docs(argocd): amend WS-02 public-flip seam contract to dual-parentRef - #290
Open
TechGardenCode wants to merge 1 commit into
Open
docs(argocd): amend WS-02 public-flip seam contract to dual-parentRef#290TechGardenCode wants to merge 1 commit into
TechGardenCode wants to merge 1 commit into
Conversation
The pinned contract said the public flip would be "a NEW route, never a retarget". Cycle 3 landed it as a second parentRef on the three existing routes instead — nothing removed, internal validation path intact, so the intent holds and the letter does not. Records why, and the consequence that follows. A route-level policy now spans two gateways with different threat models, so a per-edge difference is only expressible via mergeType on the route-level policy. Comment-only; renders no manifest change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Comment-only amendment to the
techgarden-prodApplicationSet block. Renders no manifest change (helm values comments never reach output), so it is inert to the1276-coreautosync.The pinned contract said the public flip would be "a separate, additive act — a second HTTPRoute — never a retarget of this one." Cycle 3 landed it as a second
parentRefon the three existing routes. Nothing is removed and the internal validation path still works, so the intent holds; the letter does not. This records the renegotiation rather than leaving the file asserting something that is no longer true.It also records the consequence, which is the part worth keeping: a route-level policy now spans two gateways with different threat models. Under the original contract you could attach a public-specific policy to the public route alone. Dual-parent forecloses that — per-edge differences exist only via
mergeTypeon the route-level policy. Drop it and the protected routes silently loseeg-public's Deny-by-default allowlist while the unprotected catch-all keeps it.Split from #289 deliberately: that PR is scoped to
1276-prod/techgarden-web, this touches1276-core. No ordering dependency between them.🤖 Generated with Claude Code
https://claude.ai/code/session_01Kvu3k5T8hA1dBGzzb23Lmj