mathiasandClaude Sonnet 5
f7a0281ca2
Adds an oath job to cd.yml: on pull_request, checks out swedsl (the vargo-gate source — its oath submodule isn't go-installable, module path isn't a real import path) and runs cmd/vargo-gate against this repo's linked issue, posting a var-go/oath commit status. Deliberately NOT required by branch protection: vargo-gate's candidate is still a hardcoded toy self-test registry (swedsl's own #9 fixture), not a real PR-diff checker, so it fails closed against any real oath until swedsl ships an Executor (swedsl#27). Requiring it now would permanently block every cad-atlas PR. Disclosed in the CI config comment, PROJECT.md, and docs/INCEPTION-OATH.md (honest-stub discipline). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
3.5 KiB
cad-atlas — Inception Sprint Oath
The acceptance contract for standing up cad-atlas. The sprint is finalized only when this
Oath holds. Methodology: brain wiki/homelab/decisions/inception-sprint-and-oath.md.
Status of enforcement: this Oath is currently advisory (human-verified).
var-go/oathis wired (issue #1) and runs on every PR, but its candidate is a toy self-test — it fails closed against any real oath and is not required by branch protection. See the honesty rule below.
General clauses (any inception sprint)
| # | Clause | Status | Evidence |
|---|---|---|---|
| G1 | Repo born from template on Gitea, dispatch-eligible | ✅ | create_project_from_template, .dispatch-allow, dispatch-allowlisted |
| G2 | Self-contained context + brain deep-links + external refs | ✅ | .context/PROJECT.md, README.md |
| G3 | Green CI on main: build · vet · lint · test (TDD) | ✅ | Genuinely green from run 19 (commit 68adfe7). NOTE: runs 16–18 were hollow — a template guard bug (template-go-web#9) skipped every job; fixed here. internal/web/handler_test.go |
| G4 | Genesis learning persisted to brain, linked from repo | ✅ | wiki/homelab/decisions/cad-atlas-audit-chain-is-viz-data.md |
| G5 | Discovered findings filed as tracker issues | ✅ | template-go-web#8, local-dev#20 |
| G6 | SemVer tag marks the milestone (closing act) | ✅ | v0.1.0 |
| G7 | Agent-ready spec issue for the next increment | ✅ | #1 |
Specific clauses (cad-atlas)
| # | Clause | Status | Evidence |
|---|---|---|---|
| S1 | Atlas served at /, renders all 9 stages signal→pod |
✅ | internal/web/handler.go + static/cad-atlas.html |
| S2 | Oath covered in the viz (stages 03 + 06) | ✅ | var-go Oath nodes in the atlas |
| S3 | var-go/oath enforces cad-atlas's own PRs |
⏸ wired, not enforcing → #1 | oath job runs + posts status (#1). Not branch-protection-required: candidate is still a toy self-test, fails closed on every real oath until swedsl's Executor (swedsl#27) exists. See honesty rule. |
Deployment
Live at https://atlas.d-ma.be (Authentik forward-auth — authed users only) on koala k3s:
namespace cad-atlas, 1 replica, cad-atlas:80 → :8080 (manifests in mathias/infra
k3s/apps/cad-atlas/, reconciled by Flux). CI deploy job auto-deploys on every main push —
INFRA_DEPLOY_KEY (write deploy-key cad-atlas-ci on infra) is wired (#2 done).
The honesty rule
A clause blocked by an external dependency is descoped and tracked, never marked satisfied —
a self-lying Oath is a rubber stamp, the exact failure the Oath exists to prevent. S3's real
enforcement depends on a var-go Executor (swedsl#27) + a published oath module; it is tracked as
a fast-follow on #1, not claimed here. The DMABE_GITEA_API_TOKEN Actions secret is
pre-provisioned so #1 can land without a secret-write.
The Oath (advisory form)
Given a new software thing is being stood up as an inception sprint
Then its repo is born from template on Gitea and is dispatch-eligible
And its context is self-contained with brain deep-links and external references
And CI on main is green across build, vet, lint and test
And the genesis learning is persisted to brain and linked from the repo
And every discovered finding is filed as a tracker issue
And an agent-ready spec issue exists for the next increment
And a SemVer tag marks the milestone as the closing act
And any clause blocked by an external dependency is descoped and tracked, never claimed