open-platform/mitosis

Fork 0

/goal /ultracode-workflows [POL-0] DESIGN the policy-authoring & governance-of-governance model (Kyverno) #38

New issue

Closed

opened 2026-07-01 02:03:49 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:49 +00:00

Owner

Track/Wave: POL-0 · Wave G2 · Size S
Repos: mitosis-vision
Depends on: RBAC-1

Why

Kyverno is the deterministic BACKEND (agent authors policy YAML from an NL prompt → PR → Flux → Kyverno enforces/generates with synchronize:true). Before agents get any policy-authoring capability, the governance-of-governance must be decided — a bad ClusterPolicy has platform-wide blast radius, unlike a per-app PR.

Scope

A design doc answering: (a) does policy live in gitops or a stricter-reviewed policy repo; (b) may agents ever WRITE policy or only PROPOSE via human-merged PR (per category: quota tier — maybe; default-deny network — human only); (c) enforce vs audit default for newly-merged policy (audit-first is safer for a self-modifying platform); (d) Kyverno webhook failurePolicy (fail-open unsafe vs fail-closed platform-wide-outage) — an explicit tested decision matching authorize()'s fail-closed philosophy. Enumerate the exact invariants POL-1..POL-5 enforce.

Acceptance

A reviewed doc with an explicit yes/no per policy category on 'can an agent's own PR change the policy that governs itself', plus the failurePolicy and enforce/audit defaults.

Notes

Design-first — natural fan-out target.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `POL-0` · Wave **G2** · Size **S** **Repos:** `mitosis-vision` **Depends on:** RBAC-1 ## Why Kyverno is the deterministic BACKEND (agent authors policy YAML from an NL prompt → PR → Flux → Kyverno enforces/generates with synchronize:true). Before agents get any policy-authoring capability, the governance-of-governance must be decided — a bad ClusterPolicy has platform-wide blast radius, unlike a per-app PR. ## Scope A design doc answering: (a) does policy live in gitops or a stricter-reviewed `policy` repo; (b) may agents ever WRITE policy or only PROPOSE via human-merged PR (per category: quota tier — maybe; default-deny network — human only); (c) enforce vs audit default for newly-merged policy (audit-first is safer for a self-modifying platform); (d) Kyverno webhook failurePolicy (fail-open unsafe vs fail-closed platform-wide-outage) — an explicit tested decision matching authorize()'s fail-closed philosophy. Enumerate the exact invariants POL-1..POL-5 enforce. ## Acceptance A reviewed doc with an explicit yes/no per policy category on 'can an agent's own PR change the policy that governs itself', plus the failurePolicy and enforce/audit defaults. ## Notes **Design-first — natural fan-out target.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:49 +00:00

plat added the

goal

roadmap

horizon:governance

labels

2026-07-01 02:03:49 +00:00

plat added a new dependency

2026-07-01 02:04:48 +00:00

#28 /goal /ultracode-workflows [RBAC-1] repo-permission authz in MCP (swap org-membership for the …/permission probe)

plat added a new dependency

2026-07-01 02:04:48 +00:00

#39 /goal /ultracode-workflows [POL-1] land Kyverno as a Flux-reconciled component + primitive-independent baselines

plat added a new dependency

2026-07-01 02:04:49 +00:00

#40 /goal /ultracode-workflows [POL-2] migrate overlayManifests governance → Kyverno generate policies (the real payoff)

plat added a new dependency

2026-07-01 02:04:49 +00:00

#41 /goal /ultracode-workflows [POL-3] image provenance via Kyverno verifyImages + platform CI cosign signing

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-01 02:36:20 +00:00

POL-0: Kyverno policy-governance model (design)

plat referenced this issue

2026-07-01 02:36:33 +00:00

POL-0: Kyverno policy-governance model (design) — plat/mitosis#38 #49

plat referenced this issue from a commit

2026-07-01 20:33:18 +00:00

POL-0: Kyverno policy-governance model (design) — plat/mitosis#38 (#49)

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat commented

2026-07-02 02:35:39 +00:00

Author

Owner

Audit (team-board): acceptance met — closing.

The design merged in PR #49 (bd8d0848): docs/proposals/policy-governance-kyverno.md (273 lines). It answers exactly what the acceptance demands:

Decision 2 — may an agent WRITE policy: NEVER direct write, propose-only via human-merged PR, explicit per category (quota-tier proposals allowed; cluster-shape/network policy human-only)
Decision 3 — Audit-first default for newly merged policy
Decision 4 — webhook failurePolicy, explicitly decided (Ignore while non-HA; fail-closed is a gated promotion)
POL-1..POL-5 invariants enumerated (doc §"Invariants")

Implementation demonstrably follows it: every merged policy file in plat/gitops cites "POL-0 Decision 3/4" in-line, and today's fresh daughter runs the decided posture (12 ClusterPolicies Ready, Audit, failurePolicy Ignore, plat.sh/app-scoped webhook). Doc landed in plat/mitosis docs/proposals/ rather than a separate vision repo — same review surface, no gap.

Audit (team-board): acceptance met — closing. The design merged in PR #49 (bd8d0848): `docs/proposals/policy-governance-kyverno.md` (273 lines). It answers exactly what the acceptance demands: - **Decision 2** — may an agent WRITE policy: NEVER direct write, propose-only via human-merged PR, explicit per category (quota-tier proposals allowed; cluster-shape/network policy human-only) - **Decision 3** — Audit-first default for newly merged policy - **Decision 4** — webhook `failurePolicy`, explicitly decided (Ignore while non-HA; fail-closed is a gated promotion) - **POL-1..POL-5 invariants enumerated** (doc §"Invariants") Implementation demonstrably follows it: every merged policy file in plat/gitops cites "POL-0 Decision 3/4" in-line, and today's fresh daughter runs the decided posture (12 ClusterPolicies Ready, Audit, failurePolicy Ignore, `plat.sh/app`-scoped webhook). Doc landed in plat/mitosis `docs/proposals/` rather than a separate vision repo — same review surface, no gap.

plat closed this issue

2026-07-02 02:35:41 +00:00

plat referenced this issue

2026-07-02 14:19:23 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue

2026-07-06 14:52:03 +00:00

/goal /ultracode-workflows [POL-1] land Kyverno as a Flux-reconciled component + primitive-independent baselines #39