From 2f5fca8513036ea9dbe1054e9889a6878e1488ae Mon Sep 17 00:00:00 2001 From: mathias Date: Mon, 20 Jul 2026 20:51:35 +0000 Subject: [PATCH] docs(oath): mark S3 enforced now that branch protection requires var-go/oath (closes #8) --- docs/INCEPTION-OATH.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/INCEPTION-OATH.md b/docs/INCEPTION-OATH.md index 45bc92c..a158f12 100644 --- a/docs/INCEPTION-OATH.md +++ b/docs/INCEPTION-OATH.md @@ -3,10 +3,10 @@ The acceptance contract for standing up cad-atlas. The sprint is finalized only when this Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath.md`. -> **Status of enforcement:** this Oath is currently **advisory** (human-verified). `var-go/oath` -> gates a real candidate now (`oathcandidate/`, #8 — parses the committed CI workflow, TDD'd -> pass/fail-closed) but isn't yet required by branch protection pending a real-PR confirmation. -> See the honesty rule below. +> **Status of enforcement:** `var-go/oath` gates a real candidate (`oathcandidate/`, #8 — parses +> the committed CI workflow, TDD'd pass/fail-closed) and is now **required by branch protection** +> on `main` (verified green on a real PR). Direct pushes remain allowlisted for `mathias` per this +> repo's TBD convention. ## General clauses (any inception sprint) @@ -26,7 +26,7 @@ Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath |---|--------|--------|----------| | S1 | Atlas served at `/`, renders all 9 stages signal→pod | ✅ | `internal/web/handler.go` + `static/cad-atlas.html` | | S2 | Oath covered in the viz (stages 03 + 06) | ✅ | var-go Oath nodes in the atlas | -| S3 | `var-go/oath` enforces cad-atlas's own PRs | ⏸ **real candidate wired, not enforcing → #8** | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Not yet branch-protection-required — awaiting confirmation on a real PR. See honesty rule. | +| S3 | `var-go/oath` enforces cad-atlas's own PRs | ✅ | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Branch protection on `main` now requires `var-go/oath`, confirmed holding on a real PR (#8). | ## Deployment @@ -38,10 +38,10 @@ namespace `cad-atlas`, 1 replica, `cad-atlas:80 → :8080` (manifests in `mathia ## The honesty rule A clause blocked by an external dependency is **descoped and tracked, never marked satisfied** — -a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3's real -candidate is wired (#8) but branch-protection enforcement waits on a real-PR confirmation, tracked -there, not claimed here. The `DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and -#8 both landed without a secret-write. +a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3 is now fully +enforced: real candidate wired and branch-protection-required (#8), confirmed on a real PR. The +`DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and #8 both landed without a +secret-write. Also surfaced by #8: this file's own "Oath (advisory form)" below predates the discovery that var-go's parser requires single-line, period-separated sentences with no `Given`/`Then`/`And`