 Jon Chery
|
3551b37ac0
|
docs(P00): grill + plan revision — v0.14 binding conditions
Grill verdict: RETHINK (0.45) → revised plan addresses all 12
binding conditions (C-50..C-61):
- C-50: install podman if absent (linux/lead)
- C-51: DNATTarget validation (nft injection guard)
- C-53: apt-get idempotency (command -v podman check)
- C-54: offline-first tension documented (podman pull exception)
- C-55: native-mode nft single-apply (discover LXC IP first)
- C-56: MAC collision check against registry
- C-57: v0.13→v0.14 upgrade path (remove legacy systemd+binary)
- C-58: mount static config from host (preserve REQ-100 opt-out)
- C-59: migration 0009 (not 0007)
- C-60: certpaths.CACertPath() (not CAPath())
- C-61: --restart=unless-stopped, omit :Z
- C-62/G-003: mTLS deferred to v0.15 (confidence 0.55 < 0.60)
---ci---
project: orca
phase: 0
milestone: v0.14
status: grill
---/ci---
|
2026-08-10 18:26:33 +00:00 |
|
|
Jon Chery
|
0e7ee4f324
|
docs(P00): create phase plans — v0.14 ingress bootstrap
9 phases (P0+P1..P7+P8 final). Plan incorporates research findings:
nft postrouting masquerade scoped to 127.0.0.0/8, pve-firewall
priority shift to -10, LXC fuse=1 feature, traefik TLS model
change (drop certResolver, use dynamic tls.certificates), podman
--restart=unless-stopped + podman-restart.service, omit SELinux :Z.
---ci---
project: orca
phase: 0
milestone: v0.14
status: plan
---/ci---
|
2026-08-10 18:13:59 +00:00 |
|