oathcandidate/ is a separate Go module (mirrors swedsl's own
oath/testdata/selfcandidate pattern, keeping var-go's transitive deps
out of the deployed atlas binary) whose Build() parses the committed
.gitea/workflows/cd.yml and checks the "oath" job exists and invokes
cmd/vargo-gate. TDD: passes against the real file, fails closed on a
fixture missing the job.
Rewires the oath CI job to go-run vargo-gate from its real module path
(git.d-ma.be/mathias/swedsl/oath/cmd/vargo-gate@oath/v0.28.0, unblocked
by swedsl#35/#38) against VARGO_CANDIDATE_DIR=oathcandidate, instead of
checking out swedsl and gating its hardcoded toy fixture. Private-module
auth via a short-lived GIT_ASKPASS script (token never in argv, never
written to git config, matches act_runner's env:-block-with-secrets
gotcha).
Discovered along the way: var-go's parser needs single-line,
period-separated oath sentences with no Given/When/Then/And keyword
stripping — this repo's older oaths (incl. #1) used an unverified
multi-line keyword-prefixed style. #8's oath uses the proven format.
Still not required by branch protection pending a real-PR confirmation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
swedsl#27 (var-go strategic-fit ADR) closed 2026-07-18 and killed the
Executor/Reviewer path entirely — var-go is gate-only by design, each
consuming repo supplies its own candidate. The real blocker for
enforcement here is swedsl/oath's non-importable module path
(swedsl#35), not a nonexistent Executor. Corrects PROJECT.md,
INCEPTION-OATH.md, and the cd.yml comment to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds an oath job to cd.yml: on pull_request, checks out swedsl (the
vargo-gate source — its oath submodule isn't go-installable, module
path isn't a real import path) and runs cmd/vargo-gate against this
repo's linked issue, posting a var-go/oath commit status.
Deliberately NOT required by branch protection: vargo-gate's candidate
is still a hardcoded toy self-test registry (swedsl's own #9 fixture),
not a real PR-diff checker, so it fails closed against any real oath
until swedsl ships an Executor (swedsl#27). Requiring it now would
permanently block every cad-atlas PR. Disclosed in the CI config
comment, PROJECT.md, and docs/INCEPTION-OATH.md (honest-stub
discipline).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lap-2 review's top two findings:
#1 Node titles were still jargon (the lap-1 disease one level down). Every node
now has a plain_t ("var-go Oath" → "Definition of done", "Admission controller"
→ "Tamper-proof seal", …); Plain view leads with it and demotes the technical
name to a dim in-card subtitle — mirrors the stage-head pattern. plain_t on every
authored node is now guard-tested.
#2 Transition labels lived only in the SVG spine (display:none <820px) with a
hover-only rationale — invisible on phones. Added stacked-layout transition rows
(HTML, always-visible, full sentence, no hover) shown on mobile; desktop header
band scoped to ≥821px so mobile isn't stretched.
build/vet/lint(0)/test green; desktop Plain screenshot-verified.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Makes the atlas self-explanatory. Every stage/node gains a plain-language layer
(plain_title + plain "what happens" + jargon-free node text); the previous
technical copy demotes to a subtitle + on-demand detail. A Plain⇄Technical
toggle (default Plain, persisted) flips the whole atlas. Biggest win: every
transition arrow is now LABELLED with "what must be true to advance" (the gated-
flow story that was invisible), gate hops (human @04, CI @06) styled distinctly.
Spine repositioned into a uniform header band so labels never collide with copy.
Copy grounded in a fresh-eyes UX review (docs/UX-REVIEW.md, reviewer≠implementer).
Data model: plain_title/plain/trans_label/trans on Stage, plain on Node — guarded
by a test (every stage has plain_title + a transition). Live overlays unchanged.
Verified: build/vet/lint(0)/test green; Plain render screenshot-checked.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Deploy job's INFRA_DEPLOY_KEY (write deploy-key cad-atlas-ci on infra) is set;
future main pushes auto-bump the infra image tag → Flux rolls. Also records the
live Authentik-gated endpoint. This commit is itself the first auto-deploy test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
runs 16-18 were fake-green (template guard skipped all jobs, template-go-web#9);
CI genuinely green from run 19. cad-atlas now live on koala k3s via Flux
(infra k3s/apps/cad-atlas). CI deploy-job auto-deploy tracked in #2.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add docs/INCEPTION-OATH.md — the sprint's acceptance contract (general +
cad-atlas-specific clauses, tagging as the closing act). S3 (var-go/oath
enforcing cad-atlas PRs) is descoped to a tracked fast-follow (#1): var-go v1's
candidate is a hardcoded self-test and its module is not cross-repo consumable,
so a green status would prove wiring, not verification. Honesty rule: a clause
blocked by an external dependency is descoped and tracked, never claimed.
Methodology persisted: brain wiki/homelab/decisions/inception-sprint-and-oath.md
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mathias
mathiasandClaude Sonnet 5