open-platform/mitosis

Fork 0

[ROADMAP] First Client Deploy → Governance — tracker #47

New issue

Open

opened 2026-07-01 02:05:20 +00:00 by plat · 3 comments

plat commented

2026-07-01 02:05:20 +00:00

Owner

📍 Status 2026-07-06: roadmap executed and shipped (0.7.6 train on prod, nightly gate green, reseed automated). Still open: Enforce flips #42/#43 (+#41 cosign keys), HYB-2 #35 + GATE #46 acceptance, design PR #48 (#36) — all labeled operator-decision. Full state: see the 2026-07-06 comment below.

First Client Deploy → Governance — the roadmap tracker. All items are goal issues under the Client Deploy → Governance Roadmap milestone, carrying native blockedBy dependencies. Two horizons; waves are seam-serialized so parallel agents don't collide on bin/germinate/bin/lib.sh, mcp/src/server.ts (overlay renderer), or the gitops root kustomization.

Async substrate (start now, non-blocking)

#21 CI-1 — cold-start CI (Forgejo Actions + vcluster). Merges to main when robust; then everything validates through it.

Horizon 1 — Client-Deployable MVP (deploy tomorrow)

Wave	Issues
M1	#22 SPINE-2 · #24 DOM-1a
M2	#23 SPINE-3
M3	#25 HYB-1
M4	#26 SEC-1
M5	#27 SPINE-4 → ship to client's VPS

Horizon 2 — Governance (overlaps H1 where seams allow)

Wave	Issues
G1	#28 RBAC-1 · #44 SEC-2
G2	#34 DOM-1b · #38 POL-0 · #33 RBAC-7
G3	#29 RBAC-2 · #39 POL-1
G4	#30 RBAC-3 · #31 RBAC-4 · #40 POL-2 · #41 POL-3
G5	#37 DOM-2 · #32 RBAC-5 · #42 POL-4 · #43 POL-5 · #45 SEC-3
G6	#46 GATE — full multi-primitive acceptance on a VPS granddaughter

Backlog

#36 HYB-3 — OpenTofu multi-cloud substrate (design only)
BYO IdP (Entra/OIDC) — revisit when the client needs corporate SSO

Critical path (to GATE): DOM-1a → DOM-1b → RBAC-2 → RBAC-4 → DOM-2 → POL-4/POL-5 → GATE (RBAC-1 gates the RBAC chain). The MVP path (SPINE-2 → SPINE-3 → HYB-1 → SEC-1, DOM-1a in parallel) ships far earlier.

Each goal issue is written for an autonomous agent that may recurse into its own subagent team. Seam rule: land on a shared seam by rebase; don't start a seam position until the prior one merges.

> **📍 Status 2026-07-06:** roadmap executed and shipped (0.7.6 train on prod, nightly gate green, reseed automated). Still open: Enforce flips #42/#43 (+#41 cosign keys), HYB-2 #35 + GATE #46 acceptance, design PR #48 (#36) — all labeled `operator-decision`. Full state: see the 2026-07-06 comment below. **First Client Deploy → Governance** — the roadmap tracker. All items are `goal` issues under the *Client Deploy → Governance Roadmap* milestone, carrying native `blockedBy` dependencies. Two horizons; waves are seam-serialized so parallel agents don't collide on `bin/germinate`/`bin/lib.sh`, `mcp/src/server.ts` (overlay renderer), or the gitops root kustomization. ## Async substrate (start now, non-blocking) - #21 **CI-1** — cold-start CI (Forgejo Actions + vcluster). Merges to `main` when robust; then everything validates through it. ## Horizon 1 — Client-Deployable MVP (deploy tomorrow) | Wave | Issues | |---|---| | M1 | #22 SPINE-2 · #24 DOM-1a | | M2 | #23 SPINE-3 | | M3 | #25 HYB-1 | | M4 | #26 SEC-1 | | M5 | #27 SPINE-4 → **ship to client's VPS** | ## Horizon 2 — Governance (overlaps H1 where seams allow) | Wave | Issues | |---|---| | G1 | #28 RBAC-1 · #44 SEC-2 | | G2 | #34 DOM-1b · #38 POL-0 · #33 RBAC-7 | | G3 | #29 RBAC-2 · #39 POL-1 | | G4 | #30 RBAC-3 · #31 RBAC-4 · #40 POL-2 · #41 POL-3 | | G5 | #37 DOM-2 · #32 RBAC-5 · #42 POL-4 · #43 POL-5 · #45 SEC-3 | | G6 | #46 GATE — full multi-primitive acceptance on a VPS granddaughter | ## Backlog - #36 HYB-3 — OpenTofu multi-cloud substrate (design only) - BYO IdP (Entra/OIDC) — revisit when the client needs corporate SSO **Critical path (to GATE):** DOM-1a → DOM-1b → RBAC-2 → RBAC-4 → DOM-2 → POL-4/POL-5 → GATE (RBAC-1 gates the RBAC chain). The MVP path (SPINE-2 → SPINE-3 → HYB-1 → SEC-1, DOM-1a in parallel) ships far earlier. *Each `goal` issue is written for an autonomous agent that may recurse into its own subagent team. Seam rule: land on a shared seam by rebase; don't start a seam position until the prior one merges.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:05:20 +00:00

