---
date: 2026-11-08
branch: chore/adopt-spec-sync
title: Adopt the spec sync (registry parity, ADR cross-references, spec pin)
---

## What changed

The operator ruled this repo's `main` (`50c8719`) the accepted state and had the System Architect
bring the spec repo in line with it (spec PR `jakman85/home-network-k3s#2`). This is the
implementation half of that sync.

- `conformance/requirements/registry.yaml`: added R-DNS-04, R-DNS-05 and R-SEC-04, which the spec
  defined and this mirror lacked. Reworded the R-ENV-01/02/03 and R-UPD-02 summaries to match the
  amended requirements.
- Tagged existing L0 tests against those IDs, because a registry entry with no tagged test blocks
  the merge: `cloudflared-ingress-rules` (R-DNS-04, R-DNS-05, R-SEC-04), `pihole-lan-names`
  (R-DNS-04), and `internal-services-publish-no-public-dns` (R-DNS-05).
- `platform/vpn-egress/README.md` and a comment in `egress-steering.yaml` pointed at a drafted
  "ADR-0016 supersede". That number went to the Cloudflare Tunnel; the accepted ADR is ADR-0020.
- `ci/SPEC_PIN` must move to the spec merge commit. That SHA does not exist until the spec PR
  merges, so this PR carries a `WIP:` title until the bump is added.

## What I verified

- Read each tagged test's assertions before tagging it. `cloudflared-ingress-rules` asserts every
  LAN-only hostname maps to a 404, the catch-all exists, no rule targets the API, and the egress
  policy admits no API or host entity. `pihole-lan-names` asserts LAN names resolve independently
  of the public path. `internal-services-publish-no-public-dns` asserts internal routes carry the
  disown annotation and pins the declared L4 set.
- The toolbox gate result for this commit is quoted in the PR description, with the spec branch
  mounted so that the checks parsing spec text ran against the new spec.

## What I did NOT verify

- **These tags are static coverage, not proof.** No L2 test touches the tunnel, and nothing here
  shows router 80/443 closed or 6443 unforwarded (spec `docs/16-known-gaps.md`).
- R-SEC-04 is registered `safety_critical: false`. Making it `true` needs an L3 fault-injection
  test that does not exist. UNVERIFIED whether the operator wants that.
- No live cluster, tunnel or DNS state was measured.
- `spec-immutability` did not run against a pinned checkout: the pin is not bumped yet.
- Stale implementation prose found by the audit was deliberately left out of this PR, because the
  operator ruled this repo the accepted state and none of it changes behaviour. Examples:
  `catalog/gitea.yaml` still says "+ mirrored"; `platform/longhorn` still promises a backup target;
  `README.md` says `node-loss` is outstanding; `hands-off-update` exercises Flux image policy rather
  than Renovate; `dev-nodes-provisioned-as-code` is named for an environment that no longer exists.