docs(decisions-log): end-of-session PM handoff #14

2026-09-29T08:28:34Z

gitea-admin commented

2026-09-29 08:28:34 +00:00

End-of-session PM handoff, written for a different session on a different computer.

Covers: the two open gated PRs (#12, #13) with their risk; the one command that must follow the
now-merged #11 (./infra/gitea/set-ci-token.sh — the drift detector skips until its token
exists, and a skipped detector detects nothing); and the three credentials deliberately not
in git, without which the toolbox and cluster are unreachable on a new machine:

~/.config/sops/age/keys.txt — the age private key. Without it no *.sops.yaml can be
read or edited, and sops fails in a way that looks like a corrupt file.
infra/ansible/.cache/prod.kubeconfig — untracked; absent in every git worktree.
A Gitea credential for gitea.home.keithjackson.dev.

It records the measured platform state and tells the reader to re-measure rather than trust the
log — which is the point of CLAUDE.md §2b, and which this log earned by being confidently
wrong for a month.

Gate: MERGE GATE: UNDETERMINED (exit 3), naming gitea-settings as unrun because no
GITEA_SETTINGS_TOKEN is set locally. That is the designed behaviour of the detector merged in
#11, gate.yml tolerates exit 3, and lint/l0/render-golden/l1/spec-immutability were all green.

Co-Authored-By: Claude Opus 5 (1M context) [email protected]

🤖 Generated with Claude Code

End-of-session PM handoff, written for a **different session on a different computer**. Covers: the two open gated PRs (#12, #13) with their risk; the one command that must follow the now-merged #11 (`./infra/gitea/set-ci-token.sh` — the drift detector **skips until its token exists, and a skipped detector detects nothing**); and the three credentials deliberately **not** in git, without which the toolbox and cluster are unreachable on a new machine: 1. `~/.config/sops/age/keys.txt` — the age **private** key. Without it no `*.sops.yaml` can be read or edited, and sops fails in a way that looks like a corrupt file. 2. `infra/ansible/.cache/prod.kubeconfig` — untracked; absent in every git worktree. 3. A Gitea credential for `gitea.home.keithjackson.dev`. It records the measured platform state **and tells the reader to re-measure rather than trust the log** — which is the point of `CLAUDE.md` §2b, and which this log earned by being confidently wrong for a month. Gate: `MERGE GATE: UNDETERMINED` (exit 3), naming `gitea-settings` as unrun because no `GITEA_SETTINGS_TOKEN` is set locally. **That is the designed behaviour of the detector merged in #11**, `gate.yml` tolerates exit 3, and lint/l0/render-golden/l1/spec-immutability were all green. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-admin added 1 commit 2026-09-29 08:28:34 +00:00

docs(decisions-log): end-of-session PM handoff — six PRs open, and what a new machine needs

gate / gate (pull_request) Successful in 1m33s

Details

gate / conformance (pull_request) Has been skipped

Details

911ead5fbd

Written for a different session on a different computer. Lists the three open gated
PRs with their risk, the one command that must follow #11 (the drift detector skips
until its token exists, and a skipped detector detects nothing), and the three
credentials that are deliberately NOT in git and without which the toolbox and
cluster are unreachable: the age private key, prod.kubeconfig, and a Gitea
credential.

Records the measured platform state while telling the reader to re-measure it rather
than trust this log -- which is the whole point of CLAUDE.md section 2b, and which
this log earned by being confidently wrong for a month.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

gitea-admin force-pushed docs/handoff-2026-09-29 from ba17823ef8 to 911ead5fbd

2026-09-29 08:28:34 +00:00

Compare

gitea-admin added 1 commit 2026-09-29 17:13:49 +00:00

docs(decisions-log): addendum — detector armed, and why an agent cannot merge here

gate / gate (pull_request) Successful in 1m34s

Details

gate / conformance (pull_request) Has been skipped

Details

4b31f97486

Records two findings from the unattended session.

The drift detector was INERT: set-ci-token.sh stored the secret under a name Gitea
reserves (GITEA_ prefix, HTTP 400 "invalid secret name"), sent the PUT to /dev/null,
and printed success anyway. A token existed; no secret did. Enabling
REQUIRE_GITEA_SETTINGS on top of that would have blocked every PR including its own
fix. PR #15 fixes it and its CI is green WITH require active, which is the only
proof that counts.

And: merging as gitea-admin returns HTTP 405 "Does not have enough approvals".
required_approvals:1 + block_admin_merge_override:true + an author who cannot
self-approve means "merge on green CI" is not executable by an agent. Recorded as
the control working rather than a fault, and deliberately not circumvented --
self-approval would hollow out the boundary just built. The choice of what to do
about it is the operator s, and whatever is chosen must also change the declaration
in expected-branch-protection.json or the detector will correctly fail on the drift.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

jakman85 approved these changes

2026-09-29 18:16:17 +00:00

jakman85 merged commit 1c5974013e into main

2026-09-29 18:16:22 +00:00

jakman85 referenced this issue from a commit

2026-09-29 18:16:22 +00:00

Merge pull request 'docs(decisions-log): end-of-session PM handoff' (#14) from docs/handoff-2026-09-29 into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#14