the immune system: rehome, the gauntlet, domain validation #254

Merged

plat merged 1 commit from immune-system into main

2026-09-02 02:56:01 +00:00

plat commented

2026-09-02 02:20:08 +00:00

Owner

Three pieces of one directive: CI that is rock solid, wieldable, and runs like an immune system — deterministic, in the background, never in charge.

rehome — the cousin test. NEW_DOMAIN=… nix run .#rehome moves a RUNNING platform to a new domain: cleartext identity sweep + in-cluster DNS re-render (write_coredns_rewrite, factored from germinate and proven byte-identical), sealed identity fields and BOTH pull-secret hosts re-sealed to the same sovereign key, OAuth redirects PATCHed in place (clients and secrets survive), repo websites re-pointed, the node registry mirror updated (k3d natively — it is creation-time k3s config, the one thing no gitops sweep can move; bare nodes get the single required step on the card), reconcile, rolls, in-cluster verification. v1 scope: dotted domains; flat daughters re-germinate.

The gauntlet (scripts/gauntlet/, workflow gauntlet.yml: nightly cron + dispatch). Scenarios are versioned bash, serial by design (the runner host serves prod; two germinations = forge 502s, measured). Results are one live issue per failing scenario, edited in place, self-closing on the next pass (report.sh). v1 scenarios: domain-validate (seconds, no cluster), rehome (full coldstart gate on both sides of a domain move), anon-surface (the privacy audit's intended-public inventory as assertions). Docs: docs/ops/gauntlet.md.

Domain validation at every front door. validate_domain (lib.sh) guards up, germinate (before the seed is even read), and rehome: lowercase RFC-1123 labels, ≥2, no -- (the flat-host / namespace grammar token). The gauntlet's local run caught two of my own bugs before this PR: a double-escaped heredoc in the coredns factor-out (functional diff vs the original caught it) and macOS lacking timeout(1).

Also: OAuth registrations in the fork path retry 3× before giving up (correctness audit #86 top finding — same posture _bv_push_tag earned); previews-born-on-demand note in docs/ops/on-demand.md (mcp 0.52.0, live); docs/proposals/platform-as-a-branch.md — the gitops/mitosis unification direction.

Reports this rides on: gitops #83 (privacy), #84 (packages), #85 (units), #86 (correctness).

Three pieces of one directive: CI that is rock solid, wieldable, and runs like an immune system — deterministic, in the background, never in charge. **`rehome` — the cousin test.** `NEW_DOMAIN=… nix run .#rehome` moves a RUNNING platform to a new domain: cleartext identity sweep + in-cluster DNS re-render (write_coredns_rewrite, factored from germinate and proven byte-identical), sealed identity fields and BOTH pull-secret hosts re-sealed to the same sovereign key, OAuth redirects PATCHed in place (clients and secrets survive), repo websites re-pointed, the node registry mirror updated (k3d natively — it is creation-time k3s config, the one thing no gitops sweep can move; bare nodes get the single required step on the card), reconcile, rolls, in-cluster verification. v1 scope: dotted domains; flat daughters re-germinate. **The gauntlet** (`scripts/gauntlet/`, workflow `gauntlet.yml`: nightly cron + dispatch). Scenarios are versioned bash, serial by design (the runner host serves prod; two germinations = forge 502s, measured). Results are one live issue per failing scenario, edited in place, self-closing on the next pass (`report.sh`). v1 scenarios: `domain-validate` (seconds, no cluster), `rehome` (full coldstart gate on both sides of a domain move), `anon-surface` (the privacy audit's intended-public inventory as assertions). Docs: `docs/ops/gauntlet.md`. **Domain validation at every front door.** `validate_domain` (lib.sh) guards `up`, `germinate` (before the seed is even read), and `rehome`: lowercase RFC-1123 labels, ≥2, no `--` (the flat-host / namespace grammar token). The gauntlet's local run caught two of my own bugs before this PR: a double-escaped heredoc in the coredns factor-out (functional diff vs the original caught it) and macOS lacking `timeout(1)`. Also: OAuth registrations in the fork path retry 3× before giving up (correctness audit #86 top finding — same posture `_bv_push_tag` earned); previews-born-on-demand note in docs/ops/on-demand.md (mcp 0.52.0, live); `docs/proposals/platform-as-a-branch.md` — the gitops/mitosis unification direction. Reports this rides on: gitops #83 (privacy), #84 (packages), #85 (units), #86 (correctness).

plat added 1 commit

2026-09-02 02:20:08 +00:00