Clear the delivery-surface debt #59

Merged

PerishFire merged 3 commits from delivery-debt into main

2026-07-31 10:20:17 +00:00

PerishFire commented

2026-07-31 10:03:29 +00:00

Owner

Three debts, cleared in dependency order.

plumb doctor was out of true because plumb moved to 0.18.7. Guard runs doctor
as its second step, so the next pull request would have failed before reaching
its own changes.

The init container decision removed the -api ServiceAccount, and with it the
RBAC seat that separated custody from runtime. artifact::signing refuses a
sudo artifact by name, but nothing asserted it. The new test seals an estate and
provides a valid signing artifact first, so no other refusal can stand in for
the one under test; removing the named refusal turns it red.

The repository published nothing. A client nobody can install is a poor primary
front end, and the skill had no carrier. plumb.toml declares the product,
authority, binary, targets, and skill; two thin callers hand the sequence to the
shared Actions workflow. The bootstrap law moves in from outside the repository
as skills/ensign, carrying the settled Kubernetes lifecycle rather than the
open questions it was written with. v0.2.0 is documented in en and zh before the
release rather than after it, when there would be nowhere to put it.

plumb doctor is now true to the skeleton, reporting
lanes guard release-exact release-stable and publishes binary, and
plumb changelog reports v0.2.0 documented in both languages.

Guard was run in full on the committed state and is clean, including all six
acts. The pre-commit hook could not run it: the hook ends in a bare
runseal :guard, which runseal 0.14.1 rejects, and runseal.toml itself no
longer parses under that version. That is a separate workshop-wide migration —
runseal 0.14.1 ships the guidance, and every repository except runseal is still
on the old shape.

The declared authority releases.ensign.perish.uk does not resolve yet, so the
lane is structurally complete but cannot publish until that chain is cold
started.

Three debts, cleared in dependency order. `plumb doctor` was out of true because plumb moved to 0.18.7. Guard runs doctor as its second step, so the next pull request would have failed before reaching its own changes. The init container decision removed the `-api` ServiceAccount, and with it the RBAC seat that separated custody from runtime. `artifact::signing` refuses a sudo artifact by name, but nothing asserted it. The new test seals an estate and provides a valid signing artifact first, so no other refusal can stand in for the one under test; removing the named refusal turns it red. The repository published nothing. A client nobody can install is a poor primary front end, and the skill had no carrier. `plumb.toml` declares the product, authority, binary, targets, and skill; two thin callers hand the sequence to the shared Actions workflow. The bootstrap law moves in from outside the repository as `skills/ensign`, carrying the settled Kubernetes lifecycle rather than the open questions it was written with. v0.2.0 is documented in en and zh before the release rather than after it, when there would be nowhere to put it. `plumb doctor` is now true to the skeleton, reporting `lanes guard release-exact release-stable` and `publishes binary`, and `plumb changelog` reports v0.2.0 documented in both languages. Guard was run in full on the committed state and is clean, including all six acts. The pre-commit hook could not run it: the hook ends in a bare `runseal :guard`, which runseal 0.14.1 rejects, and `runseal.toml` itself no longer parses under that version. That is a separate workshop-wide migration — runseal 0.14.1 ships the guidance, and every repository except runseal is still on the old shape. The declared authority `releases.ensign.perish.uk` does not resolve yet, so the lane is structurally complete but cannot publish until that chain is cold started.

PerishFire added 3 commits

2026-07-31 10:03:29 +00:00

deps: follow plumb to stable latest 9a698a9a75

Prove the binary is the seat that keeps sudo out of serve c5464c78b0

The init container decision removed the -api ServiceAccount, so RBAC no
longer separates custody from runtime. artifact::signing refuses a sudo
artifact by name, but nothing asserted it. The estate is sealed and the
signing artifact is valid before serve is asked, so no other refusal can
stand in for the one under test.

Ship ensign through the shared release lane

guard / guard (pull_request) Successful in 3m31s

Details

guard / guard (push) Successful in 3m20s

Details

c0c2020af6

The repository published nothing, so the client nobody could install was
the primary front end and the skill had no carrier. plumb.toml declares
the product, authority, binary, targets, and skill; two thin callers hand
the sequence to the shared Actions workflow.

The bootstrap law moves in from outside the repository as skills/ensign,
carrying the settled Kubernetes lifecycle rather than the open questions
it was written with. The v0.2.0 changelog is written before the release
rather than after it, when there would be nowhere to put it.

PerishFire referenced this pull request from PerishLab/codehull

2026-07-31 10:07:25 +00:00

deps: follow plumb to stable latest #60

PerishFire merged commit c0c2020af6 into main

2026-07-31 10:20:17 +00:00

PerishFire deleted branch delivery-debt

2026-07-31 10:20:18 +00:00