jakman85andClaude Opus 5.5
18f7ba8d0f
Retire Kasm from the catalog. Drop ACME revocation from R-TLS-02. Make L3 fault injection operator-run and exclude it from the merge gate (R-TEST-03, ADR-0026). Update the gap register to match; Homepage authentication is now ruled must-enforce and stays a gap until the implementation lands. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2.2 KiB
2.2 KiB
ADR-0026 — Fault injection is operator-run, never automated
- Status: Accepted
- Date: 2026-11-08
- Serves: R-TEST-03, R-TEST-05, R-ENV-03
- Supersedes: the L3 portion of ADR-0010's merge gating and of ADR-0011's CI-triggered harness
- Accepted by: operator ruling of 2026-11-08; effective on merge.
Context
ADR-0010 has the conformance suite gate merges, and ADR-0011 has CI trigger L2 and L3 as an in-cluster Job. Both were written when a dev/test cluster existed to break. ADR-0017 retired that cluster, so production is now the only target. An L3 test takes the VPN tunnel down, kills a node, injects a bad update or restores a backup. Running that automatically would put a production outage on a pipeline's schedule, and the operator sees no reason to do so.
Decision
- L3 fault-injection tests are never triggered by CI, a schedule or any other automation. The operator starts them deliberately, at a chosen time.
- L3 does not gate individual merges. The merge gate covers the automatable layers.
- Fault injection stays required. R-TEST-05 is unchanged: safety-critical behaviors are still verified by fault-injection tests, using the same in-cluster Job and scoped test identity. Each operator run is recorded in the implementation's run ledger.
- ADR-0011's decision stands for L2, and for L3's tooling and harness.
Alternatives considered
- Automate L3 against production on a schedule — rejected by the operator: a deliberate outage has no business being unattended.
- Rebuild a dev/test cluster to automate against — cost with no stated need; ADR-0017 retired it.
- Retire fault-injection tests altogether — not ruled. R-TEST-05 protects properties such as the VPN kill-switch and data survival, which happy-path checks cannot prove.
Consequences
- No credential or pipeline path can start a fault against production.
- A merge can change a safety-critical behavior without its L3 test re-running, so an L3 proof can go stale. The implementation's status tooling reports that staleness; re-running is an operator choice.
- The wiring that remains to be built for CI is the L2 trigger only.