jakman85 5fa893095b merge: the placeholder guard test was hiding a RED, not a pass ...

It had been permanently SKIPPED because it expected bootstrap/standup.sh,
which never landed on main — planned, never merged, still living only on the
unmerged prod-standup branches along with the 2026-09-05 incident it came
from. Dropping the real script in and running the old check produced FAIL
2/34: it would have false-blocked the very merge that landed its own input.

Now split into the half that needs no guard (no overlay ships a
placeholder-shaped effective cluster-vars value; an empty value must be
STATED by the overlay, not inherited in silence; a loud base sentinel must
be explicitly overridden) and the half that self-activates. The guard is
discovered by CONTENT — any tracked *.sh defining <name>_is_placeholder() —
so landing one anywhere activates the second half with no edit here, and two
definitions is a failure. The check never exits 3 again.

Unscoped L0 goes 13 PASS / 1 SKIP -> 14 PASS / 0 SKIP.

2026-09-13 00:14:17 -05:00

..

alert-rules-unit-tested

feat(ci): promtool in the pinned toolchain, one alert-rule harness, and the gaps declared

2026-09-13 00:02:27 -05:00

alert-runbooks-resolvable

fix(runbooks): declare whole-repo scope, drop the bespoke l0 stage, +cnpg-primary-spread

2026-09-13 00:00:24 -05:00

auditability-proofs-producible

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

bulk-tier-distinct-from-replicated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

dev-nodes-provisioned-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

egress-paths-selected-by-rules

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

flux-postbuild-substitution

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

ha-control-plane-as-code

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

keycloak-client-secret-reconciler

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

least-privilege-rbac

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

no-plaintext-secrets

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

placeholder-guard-coupling

fix(conformance): placeholder-guard-coupling actually RUNS — it was skipping forever

2026-09-13 00:10:37 -05:00

prod-baremetal-not-dev-surface

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

spec-immutability-enforced

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

tls-lifecycle-automated

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00

whole-repo-invariants-wired

fix(ci): declare whole-repo scope instead of hand-writing a gate stage per invariant

2026-09-12 23:45:06 -05:00