mathias/cad-atlas
1
0
Fork 0
generated from mathias/template-go-web
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(oath): mark S3 enforced now that branch protection requires var-go/oath (closes #8)
CD / Detect unsubstituted template (push) Successful in 1s
Details
CD / Lint / Test / Vet (push) Successful in 6s
Details
CD / var-go/oath (push) Has been skipped
Details
CD / Build & Import (push) Successful in 14s
Details
CD / Deploy via GitOps (push) Successful in 1s
Details

Browse Source
This commit is contained in:
mathias
2026-07-20 20:51:35 +00:00
parent 805b76d7c3
commit 2f5fca8513
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INCEPTION-OATH.md
+9 -9
View File
@@ -3,10 +3,10 @@
The acceptance contract for standing up cad-atlas. The sprint is finalized only when this
Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath.md`.
> **Status of enforcement:** this Oath is currently **advisory** (human-verified). `var-go/oath`
> gates a real candidate now (`oathcandidate/`, #8 — parses the committed CI workflow, TDD'd
> pass/fail-closed) but isn't yet required by branch protection pending a real-PR confirmation.
> See the honesty rule below.
> **Status of enforcement:** `var-go/oath` gates a real candidate (`oathcandidate/`, #8 — parses
> the committed CI workflow, TDD'd pass/fail-closed) and is now **required by branch protection**
> on `main` (verified green on a real PR). Direct pushes remain allowlisted for `mathias` per this
> repo's TBD convention.
## General clauses (any inception sprint)
@@ -26,7 +26,7 @@ Oath holds. Methodology: brain `wiki/homelab/decisions/inception-sprint-and-oath
|---|--------|--------|----------|
| S1 | Atlas served at `/`, renders all 9 stages signal→pod | ✅ | `internal/web/handler.go` + `static/cad-atlas.html` |
| S2 | Oath covered in the viz (stages 03 + 06) | ✅ | var-go Oath nodes in the atlas |
| S3 | `var-go/oath` enforces cad-atlas's own PRs | ⏸ **real candidate wired, not enforcing → #8** | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Not yet branch-protection-required — awaiting confirmation on a real PR. See honesty rule. |
| S3 | `var-go/oath` enforces cad-atlas's own PRs | ✅ | `oathcandidate/` gates the real `.gitea/workflows/cd.yml` (TDD green: passes real file, fails closed on a fixture missing the job) via swedsl's sandboxed `SubprocessGate` (swedsl#35/#38). Branch protection on `main` now requires `var-go/oath`, confirmed holding on a real PR (#8). |
## Deployment
@@ -38,10 +38,10 @@ namespace `cad-atlas`, 1 replica, `cad-atlas:80 → :8080` (manifests in `mathia
## The honesty rule
A clause blocked by an external dependency is **descoped and tracked, never marked satisfied** —
a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3's real
candidate is wired (#8) but branch-protection enforcement waits on a real-PR confirmation, tracked
there, not claimed here. The `DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and
#8 both landed without a secret-write.
a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3 is now fully
enforced: real candidate wired and branch-protection-required (#8), confirmed on a real PR. The
`DMABE_GITEA_API_TOKEN` Actions secret is pre-provisioned so #1 and #8 both landed without a
secret-write.
Also surfaced by #8: this file's own "Oath (advisory form)" below predates the discovery that
var-go's parser requires single-line, period-separated sentences with no `Given`/`Then`/`And`