open-platform/mitosis

Fork 0

/goal /ultracode-workflows [SPINE-4] re-establish a known-good baseline — germinate a fresh long-lived reference/staging platform from post-SPINE-2/3 main #27

New issue

Closed

opened 2026-07-01 02:03:43 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:43 +00:00

Owner

Track/Wave: SPINE-4 · Wave M5 · Size M
Repos: mitosis, mcp, agents, gitops, _app-template
Depends on: SPINE-2, SPINE-3, DOM-1a, SEC-1, HYB-1

Why

Nothing runs the current stack today (gc.local torn down; prod on old versions). This re-validates hardened main end-to-end and becomes the reference/staging platform Horizon 2 validates against. Immediate pre-condition to the client VPS deploy.

Scope

Germinate a fresh long-lived platform from hardened main; exercise the full secrets flow (prod + dev PLAT_DEV scoping), the credential boundary, public TLS, and a real agent-built app with DB+bucket end-to-end; KEEP IT RUNNING as staging.

Acceptance

Passes CI-1 AND a human-reviewed report confirms secret scoping, the non-admin boundary (#16 red-team), and browser-trusted TLS on a client-shaped app; the platform is kept alive as staging.

Notes

→ MVP milestone: after this, germinate main onto the client's VPS. That is the SOW deliverable.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `SPINE-4` · Wave **M5** · Size **M** **Repos:** `mitosis`, `mcp`, `agents`, `gitops`, `_app-template` **Depends on:** SPINE-2, SPINE-3, DOM-1a, SEC-1, HYB-1 ## Why Nothing runs the current stack today (gc.local torn down; prod on old versions). This re-validates hardened main end-to-end and becomes the reference/staging platform Horizon 2 validates against. Immediate pre-condition to the client VPS deploy. ## Scope Germinate a fresh long-lived platform from hardened main; exercise the full secrets flow (prod + dev PLAT_DEV scoping), the credential boundary, public TLS, and a real agent-built app with DB+bucket end-to-end; KEEP IT RUNNING as staging. ## Acceptance Passes CI-1 AND a human-reviewed report confirms secret scoping, the non-admin boundary (#16 red-team), and browser-trusted TLS on a client-shaped app; the platform is kept alive as staging. ## Notes **→ MVP milestone: after this, germinate main onto the client's VPS. That is the SOW deliverable.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:43 +00:00

plat added the

roadmap

goal

horizon:mvp

labels

2026-07-01 02:03:43 +00:00

plat added a new dependency

2026-07-01 02:04:42 +00:00

#22 /goal /ultracode-workflows [SPINE-2] fix ci-builder cold-start KEDA/runner stall (#19) + validate seed refresh (#14 / PR #20)

plat added a new dependency

2026-07-01 02:04:42 +00:00

#23 /goal /ultracode-workflows [SPINE-3] land credential-boundary germinate provisioning (rebase PR #18) + reconcile branch-protect divergence

plat added a new dependency

2026-07-01 02:04:43 +00:00

#24 /goal /ultracode-workflows [DOM-1a] public ACME TLS for the platform domain (letsencrypt-dns01 ClusterIssuer + public wildcard cert)

plat added a new dependency

2026-07-01 02:04:43 +00:00

#26 /goal /ultracode-workflows [SEC-1] sovereign age-key backup, escrow verification, and rotation runbook + tooling

plat added a new dependency

2026-07-01 02:04:43 +00:00

#25 /goal /ultracode-workflows [HYB-1] harden the bare-k3s VPS germination path (two-step registries + tunnel cutover + public-edge-aware germinate)

plat added a new dependency

2026-07-01 02:04:53 +00:00

#46 /goal /ultracode-workflows [GATE] validated grandchild acceptance gate — secrets+domains+rbac+policy on a VPS depth-2/3 platform

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat commented

2026-07-02 20:35:21 +00:00

Author

Owner

SPINE-4 delivered: long-lived reference/staging platform staging.local germinated on the vxrail from the current committed seed (post-0.7.6 + full tooling era) and LEFT RUNNING as the standing baseline. Full acceptance gate 12/12 + GATE PASS (context k3d-staging: whiteboard 10/10 Kustomizations + 12 ClusterPolicies, single restart-idempotent webhook on the 0.7.6 verify path, redirect matrix, hostNetwork mirror + crictl pull, agents 0.7.6/mcp 0.26.0, tier-1 mitosis fork with true parent lineage). Standing roles: (a) soak/long-run stability target — the one axis ephemeral CI daughters cannot cover; (b) the PolicyReport bake window plat/gitops#14's Enforce checklist needs; (c) demo/reference. Ops: checkout + logs at vxrail:~/staging-mitosis, fork key backup in ~/.mitosis-keys. Closing.

SPINE-4 delivered: long-lived reference/staging platform `staging.local` germinated on the vxrail from the current committed seed (post-0.7.6 + full tooling era) and LEFT RUNNING as the standing baseline. Full acceptance gate 12/12 + GATE PASS (context k3d-staging: whiteboard 10/10 Kustomizations + 12 ClusterPolicies, single restart-idempotent webhook on the 0.7.6 verify path, redirect matrix, hostNetwork mirror + crictl pull, agents 0.7.6/mcp 0.26.0, tier-1 mitosis fork with true parent lineage). Standing roles: (a) soak/long-run stability target — the one axis ephemeral CI daughters cannot cover; (b) the PolicyReport bake window plat/gitops#14's Enforce checklist needs; (c) demo/reference. Ops: checkout + logs at vxrail:~/staging-mitosis, fork key backup in ~/.mitosis-keys. Closing.

plat closed this issue

2026-07-02 20:35:21 +00:00