docs: apply the operator's rulings on Kasm, revocation and fault injection

Retire Kasm from the catalog. Drop ACME revocation from R-TLS-02. Make L3 fault injection operator-run and exclude it from the merge gate (R-TEST-03, ADR-0026). Update the gap register to match; Homepage authentication is now ruled must-enforce and stays a gap until the implementation lands. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-08 23:06:26 -06:00
1 parent c626349c7d
commit 18f7ba8d0f
@@ -59,8 +59,8 @@ pattern choices.
 | [0007](adr-0007-secrets-sops-age.md) | Secrets: SOPS + age | Accepted | R-SEC-01 |
 | [0008](adr-0008-vpn-egress-model.md) | VPN egress model: Gluetun sidecar + Cilium Egress Gateway | ~~Superseded by 0012~~ | R-NET-05/06 |
 | [0009](adr-0009-automated-image-updates.md) | Automated updates: Flux image automation + Renovate | ~~Superseded by 0023~~ | R-UPD-01..03 |
-| [0010](adr-0010-conformance-testing.md) | Conformance testing: automated, reproducible, behavior-based | Accepted | R-TEST-01..06 |
-| [0011](adr-0011-test-tooling-kyverno-chainsaw.md) | Conformance test tooling: Kyverno + Chainsaw | Accepted | R-TEST-01..05 |
+| [0010](adr-0010-conformance-testing.md) | Conformance testing: automated, reproducible, behavior-based | Accepted — L3 merge gating superseded by 0026 | R-TEST-01..06 |
+| [0011](adr-0011-test-tooling-kyverno-chainsaw.md) | Conformance test tooling: Kyverno + Chainsaw | Accepted — L3 CI trigger superseded by 0026 | R-TEST-01..05 |
 | [0012](adr-0012-vpn-egress-single-expressvpn-gateway.md) | VPN egress: single shared in-cluster ExpressVPN gateway | ~~Superseded by 0013~~ | R-NET-05/06/07 |
 | [0013](adr-0013-vpn-provider-pia-gluetun-wireguard.md) | VPN provider: PIA over OpenVPN-UDP + port forwarding | Accepted — provider/protocol only (client+steering superseded by 0015) | R-NET-05/06/07 |
 | [0014](adr-0014-idp-keycloak.md) | Identity Provider: Keycloak (SSO via OIDC + forward-auth) | Accepted — forward-auth enforcement point and app list superseded by 0022 | R-IDP-01..06 |
@@ -75,3 +75,4 @@ pattern choices.
 | [0023](adr-0023-automated-updates-renovate.md) | Automated updates: Renovate for images and charts, every change PR-gated | Accepted | R-UPD-01, R-UPD-02, R-UPD-03, R-TEST-03 |
 | [0024](adr-0024-delivery-authority-ci-gate.md) | Delivery authority: the CI gate is the approver; sensitive-path review; attributed admin override | Accepted | R-TEST-03, R-TEST-06, R-GITOPS-01, R-SEC-02 |
 | [0025](adr-0025-in-cluster-ai-program-manager.md) | In-cluster AI Program Manager (pm-agent) | Accepted | R-GITOPS-01, R-TEST-03, R-TEST-06, R-SEC-02 |
+| [0026](adr-0026-fault-injection-operator-run.md) | Fault injection is operator-run, never automated | Accepted | R-TEST-03, R-TEST-05, R-ENV-03 |
@@ -1,5 +1,5 @@
 # ADR-0010 — Conformance testing: automated, reproducible, behavior-based
- Status: Accepted
+- Status: Accepted — stands, except that L3 fault injection does not gate merges ([ADR-0026](adr-0026-fault-injection-operator-run.md))
 - Date: 2026-08-15
 - Serves: R-TEST-01, R-TEST-02, R-TEST-03, R-TEST-04, R-TEST-05, R-TEST-06
 - Supersedes: —
@@ -1,5 +1,5 @@
 # ADR-0011 — Conformance test tooling: Kyverno + Chainsaw
- Status: Accepted
+- Status: Accepted — stands, except that L3 is operator-run rather than CI-triggered ([ADR-0026](adr-0026-fault-injection-operator-run.md))
 - Date: 2026-08-15
 - Serves: R-TEST-01, R-TEST-02, R-TEST-03, R-TEST-04, R-TEST-05
 - Refines: [ADR-0010](adr-0010-conformance-testing.md) (which fixed the *approach* and left the tool mix as the one open item)
@@ -0,0 +1,37 @@
+# ADR-0026 — Fault injection is operator-run, never automated
+- Status: Accepted
+- Date: 2026-11-08
+- Serves: R-TEST-03, R-TEST-05, R-ENV-03
+- Supersedes: the L3 portion of ADR-0010's merge gating and of ADR-0011's CI-triggered harness
+- Accepted by: operator ruling of 2026-11-08; effective on merge.
+
+## Context
+[ADR-0010](adr-0010-conformance-testing.md) has the conformance suite gate merges, and
+[ADR-0011](adr-0011-test-tooling-kyverno-chainsaw.md) has CI trigger L2 and L3 as an in-cluster Job.
+Both were written when a dev/test cluster existed to break.
+[ADR-0017](adr-0017-single-environment-bare-metal-production.md) retired that cluster, so production
+is now the only target. An L3 test takes the VPN tunnel down, kills a node, injects a bad update or
+restores a backup. Running that automatically would put a production outage on a pipeline's
+schedule, and the operator sees no reason to do so.
+
+## Decision
+- **L3 fault-injection tests are never triggered by CI, a schedule or any other automation.** The
+  operator starts them deliberately, at a chosen time.
+- **L3 does not gate individual merges.** The merge gate covers the automatable layers.
+- **Fault injection stays required.** R-TEST-05 is unchanged: safety-critical behaviors are still
+  verified by fault-injection tests, using the same in-cluster Job and scoped test identity. Each
+  operator run is recorded in the implementation's run ledger.
+- ADR-0011's decision stands for L2, and for L3's tooling and harness.
+
+## Alternatives considered
+- **Automate L3 against production on a schedule** — rejected by the operator: a deliberate outage
+  has no business being unattended.
+- **Rebuild a dev/test cluster to automate against** — cost with no stated need; ADR-0017 retired it.
+- **Retire fault-injection tests altogether** — not ruled. R-TEST-05 protects properties such as the
+  VPN kill-switch and data survival, which happy-path checks cannot prove.
+
+## Consequences
+- No credential or pipeline path can start a fault against production.
+- A merge can change a safety-critical behavior without its L3 test re-running, so an L3 proof can go
+  stale. The implementation's status tooling reports that staleness; re-running is an operator choice.
+- The wiring that remains to be built for CI is the L2 trigger only.