jakman85andClaude Opus 5.5 9c51f60a35 feat(conformance): L0 guard that the external-dns annotationPrefix matches the tree ...

Add assertion (8) to internal-services-publish-no-public-dns. The external-dns
HelmRelease must declare annotationPrefix explicitly, and every
external-dns annotation in apps/, platform/, runbooks/ and catalog/render.py
must use that prefix. The v0.23.0 default-prefix change on 2026-11-07
ignored the controller: none, target and hostname annotations while
assertions (1)-(3) stayed green.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-07 17:56:12 -06:00

..

admission-policies-actually-applied

fix(sec): the R-SEC-02 admission policy was never applied -- and nothing could tell

2026-09-29 13:23:09 -05:00

alert-metrics-have-scrape-targets

feat(upgrades): automated OS reboots (kured) + security-only unattended-upgrades, and give Renovate a runner

2026-10-18 00:10:29 -05:00

alert-rules-unit-tested

feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages

2026-10-29 23:59:55 -05:00

alert-runbooks-resolvable

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

c2-root-surface

feat(sec): constrain the conformance CI trigger at admission (R-SEC-02)

2026-09-29 03:22:41 -05:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

test(l0): prove the dollar-collapse guard fires — and name the real envsubst

2026-09-13 16:24:42 -05:00

ha-control-plane-as-code

fix(conformance): one regex made the merge gate take 28 minutes instead of 2

2026-10-18 02:38:23 -05:00

internal-services-publish-no-public-dns

feat(conformance): L0 guard that the external-dns annotationPrefix matches the tree

2026-11-07 17:56:12 -06:00

keycloak-client-secret-reconciler

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

keycloak-passkey-reconciler

fix(keycloak-passkey): bind only on git's say-so; protect real sub-flows; screen the requirement PUT by body id

2026-10-29 21:41:14 -05:00

l2-announced-vips-serve-from-any-node

fix(l4): externalTrafficPolicy Cluster on unifi + crafty L4 VIPs

2026-09-14 01:32:47 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

oauth2-proxy-api-routes-per-app

feat(auth): declare API paths per service, so --api-route can ship at all

2026-10-01 22:07:08 -05:00

oauth2-proxy-cookie-names-distinct

fix(auth): five oauth2-proxy sidecars shared one cookie and evicted each other

2026-09-30 10:55:06 -05:00

placeholder-guard-coupling

fix(conformance): whole-repo checks audited nested agent worktrees as source

2026-09-18 22:14:51 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

servicemonitor-ports-resolve

feat(obs): wire the gate-sidecar scrape, and fix the alert that would have gone silent doing it

2026-10-01 21:56:07 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(conformance): workload-mTLS certificates may use a private CA, if they prove they are workload-internal

2026-10-29 23:59:55 -05:00

whole-repo-invariants-wired

fix(conformance): the meta-check was layer-agnostic and reported failures silently

2026-09-18 22:43:17 -05:00