plat added the

roadmap

label

2026-07-01 02:05:20 +00:00

plat commented

2026-07-02 02:21:34 +00:00

Author

Owner

Status reconciliation — 2026-07-01

Verified wave-by-wave against merged PRs on plat/{mitosis,gitops,agents,mcp,_app-template} and issue states, plus today's wb-gate E2E on a fresh plat.local daughter. Legend: DONE = merged + issue closed · LANDED/open = code merged, issue open (Audit-mode caveat or acceptance formality outstanding) · PARTIAL · IN-FLIGHT · NOT STARTED.

Wave	Item	Status	Evidence
M0	#21 CI-1	NOT STARTED	no Actions harness merged anywhere; still the biggest lever
M1	#22 SPINE-2	LANDED/open	#19 closed, seed PR #20 merged (superseded by #56, #61); the formal 10-consecutive-cold-start acceptance was never recorded
M1	#24 DOM-1a	DONE	plat/gitops#3 + #53 (per-daughter CF token reseal); production TLS proven on the real product-garden.com VPS
M2	#23 SPINE-3	DONE	PR #18 (credential-boundary provisioning)
M3	#25 HYB-1	DONE	PR #51 (bare-k3s two-step + tunnel cutover)
M4	#26 SEC-1	DONE	PR #52 (age-key backup/rotation + runbook)
M5	#27 SPINE-4	OPEN	today's wb-gate daughter proved hardened-main E2E, but nothing long-lived is kept running as staging — the deliverable is unmet
G1	#28 RBAC-1 · #44 SEC-2	DONE	plat/mcp#5 · plat/mcp#4 + plat/_app-template#2
G2	#34 DOM-1b · #33 RBAC-7	DONE	plat/mcp#6 (v0.24.0) · PR #55 (design)
G2	#38 POL-0	LANDED/open	design merged in PR #49; issue never closed
G3	#29 RBAC-2	DONE	plat/mcp#7 (forwardAuth + middleware)
G3	#39 POL-1	LANDED/open	plat/gitops#4 merged; proven live today — germinate deploys kyverno + kyverno-policies among 10/10 Kustomizations first-try
G4	#30 RBAC-3 · #31 RBAC-4	DONE	plat/_app-template#3 · plat/agents#8 + plat/mcp#9
G4	#40 POL-2 · #41 POL-3	LANDED/open	plat/gitops#6 + plat/mcp#8 (overlay trimmed) · plat/gitops#8 + plat/_app-template#4/#6 (conditional cosign, carried by the #61 seed)
G5	#32 RBAC-5 · #45 SEC-3	DONE	plat/agents#9 + #58 (HMAC seal) · PR #54
G5	#37 DOM-2	PARTIAL (closed)	plat/mcp#10 FQDN-egress renderer merged default-off; CNI swap NO-GO (evidence PR #59, closed unmerged) → prerequisite tracked in #60; #13 stays open behind it
G5	#42 POL-4 · #43 POL-5	LANDED/open	plat/gitops#7/#9 merged — all 12 ClusterPolicies live but 100% Audit + namespaceSelector `plat.sh/app` (intentional); the Enforce flip + acceptance is the remaining scope
G6	#46 GATE	PARTIAL	local-equivalent gate PASSED today on a fresh daughter (all 5 primitives, see the GATE-PASSED comment on #46); the unattended VPS depth-2/3 run remains — blocked on HYB-2 + CI-1
—	#35 HYB-2	UNBLOCKED, needs operator go	DigitalOcean token + Cloudflare tunnel token now in hand; costs real money
—	#36 HYB-3	IN-FLIGHT	design PR #48 open

