The CI stage now shows the pipeline's latest real execution, read live from the
in-cluster Gitea Actions API (public read, no token, gitea-http.gitea.svc):
"▶ run #N · <state>" coloured by outcome, prepended to the generated job list.
LatestRun + RunNode built test-first; cached in the same 30s liveOverlay; falls
back cleanly when Gitea is unreachable.
assessor-loop ledger / session_log deferred: no live CAD data exists for this repo
yet (brain confirms). Gitea run history is the real available trace.
Verified: build/vet/lint(0)/test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
NamespaceSummary (test-first) renders the substrate ns line from live cluster
namespaces (system-filtered, sorted, capped). Handler now overlays both node
specs and the ns line via a single cached liveOverlay(). Removed the inline
SUBSTRATE/STAGES/NS data — /api/atlas.json is the single source; the page shows
an error banner on fetch failure instead of stale data.
GPU model naming intentionally NOT done: koala's node has no GPU product label
(only nvidia.com/gpu count), so "1× GPU" is the API's truth — naming the RTX 5070
would need GPU-feature-discovery, out of scope.
Verified: build/vet/lint(0)/test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MergeSubstrate overlays live node specs onto the authored machine list by name:
cluster nodes (koala) get fresh live specs, non-cluster machines (iguana/flamingo/
piguard) stay authored, new live nodes are appended. Test-first. Restores the full
homelab machine list while keeping cluster nodes truthful.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The substrate machines are now rendered from the live k3s nodes (arch, cpu,
memory, GPU, k3s version), read in-cluster via the mounted ServiceAccount with a
stdlib HTTP client (no client-go) and a 30s cache; falls back to the authored
substrate whenever the cluster is unreachable. Placement per the homelab decision
"in-cluster only for in-workload ops" — a running web app rendering live data fits.
HostsFromNodes parser built test-first. RBAC (read-only node-reader SA) shipped in
infra k3s/apps/cad-atlas/.
Verified: go build/vet/lint(0)/test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The atlas no longer hand-maintains its content. Authored data lives in one place
(internal/atlas/atlas.json); the Go layer overlays sourced facts and serves the
result at /api/atlas.json; the frontend fetches + renders (inline arrays kept only
as an offline fallback). First generated source: the CI/CD stage's nodes are parsed
from the repo's own .gitea/workflows/cd.yml — so the viz shows the pipeline that
actually runs (guard/check/build/deploy), dropping the aspirational var-go/oath-gate
node that isn't wired yet. That's the point: it can't drift from the real pipeline.
New internal/atlas package (JobsFromWorkflow, Build) built test-first. Adds
gopkg.in/yaml.v3 (justified: parsing the workflow YAML; stdlib has no YAML).
Verified: go build/vet/lint(0)/test green; /api/atlas.json → 9 stages, CI = real
jobs; frontend renders from the fetch (screenshot).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploy job's INFRA_DEPLOY_KEY (write deploy-key cad-atlas-ci on infra) is set;
future main pushes auto-bump the infra image tag → Flux rolls. Also records the
live Authentik-gated endpoint. This commit is itself the first auto-deploy test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
runs 16-18 were fake-green (template guard skipped all jobs, template-go-web#9);
CI genuinely green from run 19. cad-atlas now live on koala k3s via Flux
(infra k3s/apps/cad-atlas). CI deploy-job auto-deploy tracked in #2.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add docs/INCEPTION-OATH.md — the sprint's acceptance contract (general +
cad-atlas-specific clauses, tagging as the closing act). S3 (var-go/oath
enforcing cad-atlas PRs) is descoped to a tracked fast-follow (#1): var-go v1's
candidate is a hardcoded self-test and its module is not cross-repo consumable,
so a green status would prove wiring, not verification. Honesty rule: a clause
blocked by an external dependency is descoped and tracked, never claimed.
Methodology persisted: brain wiki/homelab/decisions/inception-sprint-and-oath.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Wire the reel-style CAD workflow atlas (signal→pod) as the served page via
go:embed. Fill PROJECT.md/README with the 9-stage workflow, three governance
gates (Ed25519 admission / dispatch-allow / var-go Oath), phase map A→C,
dogfooding model, brain deep-links and external references.
Fixes two template-go-web latent bugs surfaced by dogfooding:
- templ version skew: go.mod pinned v0.2.778 vs templ@latest generator
- .gitignore pattern *.templ.go did not match generated *_templ.go
Verified: go build · vet · golangci-lint (0 issues) · go test green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mathiasandClaude Opus 4.8