Two follow-up items from project_create e2e verification (2026-05-18)
Item 1 — infra namespace committed to branch, not main
project_create commits the staging namespace manifest to a staging/<name> branch
in the infra repo, not directly to main. This means Flux does NOT deploy the staging
namespace until the branch is manually merged.
This may be intentional (review gate before staging is activated) or a bug.
Decision needed: which behaviour do we want?
Option A — commit directly to main (fully automated)
staging namespace comes up automatically within 60s of project_create. No manual step.
Consistent with TBD. Change: update callInfraCommit in internal/skills/project/handlers.go
to use branch: "main" and remove the base: "main" param.
Option B — keep staging/ branch (manual review gate)
Human merges the branch when ready to activate staging. Adds friction but gives
explicit control over when Flux deploys the namespace.
Recommendation: Option A for experiment/throwaway projects. The namespace is just
a k8s namespace — it's low risk and Flux will reconcile it. Manual merge is unnecessary friction.
Item 2 — GITEA_MCP_TOKEN not in SOPS secrets
GITEA_MCP_TOKEN was patched imperatively into routing-secrets on 2026-05-18.
It will be lost if:
The secret is recreated from secrets.enc.yaml (SOPS restore)
The cluster is rebuilt from scratch (bootstrap)
Someone runs kubectl apply -f secrets.enc.yaml without the patch
Fix: Add GITEA_MCP_TOKEN to k3s/apps/routing/secrets.enc.yaml via SOPS:
# Decrypt, add token, re-encrypt
sops k3s/apps/routing/secrets.enc.yaml
# Add: GITEA_MCP_TOKEN: <value># Save and exit — SOPS re-encrypts automatically
This ensures the token survives cluster rebuilds and is tracked in git (encrypted).
Acceptance criteria
Decision made on Option A vs B for infra commit (document in DECISIONS.md)
If Option A: callInfraCommit updated to commit directly to main
GITEA_MCP_TOKEN added to secrets.enc.yaml via SOPS
routing-secrets regenerated from SOPS to verify round-trip works
## Two follow-up items from project_create e2e verification (2026-05-18)
### Item 1 — infra namespace committed to branch, not main
`project_create` commits the staging namespace manifest to a `staging/<name>` branch
in the infra repo, not directly to main. This means Flux does NOT deploy the staging
namespace until the branch is manually merged.
This may be intentional (review gate before staging is activated) or a bug.
**Decision needed:** which behaviour do we want?
**Option A — commit directly to main (fully automated)**
staging namespace comes up automatically within 60s of `project_create`. No manual step.
Consistent with TBD. Change: update `callInfraCommit` in `internal/skills/project/handlers.go`
to use `branch: "main"` and remove the `base: "main"` param.
**Option B — keep staging/<name> branch (manual review gate)**
Human merges the branch when ready to activate staging. Adds friction but gives
explicit control over when Flux deploys the namespace.
Recommendation: **Option A** for experiment/throwaway projects. The namespace is just
a k8s namespace — it's low risk and Flux will reconcile it. Manual merge is unnecessary friction.
### Item 2 — GITEA_MCP_TOKEN not in SOPS secrets
`GITEA_MCP_TOKEN` was patched imperatively into `routing-secrets` on 2026-05-18.
It will be lost if:
- The secret is recreated from `secrets.enc.yaml` (SOPS restore)
- The cluster is rebuilt from scratch (bootstrap)
- Someone runs `kubectl apply -f secrets.enc.yaml` without the patch
**Fix:** Add `GITEA_MCP_TOKEN` to `k3s/apps/routing/secrets.enc.yaml` via SOPS:
```bash
# Decrypt, add token, re-encrypt
sops k3s/apps/routing/secrets.enc.yaml
# Add: GITEA_MCP_TOKEN: <value>
# Save and exit — SOPS re-encrypts automatically
```
This ensures the token survives cluster rebuilds and is tracked in git (encrypted).
## Acceptance criteria
- [ ] Decision made on Option A vs B for infra commit (document in DECISIONS.md)
- [ ] If Option A: `callInfraCommit` updated to commit directly to main
- [ ] `GITEA_MCP_TOKEN` added to `secrets.enc.yaml` via SOPS
- [ ] `routing-secrets` regenerated from SOPS to verify round-trip works
Decision recorded in DECISIONS.md (2026-05-18 entry). callInfraCommit now passes branch: "main" directly; the staging/<name> indirection and base param are gone. Flux reconciles within ~60s of project_create, no manual merge step.