Shipped today (wb-gate arc, PR #61 + seed): fresh daughter germination activates the WHOLE whiteboard first-try — 10/10 Flux Kustomizations incl. kyverno + kyverno-policies, 12 ClusterPolicies (Audit); full E2E on a fresh plat.local daughter: template → agent build → browser review → auto-merge → prod 200 (pulse).

Found today (issues + fixes in flight): #63 duplicate system webhook every dispatcher boot (fix: plat/agents#10) · #57 root-caused — reviewer probe used loopback from inside the pod, ~10-min spurious fallback (fix: plat/agents#11) · #64 port-80 serves Forgejo in cleartext (first fix failed validation; rework running on plat/gitops fix/web-entrypoint-https-redirect) · #62 depth-2 reseed, delivered as PR #65.

Next horizon (proposed order)

agents 0.7.6 release train — #66. Merge plat/agents#10 + #11 → tag v0.7.6 → gitops pin bump → genesis reseed (follow-up to PR #65). Cheap, mechanical, retires #63/#57.
Land the #64 rework and fold it into the same pin/seed window — one reseed instead of two.
GATE regression assertions — #67. Today's two failure modes both self-heal, so a naive E2E passes while degraded; add exactly-one-webhook-after-restart + no-fallback reviewer liveness to the #21/#46 assertion set.
The fork in the road (operator decision): #35 HYB-2 vs #21 CI-1. HYB-2 is materially unblocked (DO + tunnel tokens in hand) and retires the real-infra unknown early, but spends money and needs the operator's go. CI-1 spends only time and is what makes GATE unattended-repeatable — #46 explicitly extends the CI-1 harness. They share no seams, so with budget they can run in parallel; if serialized, CI-1 first keeps the capstone honest, HYB-2 first buys the earliest client-shaped proof.
Governance tail after the train: POL Enforce flip (#42/#43 remaining scope), #38/#39/#40/#41 issue closure on acceptance evidence, #60 Cilium prerequisite (then flip PLAT_FQDN_EGRESS=1 and #13 closes), then the full #46 VPS gate.

Additive reconciliation only — no issues were closed or edited; owners of the LANDED/open rows should close on their own acceptance evidence.

