jakman85 4f16e83eec Merge pull request 'feat(obs): make oauth2-proxy auth failures visible — the gates emit nothing' (#29) from feat/oauth2-proxy-auth-failure-visible into main ...

Reviewed-on: #29
Reviewed-by: Keith Jackson <[email protected]>

2026-10-02 04:55:43 +00:00

..

admission-policies-actually-applied

fix(sec): the R-SEC-02 admission policy was never applied -- and nothing could tell

2026-09-29 13:23:09 -05:00

alert-metrics-have-scrape-targets

feat(obs): notify on Flux deploy start and completion

2026-09-29 23:40:01 -05:00

alert-rules-unit-tested

fix(conformance): "unit-tested" counted an alert MENTIONED in a comment as tested

2026-09-19 01:00:59 -05:00

alert-runbooks-resolvable

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

c2-root-surface

feat(sec): constrain the conformance CI trigger at admission (R-SEC-02)

2026-09-29 03:22:41 -05:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

test(l0): prove the dollar-collapse guard fires — and name the real envsubst

2026-09-13 16:24:42 -05:00

ha-control-plane-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

internal-services-publish-no-public-dns

feat(dns): exposure: internal can no longer publish a public record

2026-09-14 00:43:12 -05:00

keycloak-client-secret-reconciler

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

l2-announced-vips-serve-from-any-node

fix(l4): externalTrafficPolicy Cluster on unifi + crafty L4 VIPs

2026-09-14 01:32:47 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

oauth2-proxy-api-routes-per-app

feat(auth): declare API paths per service, so --api-route can ship at all

2026-10-01 22:07:08 -05:00

oauth2-proxy-cookie-names-distinct

fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other

2026-09-30 10:55:06 -05:00

placeholder-guard-coupling

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

servicemonitor-ports-resolve

feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it

2026-10-01 21:56:07 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

whole-repo-invariants-wired

fix(conformance): the meta-check was layer-agnostic and reported failures silently

2026-09-18 22:43:17 -05:00