chore(spec): adopt the spec sync: registry parity and ADR cross-references

Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the amended requirements. Point the VPN egress docs at ADR-0020; the drafted "ADR-0016" number went to the Cloudflare Tunnel. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 22:47:54 -06:00
1 parent 50c8719b12
commit 8cd5ab2e41
@@ -0,0 +1,46 @@
+---
+date: 2026-11-08
+branch: chore/adopt-spec-sync
+title: Adopt the spec sync (registry parity, ADR cross-references, spec pin)
+---
+
+## What changed
+
+The operator ruled this repo's `main` (`50c8719`) the accepted state and had the System Architect
+bring the spec repo in line with it (spec PR `jakman85/home-network-k3s#2`). This is the
+implementation half of that sync.
+
+- `conformance/requirements/registry.yaml`: added R-DNS-04, R-DNS-05 and R-SEC-04, which the spec
+  defined and this mirror lacked. Reworded the R-ENV-01/02/03 and R-UPD-02 summaries to match the
+  amended requirements.
+- Tagged existing L0 tests against those IDs, because a registry entry with no tagged test blocks
+  the merge: `cloudflared-ingress-rules` (R-DNS-04, R-DNS-05, R-SEC-04), `pihole-lan-names`
+  (R-DNS-04), and `internal-services-publish-no-public-dns` (R-DNS-05).
+- `platform/vpn-egress/README.md` and a comment in `egress-steering.yaml` pointed at a drafted
+  "ADR-0016 supersede". That number went to the Cloudflare Tunnel; the accepted ADR is ADR-0020.
+- `ci/SPEC_PIN` must move to the spec merge commit. That SHA does not exist until the spec PR
+  merges, so this PR carries a `WIP:` title until the bump is added.
+
+## What I verified
+
+- Read each tagged test's assertions before tagging it. `cloudflared-ingress-rules` asserts every
+  LAN-only hostname maps to a 404, the catch-all exists, no rule targets the API, and the egress
+  policy admits no API or host entity. `pihole-lan-names` asserts LAN names resolve independently
+  of the public path. `internal-services-publish-no-public-dns` asserts internal routes carry the
+  disown annotation and pins the declared L4 set.
+- The toolbox gate result for this commit is quoted in the PR description, with the spec branch
+  mounted so that the checks parsing spec text ran against the new spec.
+
+## What I did NOT verify
+
+- **These tags are static coverage, not proof.** No L2 test touches the tunnel, and nothing here
+  shows router 80/443 closed or 6443 unforwarded (spec `docs/16-known-gaps.md`).
+- R-SEC-04 is registered `safety_critical: false`. Making it `true` needs an L3 fault-injection
+  test that does not exist. UNVERIFIED whether the operator wants that.
+- No live cluster, tunnel or DNS state was measured.
+- `spec-immutability` did not run against a pinned checkout: the pin is not bumped yet.
+- Stale implementation prose found by the audit was deliberately left out of this PR, because the
+  operator ruled this repo the accepted state and none of it changes behaviour. Examples:
+  `catalog/gitea.yaml` still says "+ mirrored"; `platform/longhorn` still promises a backup target;
+  `README.md` says `node-loss` is outstanding; `hands-off-update` exercises Flux image policy rather
+  than Renovate; `dev-nodes-provisioned-as-code` is named for an environment that no longer exists.