## Status reconciliation — 2026-07-01 Verified wave-by-wave against merged PRs on plat/{mitosis,gitops,agents,mcp,_app-template} and issue states, plus today's wb-gate E2E on a fresh `plat.local` daughter. Legend: **DONE** = merged + issue closed · **LANDED/open** = code merged, issue open (Audit-mode caveat or acceptance formality outstanding) · **PARTIAL** · **IN-FLIGHT** · **NOT STARTED**. | Wave | Item | Status | Evidence | |---|---|---|---| | M0 | #21 CI-1 | **NOT STARTED** | no Actions harness merged anywhere; still the biggest lever | | M1 | #22 SPINE-2 | **LANDED/open** | #19 closed, seed PR #20 merged (superseded by #56, #61); the formal 10-consecutive-cold-start acceptance was never recorded | | M1 | #24 DOM-1a | **DONE** | plat/gitops#3 + #53 (per-daughter CF token reseal); production TLS proven on the real product-garden.com VPS | | M2 | #23 SPINE-3 | **DONE** | PR #18 (credential-boundary provisioning) | | M3 | #25 HYB-1 | **DONE** | PR #51 (bare-k3s two-step + tunnel cutover) | | M4 | #26 SEC-1 | **DONE** | PR #52 (age-key backup/rotation + runbook) | | M5 | #27 SPINE-4 | **OPEN** | today's wb-gate daughter proved hardened-main E2E, but nothing long-lived is kept running as staging — the deliverable is unmet | | G1 | #28 RBAC-1 · #44 SEC-2 | **DONE** | plat/mcp#5 · plat/mcp#4 + plat/_app-template#2 | | G2 | #34 DOM-1b · #33 RBAC-7 | **DONE** | plat/mcp#6 (v0.24.0) · PR #55 (design) | | G2 | #38 POL-0 | **LANDED/open** | design merged in PR #49; issue never closed | | G3 | #29 RBAC-2 | **DONE** | plat/mcp#7 (forwardAuth + middleware) | | G3 | #39 POL-1 | **LANDED/open** | plat/gitops#4 merged; proven live today — germinate deploys kyverno + kyverno-policies among 10/10 Kustomizations first-try | | G4 | #30 RBAC-3 · #31 RBAC-4 | **DONE** | plat/_app-template#3 · plat/agents#8 + plat/mcp#9 | | G4 | #40 POL-2 · #41 POL-3 | **LANDED/open** | plat/gitops#6 + plat/mcp#8 (overlay trimmed) · plat/gitops#8 + plat/_app-template#4/#6 (conditional cosign, carried by the #61 seed) | | G5 | #32 RBAC-5 · #45 SEC-3 | **DONE** | plat/agents#9 + #58 (HMAC seal) · PR #54 | | G5 | #37 DOM-2 | **PARTIAL** (closed) | plat/mcp#10 FQDN-egress renderer merged **default-off**; CNI swap NO-GO (evidence PR #59, closed unmerged) → prerequisite tracked in #60; #13 stays open behind it | | G5 | #42 POL-4 · #43 POL-5 | **LANDED/open** | plat/gitops#7/#9 merged — all 12 ClusterPolicies live but 100% **Audit** + namespaceSelector `plat.sh/app` (intentional); the Enforce flip + acceptance is the remaining scope | | G6 | #46 GATE | **PARTIAL** | local-equivalent gate PASSED today on a fresh daughter (all 5 primitives, see the GATE-PASSED comment on #46); the unattended VPS depth-2/3 run remains — blocked on HYB-2 + CI-1 | | — | #35 HYB-2 | **UNBLOCKED, needs operator go** | DigitalOcean token + Cloudflare tunnel token now in hand; costs real money | | — | #36 HYB-3 | **IN-FLIGHT** | design PR #48 open | **Shipped today (wb-gate arc, PR #61 + seed):** fresh daughter germination activates the WHOLE whiteboard first-try — 10/10 Flux Kustomizations incl. kyverno + kyverno-policies, 12 ClusterPolicies (Audit); full E2E on a fresh `plat.local` daughter: template → agent build → browser review → auto-merge → prod 200 (`pulse`). **Found today (issues + fixes in flight):** #63 duplicate system webhook every dispatcher boot (fix: plat/agents#10) · #57 root-caused — reviewer probe used loopback from inside the pod, ~10-min spurious fallback (fix: plat/agents#11) · #64 port-80 serves Forgejo in cleartext (first fix failed validation; rework running on plat/gitops `fix/web-entrypoint-https-redirect`) · #62 depth-2 reseed, delivered as PR #65. ## Next horizon (proposed order) 1. **agents 0.7.6 release train — #66.** Merge plat/agents#10 + #11 → tag v0.7.6 → gitops pin bump → genesis reseed (follow-up to PR #65). Cheap, mechanical, retires #63/#57. 2. **Land the #64 rework** and fold it into the same pin/seed window — one reseed instead of two. 3. **GATE regression assertions — #67.** Today's two failure modes both self-heal, so a naive E2E passes while degraded; add exactly-one-webhook-after-restart + no-fallback reviewer liveness to the #21/#46 assertion set. 4. **The fork in the road (operator decision): #35 HYB-2 vs #21 CI-1.** HYB-2 is materially unblocked (DO + tunnel tokens in hand) and retires the real-infra unknown early, but spends money and needs the operator's go. CI-1 spends only time and is what makes GATE unattended-repeatable — #46 explicitly extends the CI-1 harness. They share no seams, so with budget they can run in parallel; if serialized, CI-1 first keeps the capstone honest, HYB-2 first buys the earliest client-shaped proof. 5. **Governance tail after the train:** POL Enforce flip (#42/#43 remaining scope), #38/#39/#40/#41 issue closure on acceptance evidence, #60 Cilium prerequisite (then flip `PLAT_FQDN_EGRESS=1` and #13 closes), then the full #46 VPS gate. *Additive reconciliation only — no issues were closed or edited; owners of the LANDED/open rows should close on their own acceptance evidence.*

