Block a user
Gate atlas.d-ma.be — tapir-style Dex/OIDC auth (currently public)
Gitea integration — logged-in user sees their projects + issues in the atlas
Update: auth is now Authentik forward-auth (#3), so the authenticated user identity arrives as request headers — no in-app OIDC needed. The ingress passes X-authentik-username, `X-authentik-…
Gate atlas.d-ma.be — tapir-style Dex/OIDC auth (currently public)
Resolved — gated via Authentik forward-auth, not in-app OIDC
atlas.d-ma.be is now Authentik-only, gated at the edge (ingress-nginx forward-auth → embedded outpost) with zero app code…
Gitea integration — logged-in user sees their projects + issues in the atlas
Gate atlas.d-ma.be — tapir-style Dex/OIDC auth (currently public)
Wire INFRA_DEPLOY_KEY so the CI deploy job auto-deploys
CRITICAL: CD guard self-defeats — every child repo skips all CI (fake green)
Stage-03 spec: bootstrap var-go/oath enforcement in cad-atlas CI
Deferred — this is the fast-follow for real Oath enforcement (Inception sprint S3 descoped here)
Measured var-go v1 before wiring; real enforcement of cad-atlas's own Oath is **not achievable…
Bootstrap bugs: templ version skew + .gitignore _templ.go pattern mismatch
Stage-03 spec: bootstrap var-go/oath enforcement in cad-atlas CI