Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

WIP: chore(spec): adopt the spec sync (registry parity, ADR references, spec pin) #160

Draft
gitea-admin wants to merge 1 commits from chore/adopt-spec-sync into main
pull from: chore/adopt-spec-sync
merge into: Home-Network:main
Conversation 0 Commits 1 Files Changed 7
+74 -11
gitea-admin commented 2026-11-09 04:49:15 +00:00
Owner
Copy link
Copy source

The implementation half of the spec sync. The spec change is jakman85/home-network-k3s#2. That one merges first.

Why this is WIP:. ci/SPEC_PIN has to move to the spec's merge commit, and that SHA does not exist until #2 merges. The title blocks an accidental merge until the bump is added.

What changes

  • Requirement mirror. Adds R-DNS-04, R-DNS-05 and R-SEC-04 to conformance/requirements/registry.yaml. The spec already defined them. Rewords the R-ENV-01/02/03 and R-UPD-02 summaries to match the amended spec.
  • Test tags. A registry entry with no tagged test blocks the merge, so existing L0 tests are tagged against the new IDs. Each test's assertions were read first:
    • cloudflared-ingress-rules: R-DNS-04, R-DNS-05, R-SEC-04
    • internal-services-publish-no-public-dns: R-DNS-05
    • pihole-lan-names: R-DNS-04
  • ADR references. platform/vpn-egress pointed at a drafted "ADR-0016 supersede". That number went to the Cloudflare Tunnel, so these now cite ADR-0020. One README paragraph and one manifest comment; no behaviour change.
  • Handoff entry in decisions/.

Remaining steps

  1. Merge spec PR #2.
  2. Add the ci/SPEC_PIN bump to this branch and drop WIP:.
  3. This PR touches conformance/** and will touch ci/**, both sensitive paths, so it needs your review or your own /approve-override. The agent account must not clear it. Expect the approval-policy stage to be red in CI until then.

Gate result

Pinned toolbox, commit 8cd5ab2: rc 3 (UNDETERMINED), nothing failed.

Stage Result
decisions-log, lint, l0, render-golden, l1 pass
approval-policy pass locally, but this stage cannot evaluate offline, so it says nothing about CI
spec-immutability did not run: the spec was mounted from a worktree, and the pin is not bumped yet
gitea-settings did not run: CI only
conformance (L2/L3) did not run: no cluster

Tagged coverage is 54/54. That measures tags, not proof. The new spec branch was mounted for this run, so the L0 checks that parse spec text ran against it and passed.

Not verified

These three requirements are statically covered only. No L2 test touches the tunnel, and nothing here shows router 80/443 closed or 6443 unforwarded. R-SEC-04 is registered safety_critical: false, because true requires an L3 test that does not exist. No live state was measured.

Stale implementation prose found by the audit is deliberately out of scope. The handoff entry lists examples.

🤖 Generated with Claude Code

The implementation half of the spec sync. The spec change is [`jakman85/home-network-k3s#2`](https://gitea.home.keithjackson.dev/jakman85/home-network-k3s/pulls/2). **That one merges first.** **Why this is `WIP:`.** `ci/SPEC_PIN` has to move to the spec's merge commit, and that SHA does not exist until #2 merges. The title blocks an accidental merge until the bump is added. ## What changes - **Requirement mirror.** Adds R-DNS-04, R-DNS-05 and R-SEC-04 to `conformance/requirements/registry.yaml`. The spec already defined them. Rewords the R-ENV-01/02/03 and R-UPD-02 summaries to match the amended spec. - **Test tags.** A registry entry with no tagged test blocks the merge, so existing L0 tests are tagged against the new IDs. Each test's assertions were read first: - `cloudflared-ingress-rules`: R-DNS-04, R-DNS-05, R-SEC-04 - `internal-services-publish-no-public-dns`: R-DNS-05 - `pihole-lan-names`: R-DNS-04 - **ADR references.** `platform/vpn-egress` pointed at a drafted "ADR-0016 supersede". That number went to the Cloudflare Tunnel, so these now cite ADR-0020. One README paragraph and one manifest comment; no behaviour change. - **Handoff entry** in `decisions/`. ## Remaining steps 1. Merge spec PR #2. 2. Add the `ci/SPEC_PIN` bump to this branch and drop `WIP:`. 3. **This PR touches `conformance/**` and will touch `ci/**`, both sensitive paths, so it needs your review or your own `/approve-override`.** The agent account must not clear it. Expect the `approval-policy` stage to be red in CI until then. ## Gate result Pinned toolbox, commit `8cd5ab2`: **rc 3 (UNDETERMINED), nothing failed.** | Stage | Result | |---|---| | decisions-log, lint, l0, render-golden, l1 | pass | | approval-policy | pass locally, but this stage cannot evaluate offline, so it says nothing about CI | | spec-immutability | **did not run**: the spec was mounted from a worktree, and the pin is not bumped yet | | gitea-settings | **did not run**: CI only | | conformance (L2/L3) | **did not run**: no cluster | Tagged coverage is 54/54. That measures tags, not proof. The new spec branch was mounted for this run, so the L0 checks that parse spec text ran against it and passed. ## Not verified These three requirements are **statically covered only**. No L2 test touches the tunnel, and nothing here shows router 80/443 closed or 6443 unforwarded. R-SEC-04 is registered `safety_critical: false`, because `true` requires an L3 test that does not exist. No live state was measured. Stale implementation prose found by the audit is deliberately out of scope. The handoff entry lists examples. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
gitea-admin added 1 commit 2026-11-09 04:49:15 +00:00
chore(spec): adopt the spec sync: registry parity and ADR cross-references
gate / gate (pull_request) Failing after 1m4s
Details
gate / conformance (pull_request) Skipped
Details
8cd5ab2e41 
Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the
L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the
amended requirements. Point the VPN egress docs at ADR-0020; the drafted
"ADR-0016" number went to the Cloudflare Tunnel.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Some required checks failed
gate / gate (pull_request) Failing after 1m4s
Required
Details
gate / conformance (pull_request) Skipped
Details
Some required checks were not successful.
You are not authorized to merge this pull request.
This branch is out-of-date with the base branch
This pull request is marked as a work in progress.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/adopt-spec-sync:chore/adopt-spec-sync
git checkout chore/adopt-spec-sync
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
agent
automated-update
blast-radius
breaking
ci-tooling
dependencies
needs-review
own-image
range-widen
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
gitea-admin jakman85 (Keith Jackson) pm-agent renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Home-Network/home-network-k3s-impl#160