plat commented

2026-07-02 14:19:23 +00:00

Author

Owner

Tracker refresh (release engineering lane): 0.7.6 train SHIPPED to prod (agents v0.7.6 = #57+#63+#11 fixes; gitops = #64 redirect + #60-prereq hostNetwork mirror; genesis seed = released train — depth-2+ carry everything). CI-1 (#21) DELIVERED + proven: repo-scoped vxrail runner + coldstart workflow + shared gate script; germinate-touching PRs now auto-validate on a fresh platform (first consumer: #70's PR #72, gate running as this is written). Closed this cycle: #11 #21 #57 #62 #63 #64 (+#2 #15 #38 from the hygiene sweep). Two release-blockers were found BY the RC validation process and fixed same-day (germinate pre-release regex; caddy file-caps EPERM) — the strongest evidence yet for gate-everything. Open decisions for the operator: close-proposals #39/#22/#3; HYB-2 (#35, spends money) vs governance tail (POL Enforce flips #42/#43); #67's reviewer-fallback assertion needs the nightly app-E2E gate variant (sealed credential).

Tracker refresh (release engineering lane): **0.7.6 train SHIPPED to prod** (agents v0.7.6 = #57+#63+#11 fixes; gitops = #64 redirect + #60-prereq hostNetwork mirror; genesis seed = released train — depth-2+ carry everything). **CI-1 (#21) DELIVERED + proven**: repo-scoped vxrail runner + coldstart workflow + shared gate script; germinate-touching PRs now auto-validate on a fresh platform (first consumer: #70's PR #72, gate running as this is written). Closed this cycle: #11 #21 #57 #62 #63 #64 (+#2 #15 #38 from the hygiene sweep). Two release-blockers were found BY the RC validation process and fixed same-day (germinate pre-release regex; caddy file-caps EPERM) — the strongest evidence yet for gate-everything. Open decisions for the operator: close-proposals #39/#22/#3; HYB-2 (#35, spends money) vs governance tail (POL Enforce flips #42/#43); #67's reviewer-fallback assertion needs the nightly app-E2E gate variant (sealed credential).

plat commented

2026-07-06 14:52:45 +00:00

Author

Owner

Board cleanup + full status — 2026-07-06

Shipped and live. Prod runs the 0.7.6 train (pod images verified today: agents 0.7.6, mcp 0.26.0). Genesis seed = r29, produced and merged by the automated reseed pipeline (#14). Fresh germinations activate the whole whiteboard (Kyverno + baselines, letsencrypt, cosign-signing, forwardAuth, webhook HMAC, credential boundary, fork genealogy).

Automation is green unattended. Nightly coldstart gate 4-for-4 since the train shipped (runs 33–36, 07-03→07-06, ~18 min each, incl. app-E2E). Reseed pipeline opened+merged r25/r29 with the no-op guard working (r27 correctly dropped). Nightly prod backups fresh through 2026-07-06 03:35.

Closed in this cleanup (all verified delivered): #3 self-serve domains (DOM-1b mcp v0.24.0 + DOM-1a, proven on product-garden.com) · #39 POL-1 Kyverno landed (gitops#4, 12 ClusterPolicies live) · #40 POL-2 generate-migration (gitops#6 + mcp#8, drift-heal proven, depth-2 evidence) · #69 canary epic (7/7 probes, superseded by the nightly E2E gate).

Remaining — operator decisions (label operator-decision):

#42 / #43 — flip Kyverno Audit→Enforce: merge plat/gitops#14, run the ENFORCE.md checklist.
#41 — cosign key custody (generate+seal keypair; verifyImages is a placeholder until then).
#35 HYB-2 — real-VPS granddaughter run (spends money).
#46 GATE — accept the assembled depth-2/vxrail evidence, or run the literal unattended VPS capstone (pairs with #35).
#36 — review/merge design PR #48 (OpenTofu substrate contract).

