From 0749562ad0d6cf5b6b42aef79ec7e8d247da8a86 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Tue, 29 Sep 2026 23:04:26 -0500 Subject: [PATCH] docs(decisions): record the rebase and the README merge decision #18 has landed, so this branch's "PR #18 must merge first" caveat was stale -- corrected to say what is now true and, more importantly, what is still NOT: no image has been built or pushed, so the digest this branch pins resolves to nothing. Also records the one real conflict the rebase hit and how it was resolved. #18's README carried a blockquote saying the 4th admission rule pinning the init container's command "is not in this branch". It IS in this branch (trigger-initcontainers-must-be-the-committed-clone-step, plus the ephemeralContainers and env/envFrom rules beside it), so keeping #18's wording would have left main documenting an open hole that had just been closed. Co-Authored-By: Claude Opus 5 (1M context) --- .../2026-09-29-conformance-job-template.md | 28 +++++++++++++++++-- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/decisions/2026-09-29-conformance-job-template.md b/decisions/2026-09-29-conformance-job-template.md index eaf5ae1..962a61d 100644 --- a/decisions/2026-09-29-conformance-job-template.md +++ b/decisions/2026-09-29-conformance-job-template.md @@ -333,15 +333,37 @@ visible in the policy's prose — which is careful, accurate about what it *does explicit that it is "THE SECURITY BOUNDARY" — only in what the CLI did with a tampered resource. A policy is only as trustworthy as its negative fixtures. +### Addendum — rebased onto `main` after #18 landed (2026-09-29) + +This branch originally appended its handoff to `DECISIONS-LOG.md`, which is why it was +`mergeable: false`: every branch appended to that file's same last hunk. The append is now this +file (see `decisions/README.md`). + +The rebase onto post-#18 `main` hit one real content conflict — `conformance/incluster/README.md`, +where #18 and this branch had each rewritten the same bullet list. Resolved by keeping #18's +`Containerfile` / `conformance-clone` / `build-image.sh` bullets and this branch's +`chainsaw-job.yaml` bullet, since this branch is what makes the Job a rendered run template. + +One of #18's paragraphs had to be **rewritten rather than kept**: its `conformance-clone` bullet +carried a blockquote saying *"This file is half a fix … a 4th policy rule demanding `command: +["/usr/local/bin/conformance-clone"]` with no `args` … is **not** in this branch."* That rule **is** +in this branch — `trigger-initcontainers-must-be-the-committed-clone-step`, plus the +`ephemeralContainers` and `env`/`envFrom` rules beside it. Leaving #18's wording would have left +`main` documenting an open hole that had just been closed, which is the same +documentation-disagrees-with-mechanism failure this repo keeps hitting. No code changed in the +rebase: every file but that README is byte-identical to the pre-rebase tip. + ## What I did NOT verify - **Nothing here has ever executed against a cluster.** The `conformance-runner` image does not exist (plan §3 item 1), so the Job cannot be submitted, and the init container's clone/fetch/assert sequence, the credential helper and the envelope-over-`kubectl-logs` path are all **unexercised**. The envelope itself is verified; its transport is not. -- **PR #18 must merge first.** The image digest and `/usr/local/bin/conformance-clone` both arrive - with it. If that path is missing or named differently, the init container fails to start; if it - is present but the image is not the pinned digest, admission denies the Job. +- **PR #18 has since merged** (`cac5c9f`), so `/usr/local/bin/conformance-clone` and the image are + now on `main` and this branch was rebased onto them. What that changes is only *availability*: + if the path were missing or named differently the init container would fail to start, and if the + image is not the pinned digest admission denies the Job. **Neither has been exercised** — no + image has been built or pushed, so the digest this branch pins still resolves to nothing. - **Secret `conformance-git-readonly` does not exist** (plan §3 item 6, operator action). Only its name is referenced here. - **`uid 65532`** is asserted by the Job's `runAsUser`/`fsGroup`; the image that must provide it has