chore(spec): adopt the spec sync: registry parity and ADR cross-references

Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the amended requirements. Point the VPN egress docs at ADR-0020; the drafted "ADR-0016" number went to the Cloudflare Tunnel. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 22:47:54 -06:00
1 parent 50c8719b12
commit 8cd5ab2e41
@@ -217,9 +217,9 @@ Consequences, stated plainly:

 **Governance:** ADR-0015 and `docs/03` are specifications and are immutable to agents
 (spec `AGENTS.md` §11, R-TEST-06, enforced by `ci/spec-immutability.sh`) — they are **not** edited
-here. The correction is raised as an **escalation with a drafted ADR-0016 supersede** in
-`DECISIONS-LOG.md` (entry of 2026-09-06) for the operator/architect to accept. Until then this file
-and `egress-steering.yaml` are the accurate statement of what the implementation can actually do.
+here. The correction, first escalated in `DECISIONS-LOG.md` (entry of 2026-09-06), is recorded in
+spec **ADR-0020**, which supersedes ADR-0015's Kill-switch and Resilience bullets. This file and
+`egress-steering.yaml` state what the implementation does.

 ## Secrets — host-side now
 PIA credentials + the `.ovpn` live **on the gateway node via Ansible vault** (see spec `docs/07`), **not**
@@ -109,7 +109,7 @@ spec:
  # that shard and re-shards the rest (breaking live connections), and each shard exits from a
  # DIFFERENT public IP. Upstream: cilium/cilium#30157, cilium/cilium#18230.
  # ADR-0015's "Resilience: two egress-gateway nodes + Cilium Egress Gateway HA (gateway failover)"
-  # is therefore NOT IMPLEMENTABLE on Cilium OSS — escalated for an ADR-0016 supersede; see
+  # is therefore NOT IMPLEMENTABLE on Cilium OSS — superseded by spec ADR-0020; see
  # platform/vpn-egress/README.md and the DECISIONS-LOG entry of 2026-09-06.
  #
  # `interface: tun0` IS RESOLVED ONCE — the gateway node has to tell Cilium when tun0 changes.