Remaining — implementation work:

#6 Grafana: PR #8 is conflicted against the post-#61 trim_gitops_lean rewrite — needs re-threading, plus the unmerged gitops branch.
#7 agent-work: plat/agents#2 is stale against the 0.7.6 dispatcher — rebase or redo.
#17 live transcripts: heartbeat v1 shipped; full SSE/SPA version awaits owner decisions 1–3.
#60 → #13 Cilium: run the CNI swap on a disposable germination, then flip PLAT_FQDN_EGRESS and tighten the 443/80 default.
#4 / #5: designs ride open PR #9.

Open PR queue: mitosis #8 (conflicted), #9 (design record — the Vault secrets doc is superseded by the shipped Forgejo-native approach), #10 (vision docs, clean merge), #48 (clean merge, closes #36) · plat/gitops#14 (Enforce flip) · plat/agents#2 (stale).

Standing security item: seal a fresh E2E_CLAUDE_TOKEN — the staged copy is still the 2026-07-01 compromised value.

Anomaly noted today: two forgejo-runner job pods in Error on k3d-staging (platform services all healthy) — worth a look.

## Board cleanup + full status — 2026-07-06 **Shipped and live.** Prod runs the 0.7.6 train (pod images verified today: agents `0.7.6`, mcp `0.26.0`). Genesis seed = r29, produced and merged by the automated reseed pipeline (#14). Fresh germinations activate the whole whiteboard (Kyverno + baselines, letsencrypt, cosign-signing, forwardAuth, webhook HMAC, credential boundary, fork genealogy). **Automation is green unattended.** Nightly coldstart gate 4-for-4 since the train shipped (runs 33–36, 07-03→07-06, ~18 min each, incl. app-E2E). Reseed pipeline opened+merged r25/r29 with the no-op guard working (r27 correctly dropped). Nightly prod backups fresh through 2026-07-06 03:35. **Closed in this cleanup (all verified delivered):** #3 self-serve domains (DOM-1b mcp v0.24.0 + DOM-1a, proven on product-garden.com) · #39 POL-1 Kyverno landed (gitops#4, 12 ClusterPolicies live) · #40 POL-2 generate-migration (gitops#6 + mcp#8, drift-heal proven, depth-2 evidence) · #69 canary epic (7/7 probes, superseded by the nightly E2E gate). **Remaining — operator decisions (label `operator-decision`):** - #42 / #43 — flip Kyverno Audit→Enforce: merge plat/gitops#14, run the ENFORCE.md checklist. - #41 — cosign key custody (generate+seal keypair; verifyImages is a placeholder until then). - #35 HYB-2 — real-VPS granddaughter run (spends money). - #46 GATE — accept the assembled depth-2/vxrail evidence, or run the literal unattended VPS capstone (pairs with #35). - #36 — review/merge design PR #48 (OpenTofu substrate contract). **Remaining — implementation work:** - #6 Grafana: PR #8 is conflicted against the post-#61 `trim_gitops_lean` rewrite — needs re-threading, plus the unmerged gitops branch. - #7 agent-work: plat/agents#2 is stale against the 0.7.6 dispatcher — rebase or redo. - #17 live transcripts: heartbeat v1 shipped; full SSE/SPA version awaits owner decisions 1–3. - #60 → #13 Cilium: run the CNI swap on a disposable germination, then flip `PLAT_FQDN_EGRESS` and tighten the 443/80 default. - #4 / #5: designs ride open PR #9. **Open PR queue:** mitosis #8 (conflicted), #9 (design record — the Vault secrets doc is superseded by the shipped Forgejo-native approach), #10 (vision docs, clean merge), #48 (clean merge, closes #36) · plat/gitops#14 (Enforce flip) · plat/agents#2 (stale). **Standing security item:** seal a fresh `E2E_CLAUDE_TOKEN` — the staged copy is still the 2026-07-01 compromised value. **Anomaly noted today:** two forgejo-runner job pods in `Error` on k3d-staging (platform services all healthy) — worth a look.