# Authoritative requirement registry (WS-TEST / R-TEST-04) # # SOURCE OF TRUTH: the read-only spec at ../home-network-k3s (docs/ + decisions/). # This file is a *mirror* of the requirement IDs the spec defines, transcribed so the # coverage generator can enumerate EVERY R-* requirement and flag the ones with no # verifying Chainsaw test. It is NOT a place to invent, weaken, or reword requirements # (R-TEST-06) — if the spec adds/changes an ID, update this mirror to match, never the # other way around. # # Parser contract (lib/coverage.py): each entry is a `- id:` block whose keys # (doc / safety_critical / summary) are single-line scalars. `summary` is an abridged # label for the report only; the spec doc is authoritative for the full normative text. # # safety_critical: true => R-TEST-05 requires an L3 fault-injection test (break it, # assert fail-closed / no-data-loss) — a happy-path L2 test # alone does NOT satisfy the requirement. requirements: # --- Testing & conformance (this workstream; verified by the harness itself) --- - id: R-TEST-01 doc: docs/14-testing-and-conformance.md safety_critical: false summary: "Every requirement verified by automated, behavior-based tests." - id: R-TEST-02 doc: docs/14-testing-and-conformance.md safety_critical: false summary: "Tests are reproducible: deterministic, hermetic, single-command." - id: R-TEST-03 doc: docs/14-testing-and-conformance.md safety_critical: false summary: "A conformance suite gates merges and phase exits." - id: R-TEST-04 doc: docs/14-testing-and-conformance.md safety_critical: false summary: "Tests are traceable: each declares its R-* IDs; coverage report maps them." - id: R-TEST-05 doc: docs/14-testing-and-conformance.md # Meta-requirement: verified by the harness self-check asserting zero # safety-critical gaps, not by its own runtime fault test. The real # safety-critical behaviors carry safety_critical: true individually. safety_critical: false summary: "Safety-critical behaviors proven by fault-injection (fail-closed/no-loss)." - id: R-TEST-06 doc: docs/14-testing-and-conformance.md safety_critical: false summary: "Agents MUST NOT modify specs/requirements/tests to reach green." # --- Networking isolation & egress --- - id: R-NET-01 doc: docs/03-networking-isolation-and-egress.md safety_critical: true summary: "East-west traffic denied by default (DNS-only for a bare workload)." - id: R-NET-02 doc: docs/03-networking-isolation-and-egress.md safety_critical: false summary: "Allow rules declarative, per source->dest port; undeclared is blocked." - id: R-NET-03 doc: docs/03-networking-isolation-and-egress.md safety_critical: false summary: "Networks configurable and isolatable (enforced segmentation)." - id: R-NET-04 doc: docs/03-networking-isolation-and-egress.md safety_critical: false summary: "Multiple egress paths selectable by routing rules." - id: R-NET-05 doc: docs/03-networking-isolation-and-egress.md safety_critical: false summary: "Service declares egress class: internet (WAN IP) vs vpn (VPN IP)." - id: R-NET-06 doc: docs/03-networking-isolation-and-egress.md safety_critical: true summary: "VPN kill-switch: tunnel down => zero plain-internet egress for vpn class." - id: R-NET-07 doc: docs/03-networking-isolation-and-egress.md safety_critical: false summary: "Egress class is declarative, changeable via GitOps, no workload rewrite." # --- Storage & state --- - id: R-STATE-01 doc: docs/04-storage-and-state.md safety_critical: true summary: "Stateful data survives destroy/rebuild of the workload (PaaS + IaaS)." - id: R-STATE-02 doc: docs/04-storage-and-state.md safety_critical: true summary: "Persistent storage replicated across the 3 nodes (Longhorn)." - id: R-STATE-03 doc: docs/04-storage-and-state.md safety_critical: true summary: "Scheduled off-cluster backups + restore (DR)." - id: R-STATE-04 doc: docs/04-storage-and-state.md safety_critical: false summary: "Bulk media storage has a capacity strategy distinct from replicated tier." # --- TLS --- - id: R-TLS-01 doc: docs/08-tls-and-certificates.md safety_critical: false summary: "Externally reachable services present trusted, non-self-signed TLS." - id: R-TLS-02 doc: docs/08-tls-and-certificates.md safety_critical: false summary: "Certificates auto issued/renewed/revoked with no manual step." - id: R-TLS-03 doc: docs/08-tls-and-certificates.md safety_critical: false summary: "Issuance works for internal-only services (no public exposure needed)." # --- DNS & ingress --- - id: R-DNS-01 doc: docs/09-dns-and-ingress.md safety_critical: false summary: "Services reachable at .home.keithjackson.dev." - id: R-DNS-02 doc: docs/09-dns-and-ingress.md safety_critical: false summary: "DNS records managed automatically from declared service intent." - id: R-DNS-03 doc: docs/09-dns-and-ingress.md safety_critical: false summary: "Internal clients resolve to the internal Gateway (split-horizon)." # --- Automated updates --- - id: R-UPD-01 doc: docs/11-automated-updates.md safety_critical: false summary: "Services update to latest stable versions on a schedule." - id: R-UPD-02 doc: docs/11-automated-updates.md safety_critical: true summary: "Updates need no human/AI/hand-authored change; bad update auto-rolls-back." - id: R-UPD-03 doc: docs/11-automated-updates.md safety_critical: false summary: "Update policy per-service configurable (cadence, channel, pinning)." # --- Observability & alerting --- - id: R-OBS-01 doc: docs/10-observability-and-alerting.md safety_critical: false summary: "Services monitored (metrics, logs, health)." - id: R-OBS-02 doc: docs/10-observability-and-alerting.md safety_critical: false summary: "Issues reported by email." - id: R-OBS-03 doc: docs/10-observability-and-alerting.md safety_critical: false summary: "Issues and health visible on dashboards." - id: R-OBS-04 doc: docs/10-observability-and-alerting.md safety_critical: false summary: "Platform alerts on its own health (nodes, storage, GitOps, certs, VPN)." # --- Platform / compute --- - id: R-PLAT-01 doc: docs/01-architecture-overview.md safety_critical: false summary: "k3s across 3 nodes with production-grade HA control plane." - id: R-PLAT-02 doc: docs/01-architecture-overview.md safety_critical: false summary: "Container workloads onboarded/managed declaratively via K8s API." - id: R-PLAT-03 doc: docs/06-vm-workloads-kubevirt.md safety_critical: false summary: "VM workloads created/managed/destroyed through the K8s API (KubeVirt)." - id: R-PLAT-04 doc: docs/06-vm-workloads-kubevirt.md safety_critical: false summary: "Create/destroy/rebuild of any workload on demand." # --- Environments & provisioning --- - id: R-ENV-01 doc: docs/02-environments-and-provisioning.md safety_critical: false summary: "dev/test provisioned as local KVMs via IaC (create/baseline/rebuild)." - id: R-ENV-02 doc: docs/02-environments-and-provisioning.md safety_critical: false summary: "Same GitOps config promotes dev/test -> prod (authored once)." - id: R-ENV-03 doc: docs/02-environments-and-provisioning.md safety_critical: false summary: "prod is 3x mini-PC bare-metal k3s with local storage." # --- GitOps & delivery --- - id: R-GITOPS-01 doc: docs/05-gitops-and-delivery.md safety_critical: false summary: "All desired state in git, reconciled by Flux." - id: R-GITOPS-02 doc: docs/05-gitops-and-delivery.md safety_critical: false summary: "Onboarding a service = a change to a versioned catalog entry." - id: R-GITOPS-03 doc: docs/05-gitops-and-delivery.md safety_critical: false summary: "System detects and corrects drift between git and cluster." # --- Security & secrets --- - id: R-SEC-01 doc: docs/07-security-and-secrets.md safety_critical: false summary: "No plaintext secrets in git; encrypted at rest (SOPS)." - id: R-SEC-02 doc: docs/07-security-and-secrets.md safety_critical: false summary: "Least-privilege for workload identities and network reach." - id: R-SEC-03 doc: docs/07-security-and-secrets.md safety_critical: false summary: "All security properties demonstrable/auditable." # --- Identity & access --- - id: R-IDP-01 doc: docs/15-identity-and-access.md safety_critical: false summary: "Central Identity Provider (SSO) as the single user directory." - id: R-IDP-02 doc: docs/15-identity-and-access.md safety_critical: false summary: "Services authenticate against the IdP (OIDC or forward-auth)." - id: R-IDP-03 doc: docs/15-identity-and-access.md safety_critical: false summary: "Identity config (realms, clients, groups, roles) is declarative." - id: R-IDP-04 doc: docs/15-identity-and-access.md safety_critical: false summary: "IdP secrets SOPS-encrypted; MFA available." - id: R-IDP-05 doc: docs/15-identity-and-access.md safety_critical: false summary: "IdP treated as DR-critical (replicated + off-cluster-backed)." - id: R-IDP-06 doc: docs/15-identity-and-access.md safety_critical: false summary: "Least-privilege access via groups/roles for sensitive surfaces." # --- Command center UI --- - id: R-C2-01 doc: docs/12-command-center-ui.md safety_critical: false summary: "Root home.keithjackson.dev serves a UI surfacing running services." - id: R-C2-02 doc: docs/12-command-center-ui.md safety_critical: false summary: "C2 UI surfaces platform health (cluster, storage, GitOps, alerts)."