wb-gate: activate whole whiteboard on fresh germination (lib.sh trim fix + set-u fix + CIBTAG 0.2.0) + seed refresh (mcp 0.26.0/agents 0.7.5 + _app-template#6) #61

Merged

plat merged 4 commits from feat/wb-gate-seed-refresh into main

2026-07-01 23:32:45 +00:00

plat commented

2026-07-01 21:32:11 +00:00

Owner

What

Makes a fresh germination activate the WHOLE whiteboard and ship apps first-try — validated live on a from-scratch k3d germination (wb-gate2).

Code fixes

bin/lib.sh trim_gitops_lean — stop regenerating platform/kustomization.yaml + flux-kustomizations.yaml from a hardcoded lean template that silently dropped every component main grew since it was written (kyverno, kyverno-policies, letsencrypt, cosign-signing). Now the kept set is derived from the tree: platform kustomization keeps every declared resource minus the observability trims (monitoring/grafana/pgadmin) + keda; flux-kustomizations is trusted as-is, with _ensure_flux_kust only self-healing an older tree (kyverno→cert-manager, kyverno-policies→kyverno). Cannot drift again.
bin/lib.sh unbound-var fix — local g="$1" P="$g/…" on one line threw g: unbound variable under set -u (bash expands all RHS words before binding). Split so g is declared first. (This bug meant the dynamic-trim commit had never actually run — germinate died at the trim step; caught + fixed by this live validation.)
bin/germinate CIBTAG 0.1.0 → 0.2.0 + derive the full ci-builder tag set from what the seed's workflows pin, so both 0.2.0 (POL-3 cosign toolchain for _app-template) and 0.1.0 (mcp/agents) get built. No version skew.

Seed refresh (`genesis/seed.tar.gz`)

Rebuilt from GITOPS_REF=feat/wb-gate-release-pins (mcp 0.26.0 / agents 0.7.5; kyverno/kyverno-policies/letsencrypt/cosign-signing in the tree), with the seed's _app-template main fast-forwarded to PR #6 so create_app generates apps whose CI skips cosign gracefully when no key is provisioned.

Live proof (wb-gate2, fresh cluster, no manual wiring)

Kyverno deployed BY germination: kyverno pods Running, all 12 ClusterPolicies Ready (POL-1..5); kyverno + kyverno-policies Flux Kustomizations Applied. Whole whiteboard reconciled (letsencrypt/cosign-signing secrets present, 10/10 Flux Kustomizations True).
App ships FIRST-TRY: create_app → CI green (ci-builder:0.2.0, cosign skipped) → release_app → wbgate-smoke Running in plat--wbgate-smoke--prod, HTTP 200. No manual intervention, no known_hosts fix.
Policy governs the app ns: Kyverno-generated tenant-quota + plat-kyverno-dos-bound ResourceQuotas and default-deny/allow-egress/allow-ingress-traefik/allow-ingress-from-workflows NetworkPolicies (labeled managed-by: kyverno, POL-1/2).

Merge order

plat/_app-template#6 (cosign conditional) — so origin _app-template main matches the seed
plat/gitops#10 (mcp 0.26.0 + agents 0.7.5 pins) — so origin gitops main matches the seed
this PR (code fix + refreshed seed that already embeds both)

Follow-up (not a blocker): after this merges, one GITOPS_REF=main bin/seed reseed embeds the fixed lib.sh into the seed's own mitosis bundle so granddaughters also activate the whiteboard (the seed's mitosis bundle is built from origin main).