Rationale (per ADR): staging namespaces are isolated, low blast-radius, and consistent with project-wide TBD. Manual review was friction with no compensating safety gain for experiment namespaces.
Project skill tests pass. Note: TestRoutingPodEndToEnd is failing pre-existing this commit (port-wait flake, unrelated to project_create); to be tracked separately.
Cluster rebuilds / SOPS restore now restore both tokens.
Closing.
Both items resolved.
### Item 1 — Option A chosen, shipped in 937355c
Decision recorded in `DECISIONS.md` (2026-05-18 entry). `callInfraCommit` now passes `branch: "main"` directly; the `staging/<name>` indirection and `base` param are gone. Flux reconciles within ~60s of `project_create`, no manual merge step.
Rationale (per ADR): staging namespaces are isolated, low blast-radius, and consistent with project-wide TBD. Manual review was friction with no compensating safety gain for experiment namespaces.
```
internal/skills/project/handlers.go | 12 +++++-------
DECISIONS.md | 21 +++++++++++++++++++++
```
Project skill tests pass. Note: `TestRoutingPodEndToEnd` is failing pre-existing this commit (port-wait flake, unrelated to project_create); to be tracked separately.
### Item 2 — `GITEA_MCP_TOKEN` already in SOPS
Confirmed on `infra@408a527`:
```bash
$ sops -d k3s/apps/routing/secrets.enc.yaml | grep -E "GITEA_MCP_TOKEN|GITHUB_PAT|LITELLM_API_KEY|ROUTING_MCP_TOKEN"
LITELLM_API_KEY: <redacted>
ROUTING_MCP_TOKEN: <redacted>
GITHUB_PAT: <redacted>
GITEA_MCP_TOKEN: <redacted>
```
Round-trip verified against live cluster — same 4-key set:
```bash
$ kubectl get secret routing-secrets -n routing -o jsonpath='{.data}' | jq 'keys'
["GITEA_MCP_TOKEN", "GITHUB_PAT", "LITELLM_API_KEY", "ROUTING_MCP_TOKEN"]
```
Cluster rebuilds / SOPS restore now restore both tokens.
Closing.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Two follow-up items from project_create e2e verification (2026-05-18)
Item 1 — infra namespace committed to branch, not main
project_createcommits the staging namespace manifest to astaging/<name>branchin the infra repo, not directly to main. This means Flux does NOT deploy the staging
namespace until the branch is manually merged.
This may be intentional (review gate before staging is activated) or a bug.
Decision needed: which behaviour do we want?
Option A — commit directly to main (fully automated)
staging namespace comes up automatically within 60s of
project_create. No manual step.Consistent with TBD. Change: update
callInfraCommitininternal/skills/project/handlers.goto use
branch: "main"and remove thebase: "main"param.Option B — keep staging/ branch (manual review gate)
Human merges the branch when ready to activate staging. Adds friction but gives
explicit control over when Flux deploys the namespace.
Recommendation: Option A for experiment/throwaway projects. The namespace is just
a k8s namespace — it's low risk and Flux will reconcile it. Manual merge is unnecessary friction.
Item 2 — GITEA_MCP_TOKEN not in SOPS secrets
GITEA_MCP_TOKENwas patched imperatively intorouting-secretson 2026-05-18.It will be lost if:
secrets.enc.yaml(SOPS restore)kubectl apply -f secrets.enc.yamlwithout the patchFix: Add
GITEA_MCP_TOKENtok3s/apps/routing/secrets.enc.yamlvia SOPS:This ensures the token survives cluster rebuilds and is tracked in git (encrypted).
Acceptance criteria
callInfraCommitupdated to commit directly to mainGITEA_MCP_TOKENadded tosecrets.enc.yamlvia SOPSrouting-secretsregenerated from SOPS to verify round-trip worksBoth items resolved.
Item 1 — Option A chosen, shipped in
937355cDecision recorded in
DECISIONS.md(2026-05-18 entry).callInfraCommitnow passesbranch: "main"directly; thestaging/<name>indirection andbaseparam are gone. Flux reconciles within ~60s ofproject_create, no manual merge step.Rationale (per ADR): staging namespaces are isolated, low blast-radius, and consistent with project-wide TBD. Manual review was friction with no compensating safety gain for experiment namespaces.
Project skill tests pass. Note:
TestRoutingPodEndToEndis failing pre-existing this commit (port-wait flake, unrelated to project_create); to be tracked separately.Item 2 —
GITEA_MCP_TOKENalready in SOPSConfirmed on
infra@408a527:Round-trip verified against live cluster — same 4-key set:
Cluster rebuilds / SOPS restore now restore both tokens.
Closing.