docs(guard): scope the ACME guard to the approval record, name the real gate #640

Merged

sean merged 1 commit from docs/acme-guard-role into trunk

2026-08-06 01:49:32 +00:00

sean commented

2026-08-06 01:47:10 +00:00

Owner

It is not. The field it watches (Stack.spec.tls.acmeServer) is read by no composition patch and defaults to staging in apis/stack/xrd.yaml; it is the retained record of the 2026-06-13 approval. The live ClusterIssuer/letsencrypt renders from sean/pipelines bundle/dns/issuer.yaml and is guarded by that repo own tests/check-acme-approval.sh (same marker rule plus an anti-vacuous floor), CI-enforced through pipeline/ci -> pipeline-validate-with-operator -> pipeline-validate -> tests/check.sh.

Comment-only. Scopes the claim to the record, names the real gate by path, and asks that the two files scope comments be kept in agreement. sean/pipelines guard already describes the relationship correctly; this makes platform agree with it.

Verified: tests/check-acme-approval.sh green, full tests/check.sh green.

The header claimed "An unapproved flip — commit or agent — goes CI-red at the merge gate", which is false for the LIVE knob and is exactly the sentence that makes a reader think this file is the gate. It is not. The field it watches (Stack.spec.tls.acmeServer) is read by no composition patch and defaults to staging in apis/stack/xrd.yaml; it is the retained record of the 2026-06-13 approval. The live ClusterIssuer/letsencrypt renders from sean/pipelines bundle/dns/issuer.yaml and is guarded by that repo own tests/check-acme-approval.sh (same marker rule plus an anti-vacuous floor), CI-enforced through pipeline/ci -> pipeline-validate-with-operator -> pipeline-validate -> tests/check.sh. Comment-only. Scopes the claim to the record, names the real gate by path, and asks that the two files scope comments be kept in agreement. sean/pipelines guard already describes the relationship correctly; this makes platform agree with it. Verified: tests/check-acme-approval.sh green, full tests/check.sh green.

sean added 1 commit

2026-08-06 01:48:32 +00:00

docs(guard): scope the ACME guard to the approval record

pipeline/ci CI green @ 6cd37e20327a

Details

6cd37e2032

The header claimed "An unapproved flip — commit or agent — goes CI-red
at the merge gate". That is false for the LIVE knob, and it is precisely
the sentence that makes a reader believe this file is the gate.

It is not. The field this guard watches, Stack.spec.tls.acmeServer, is
read by no composition patch and defaults to staging in
apis/stack/xrd.yaml; it is the retained committed record of the
2026-06-13 approval, and this guard keeps that record from being edited
without one.

The live ClusterIssuer/letsencrypt renders from sean/pipelines
bundle/dns/issuer.yaml (-> ArgoCD app `dns`) and signs all 16
portal-gateway certs. It is guarded by that repo's own
tests/check-acme-approval.sh — same marker rule, plus a floor that fails
when no ACME directory URL exists anywhere, so it cannot pass vacuously
if the knob relocates — enforced through pipeline/ci ->
pipeline-validate-with-operator -> pipeline-validate -> tests/check.sh.

Comment-only: scopes the claim, names the real gate by path, and asks
that the two files' scope comments be kept in agreement. sean/pipelines'
guard already describes the relationship correctly; this makes
platform-seanfarm agree rather than contradict it.

Verified: tests/check-acme-approval.sh green, full tests/check.sh green.

sean merged commit 6cd37e2032 into trunk

2026-08-06 01:49:32 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/platform-seanfarm!640

No description provided.

Rows
Columns