## What Makes a **fresh germination activate the WHOLE whiteboard** and ship apps first-try — validated live on a from-scratch k3d germination (wb-gate2). ### Code fixes - **`bin/lib.sh` `trim_gitops_lean`** — stop regenerating `platform/kustomization.yaml` + `flux-kustomizations.yaml` from a hardcoded lean template that silently dropped every component `main` grew since it was written (kyverno, kyverno-policies, letsencrypt, cosign-signing). Now the kept set is **derived from the tree**: platform kustomization keeps every declared resource minus the observability trims (monitoring/grafana/pgadmin) + keda; flux-kustomizations is trusted as-is, with `_ensure_flux_kust` only self-healing an older tree (kyverno→cert-manager, kyverno-policies→kyverno). Cannot drift again. - **`bin/lib.sh` unbound-var fix** — `local g="$1" P="$g/…"` on one line threw `g: unbound variable` under `set -u` (bash expands all RHS words before binding). Split so `g` is declared first. *(This bug meant the dynamic-trim commit had never actually run — germinate died at the trim step; caught + fixed by this live validation.)* - **`bin/germinate` CIBTAG 0.1.0 → 0.2.0** + derive the full ci-builder tag set from what the seed's workflows pin, so both `0.2.0` (POL-3 cosign toolchain for `_app-template`) and `0.1.0` (mcp/agents) get built. No version skew. ### Seed refresh (`genesis/seed.tar.gz`) Rebuilt from `GITOPS_REF=feat/wb-gate-release-pins` (mcp 0.26.0 / agents 0.7.5; kyverno/kyverno-policies/letsencrypt/cosign-signing in the tree), with the seed's `_app-template` **main fast-forwarded to PR #6** so `create_app` generates apps whose CI skips cosign gracefully when no key is provisioned. ## Live proof (wb-gate2, fresh cluster, no manual wiring) - **Kyverno deployed BY germination**: kyverno pods Running, all **12 ClusterPolicies Ready** (POL-1..5); `kyverno` + `kyverno-policies` Flux Kustomizations Applied. Whole whiteboard reconciled (letsencrypt/cosign-signing secrets present, 10/10 Flux Kustomizations True). - **App ships FIRST-TRY**: `create_app` → CI green (ci-builder:0.2.0, cosign skipped) → `release_app` → `wbgate-smoke` Running in `plat--wbgate-smoke--prod`, **HTTP 200**. No manual intervention, no known_hosts fix. - **Policy governs the app ns**: Kyverno-generated `tenant-quota` + `plat-kyverno-dos-bound` ResourceQuotas and `default-deny`/`allow-egress`/`allow-ingress-traefik`/`allow-ingress-from-workflows` NetworkPolicies (labeled `managed-by: kyverno`, POL-1/2). ## Merge order 1. `plat/_app-template#6` (cosign conditional) — so origin `_app-template` main matches the seed 2. `plat/gitops#10` (mcp 0.26.0 + agents 0.7.5 pins) — so origin gitops main matches the seed 3. **this PR** (code fix + refreshed seed that already embeds both) Follow-up (not a blocker): after this merges, one `GITOPS_REF=main bin/seed` reseed embeds the fixed `lib.sh` into the seed's own `mitosis` bundle so *granddaughters* also activate the whiteboard (the seed's mitosis bundle is built from origin main).

plat added 1 commit

2026-07-01 21:32:11 +00:00

seed: refresh genesis/seed.tar.gz for wb-gate capstone release c37234874a

Carries gitops pins mcp 0.26.0 + agents 0.7.5 (branch feat/wb-gate-release-pins)
and the mcp v0.26.0 / agents v0.7.5 bundles with all merged Wave-1/2 code
(DOM-1b, RBAC-2 forwardAuth, POL-2, RBAC-4 agent-ctx, DOM-2 FQDN egress;
RBAC-5 webhook HMAC, RBAC-4 Forgejo Sudo).

plat added 1 commit

2026-07-01 22:37:31 +00:00

wb-gate: germinate activates the WHOLE whiteboard on a fresh platform ef0633d5ff

Three drift fixes so a fresh germination deploys every merged gitops
component AND ships an app first-try:

