readiness into main

2026-10-15 21:36:17 -05:00

kiyi commented

2026-10-15 20:02:03 -05:00

Member

Reconcile current platform, delivery, storage and decisions pages after Documentation #49. A credential-free mocked reproduction found that known collection markers such as [false] are rejected by the identity guard. Workflows #107 prepares the correction; it still needs review, release and promotion before a fresh owning plan. Keep successful plan review/apply, workload credential issuance, full Terraform concurrency/recovery and RKE2/Core upgrades as separate pending acceptance. Public pages contain no private repository URLs, credential values, provider logs or plans.

Validation at 5050bb8: npm run check, default npm run build, native staged Gitleaks 8.30.1 and diff checks passed. Hosted checks remain required. This documentation PR can merge independently; it records the workflow fix as prepared, not released or accepted live.

Record the bounded result of private Terraform run 69 on 2026-10-15: backend initialization, validation, planning and JSON plan export completed, then public plan review stopped before producing an approval fingerprint. No apply or live workload identity change occurred. The recorded RKE2 claims are now merged in private Terraform PR 13. Reconcile current platform, delivery, storage and decisions pages after Documentation #49. A credential-free mocked reproduction found that known collection markers such as `[false]` are rejected by the identity guard. [Workflows #107](https://git.gitchegumi.com/Homelab/workflows/pulls/107) prepares the correction; it still needs review, release and promotion before a fresh owning plan. Keep successful plan review/apply, workload credential issuance, full Terraform concurrency/recovery and RKE2/Core upgrades as separate pending acceptance. Public pages contain no private repository URLs, credential values, provider logs or plans. Validation at 5050bb8: npm run check, default npm run build, native staged Gitleaks 8.30.1 and diff checks passed. Hosted checks remain required. This documentation PR can merge independently; it records the workflow fix as prepared, not released or accepted live.

kiyi added 1 commit

2026-10-15 20:02:03 -05:00

Record identity plan export and pending review-guard correction

Documentation site checks / validate (pull_request) Successful in 1m6s

Details

Source security / security (pull_request) Successful in 2m15s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

5050bb8d45

portegumi approved these changes

2026-10-15 20:03:26 -05:00

portegumi left a comment

Reviewed the four changed documentation pages at 5050bb8d45. They consistently distinguish run 69's completed backend/plan/JSON-export steps from the failed plan-review guard: no approval fingerprint, apply, credential issuance, or live identity change is claimed. The [false] collection-marker issue and workflows #107 are explicitly recorded as prepared, not released/promoted; a fresh owning plan remains necessary. The RKE2 claim inspections and Terraform #13 bindings are not presented as proof of OpenBao authentication or upgrade deployment. This changes documentation only, not UDS packages, policy, admission, gateway ownership, or routing; the established tenant/admin gateways are preserved. Source review approved. Source-security and site-validation checks are still pending and must pass independently before merge; no private run or local-test claim was independently reproduced in this review.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed the four changed documentation pages at 5050bb8d451111c37719887928ae959a4fe3ed06. They consistently distinguish run 69's completed backend/plan/JSON-export steps from the failed plan-review guard: no approval fingerprint, apply, credential issuance, or live identity change is claimed. The `[false]` collection-marker issue and workflows #107 are explicitly recorded as prepared, not released/promoted; a fresh owning plan remains necessary. The RKE2 claim inspections and Terraform #13 bindings are not presented as proof of OpenBao authentication or upgrade deployment. This changes documentation only, not UDS packages, policy, admission, gateway ownership, or routing; the established tenant/admin gateways are preserved. Source review approved. Source-security and site-validation checks are still pending and must pass independently before merge; no private run or local-test claim was independently reproduced in this review. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.