mathiasandClaude Opus 5
4ab65a3b1b
On 2026-08-25 a deploy job ran with an empty IMAGE_TAG, wrote
`image: localhost:5000/gitea-mcp:` into the infra repo and pushed it.
That is invalid YAML, so Flux failed the ENTIRE apps Kustomization --
every app stopped reconciling for about an hour, including three
unrelated deploys queued behind it.
This job's existing check could not catch it. It greps for
`image: <repo>:${IMAGE_TAG}` after the sed, and with IMAGE_TAG empty that
pattern matches the corrupted line itself, so the verification passes
because of the bug rather than despite it.
Asserting the input up front is the fix: an empty tag now fails the job
before anything is written, let alone committed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011PL5XcG68SvQqz3vGVbWbf
cad-atlas
A visual atlas of the Continuous Agentic Development (CAD) workflow — from a captured signal to a deployed k3s pod.
One screen, reel-style: Signals → TELOS → Strategic session → Spec/Oath → Human gate → agentsquad → CI → CD → pod, looping back to TELOS. It renders the CAD audit chain, which doubles as the regulated-industry audit artifact.
The CAD audit chain is the visualization data. Phase C renders it once and serves two masters: observability + compliance.
Phases
- A — static hero viz (current): self-contained
internal/web/static/cad-atlas.html, served at/. SVG spine, animated pulse, dashed feedback bus, replay/slow-mo. - B — generated-from-source: render from brain docs + workflows + infra manifests (no drift).
- C — live trace viewer: hydrate from the
assessor-loopledger +session_log+ Gitea run API + Flux events.
Quickstart
task check # lint + vet + test (CI gate)
task run # → http://localhost:8080
Context
Full project context, the 9-stage workflow, the three governance gates, the dogfooding model, and all brain deep-links + external references live in .context/PROJECT.md. Any clean agent session should read that first (brain_get <path> for the linked notes).
Governance (dogfooded)
This repo is built through the workflow it depicts: dispatch-allow-enabled, build increments governed by a var-go Oath in their spec issues. Bootstrapping honesty: the Oath is defined but cmd/vargo-gate is not yet wired into this repo's CI — advisory until it is. See PROJECT.md.