1. bin/lib.sh trim_gitops_lean — stop regenerating platform/kustomization.yaml
   + flux-kustomizations.yaml from a hardcoded template that went stale the
   moment main grew a component (it silently dropped kyverno, kyverno-policies,
   letsencrypt, cosign-signing from every germinated daughter). Now DERIVE the
   kept set from the tree: platform/kustomization.yaml keeps every declared
   resource minus the observability trims (monitoring/grafana/pgadmin) + keda;
   flux-kustomizations.yaml is trusted as-is, with _ensure_flux_kust self-healing
   an older tree by appending keda / kyverno(→cert-manager) /
   kyverno-policies(→kyverno) only when the dir exists and nothing declares it.
   Cannot drift again — whatever main ships rides along automatically.

2. bin/germinate — CIBTAG 0.1.0 -> 0.2.0 (the POL-3 cosign-capable toolchain
   the _app-template workflows require) AND derive the FULL ci-builder tag set
   from what the seed's repos pin (mcp/agents on 0.1.0, _app-template on 0.2.0)
   so every workflow's container: image exists. No more version skew.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat referenced this pull request from open-platform/app-template

2026-07-01 22:38:07 +00:00

POL-3: cosign signing conditional — a fresh platform ships apps first-try #6

plat added 1 commit

2026-07-01 23:03:24 +00:00

wb-gate: fix g:unbound in trim_gitops_lean (split local decl for set -u) 391434e7e1

ef0633d refactored trim_gitops_lean to derive the kept component set
dynamically, but declared 'local g="$1" P="$g/…"' on one line. bash
expands every RHS word of a single local statement before binding any of
them, so $g is unbound under set -u and germinate died at the trim step
(never activating kyverno). Declare g on its own line first. Validated by
a fresh germination (wb-gate2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat added 1 commit

2026-07-01 23:29:04 +00:00

wb-gate: refresh genesis seed — _app-template main carries POL-3 #6 (ships first-try) 924c541b69

Rebuilt from GITOPS_REF=feat/wb-gate-release-pins (mcp 0.26.0 / agents 0.7.5,
kyverno + kyverno-policies + letsencrypt + cosign-signing in the tree) with the
seed's _app-template main fast-forwarded to PR #6 (feat/pol-3-cosign-conditional):
create_app generates apps whose release/preview workflows skip cosign gracefully
when no key is provisioned, so a fresh platform ships apps first-try.

Validated live: germinated wb-gate2 from this seed on a fresh k3d cluster —
Kyverno + 12 ClusterPolicies deployed by germination, whole whiteboard
(kyverno/kyverno-policies/letsencrypt/cosign-signing) reconciled, and an
mcp create_app+release_app'd app came up Running in plat--wbgate-smoke--prod
(HTTP 200) with Kyverno-generated ResourceQuota + NetworkPolicies (POL-1/2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat changed title from ~~seed: refresh genesis/seed.tar.gz — carry mcp 0.26.0 + agents 0.7.5 (Wave-1/2)~~ to wb-gate: activate whole whiteboard on fresh germination (lib.sh trim fix + set-u fix + CIBTAG 0.2.0) + seed refresh (mcp 0.26.0/agents 0.7.5 + _app-template#6)

2026-07-01 23:30:30 +00:00

plat merged commit 178a909394 into main

2026-07-01 23:32:45 +00:00

plat referenced this pull request from a commit

2026-07-01 23:32:45 +00:00

Merge pull request 'wb-gate: activate whole whiteboard on fresh germination (lib.sh trim fix + set-u fix + CIBTAG 0.2.0) + seed refresh (mcp 0.26.0/agents 0.7.5 + _app-template#6)' (#61) from feat/wb-gate-seed-refresh into main

plat referenced this pull request

2026-07-01 23:33:22 +00:00

Reseed genesis to embed the fixed germinate lib.sh for depth-2 granddaughters #62

plat referenced this pull request

2026-07-02 02:12:44 +00:00

genesis: reseed post-#61 — seed mitosis bundle carries the fixed trim_gitops_lean (#62) #65