jakman85andClaude Opus 5.5 a775082ae1 feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools ...

- conformance/lib/run_l1_offline.py: checks run in a thread pool (--jobs / CONF_OFFLINE_JOBS,
  default min(8, usable CPUs)); results consumed in submission order, so log lines, JUnit,
  step summary and the 0/1/3 aggregation are unchanged. Exports a smaller MUTATION_JOBS to
  the children when parallel, so nested pools do not oversubscribe.
- keycloak-{passkey,client-secret}-reconciler/mutations.py: anchors checked first (serial),
  then the --selftest subprocesses run in a pool (MUTATION_JOBS, default min(8, CPUs));
  verdicts reported in MUTATIONS order. Output byte-identical to the serial loop.
- ci/lint.sh: yamllint over LINT_JOBS contiguous slices concurrently, per-slice output
  buffered and printed in order; stage rc = highest slice rc.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-08 00:18:57 -06:00

..

admission-policies-actually-applied

fix(sec): the R-SEC-02 admission policy was never applied -- and nothing could tell

2026-09-29 13:23:09 -05:00

alert-metrics-have-scrape-targets

feat(upgrades): automated OS reboots (kured) + security-only unattended-upgrades, and give Renovate a runner

2026-10-18 00:10:29 -05:00

alert-rules-unit-tested

feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

2026-10-29 23:59:55 -05:00

alert-runbooks-resolvable

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

c2-root-surface

feat(sec): constrain the conformance CI trigger at admission (R-SEC-02)

2026-09-29 03:22:41 -05:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

test(l0): prove the dollar-collapse guard fires — and name the real envsubst

2026-09-13 16:24:42 -05:00

ha-control-plane-as-code

fix(conformance): one regex made the merge gate take 28 minutes instead of 2

2026-10-18 02:38:23 -05:00

internal-services-publish-no-public-dns

feat(conformance): L0 guard that the external-dns annotationPrefix matches the tree

2026-11-07 17:56:12 -06:00

keycloak-client-secret-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

keycloak-passkey-reconciler

feat(ci): run L0/L1 offline checks, mutation suites and yamllint in bounded parallel pools

2026-11-08 00:18:57 -06:00

l2-announced-vips-serve-from-any-node

fix(l4): externalTrafficPolicy Cluster on unifi + crafty L4 VIPs

2026-09-14 01:32:47 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

oauth2-proxy-api-routes-per-app

feat(auth): declare API paths per service, so --api-route can ship at all

2026-10-01 22:07:08 -05:00

oauth2-proxy-cookie-names-distinct

fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other

2026-09-30 10:55:06 -05:00

placeholder-guard-coupling

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

servicemonitor-ports-resolve

feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it

2026-10-01 21:56:07 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

2026-10-29 23:59:55 -05:00

whole-repo-invariants-wired

fix(conformance): the meta-check was layer-agnostic and reported failures silently

2026-09-18 22:43:17 -05:00