jakman85andClaude Opus 5.5
8cd5ab2e41
Add R-DNS-04, R-DNS-05 and R-SEC-04 to the requirement mirror and tag the L0 tests that verify them. Align the R-ENV and R-UPD-02 summaries with the amended requirements. Point the VPN egress docs at ADR-0020; the drafted "ADR-0016" number went to the Cloudflare Tunnel. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.8 KiB
2.8 KiB
date, branch, title
| date | branch | title |
|---|---|---|
| 2026-11-08 | chore/adopt-spec-sync | Adopt the spec sync (registry parity, ADR cross-references, spec pin) |
What changed
The operator ruled this repo's main (50c8719) the accepted state and had the System Architect
bring the spec repo in line with it (spec PR jakman85/home-network-k3s#2). This is the
implementation half of that sync.
conformance/requirements/registry.yaml: added R-DNS-04, R-DNS-05 and R-SEC-04, which the spec defined and this mirror lacked. Reworded the R-ENV-01/02/03 and R-UPD-02 summaries to match the amended requirements.- Tagged existing L0 tests against those IDs, because a registry entry with no tagged test blocks
the merge:
cloudflared-ingress-rules(R-DNS-04, R-DNS-05, R-SEC-04),pihole-lan-names(R-DNS-04), andinternal-services-publish-no-public-dns(R-DNS-05). platform/vpn-egress/README.mdand a comment inegress-steering.yamlpointed at a drafted "ADR-0016 supersede". That number went to the Cloudflare Tunnel; the accepted ADR is ADR-0020.ci/SPEC_PINmust move to the spec merge commit. That SHA does not exist until the spec PR merges, so this PR carries aWIP:title until the bump is added.
What I verified
- Read each tagged test's assertions before tagging it.
cloudflared-ingress-rulesasserts every LAN-only hostname maps to a 404, the catch-all exists, no rule targets the API, and the egress policy admits no API or host entity.pihole-lan-namesasserts LAN names resolve independently of the public path.internal-services-publish-no-public-dnsasserts internal routes carry the disown annotation and pins the declared L4 set. - The toolbox gate result for this commit is quoted in the PR description, with the spec branch mounted so that the checks parsing spec text ran against the new spec.
What I did NOT verify
- These tags are static coverage, not proof. No L2 test touches the tunnel, and nothing here
shows router 80/443 closed or 6443 unforwarded (spec
docs/16-known-gaps.md). - R-SEC-04 is registered
safety_critical: false. Making ittrueneeds an L3 fault-injection test that does not exist. UNVERIFIED whether the operator wants that. - No live cluster, tunnel or DNS state was measured.
spec-immutabilitydid not run against a pinned checkout: the pin is not bumped yet.- Stale implementation prose found by the audit was deliberately left out of this PR, because the
operator ruled this repo the accepted state and none of it changes behaviour. Examples:
catalog/gitea.yamlstill says "+ mirrored";platform/longhornstill promises a backup target;README.mdsaysnode-lossis outstanding;hands-off-updateexercises Flux image policy rather than Renovate;dev-nodes-provisioned-as-codeis named for an environment that no longer exists.