Description
The app needs its own chart and image so regulatory can be deployed without Touchline (doc-0003 packaging decision). Copy the Touchline chart’s structure (agents, loadgen, Alloy, experiments CronJob, serviceaccounts, values.schema.json) rather than extending it, and wire the new image into the images workflow, justfile images list and release-please extra-files so versions bump together.
Acceptance Criteria
- #1 charts/regulatory passes helm lint and kubeconform with its ci/test-values.yaml, and just lint covers it
- #2 images workflow builds and cosign-signs gc-agento11y-regulatory and just images-push includes it
- #3 release-please bumps the chart version, appVersion and the new image tag default in the same release PR
- #4 charts/regulatory has its own values.schema.json and passes helm lint and kubeconform with ci/test-values.yaml; just lint, render and the check-yaml pre-commit exclude cover it
- #5 images workflow builds and cosign-signs gc-agento11y-regulatory, just images-push, docs/security.md and the images variable description list it, and no Trivy exception is extended
- #6 release-please extra-files bump charts/regulatory Chart.yaml, values.yaml and README (with x-release-please-version markers) alongside the shared images.tag default
- #7 justfile setup, fmt, test and ci.yml dependency install include apps/regulatory; Dockerfile.dockerignore, docs.toml nav, deploy/flux and deploy/argocd are updated
Definition of Done
- #1 just check
Implementation Plan
Implement the corrected design and frozen regulatory contracts, with disjoint file ownership for parallel work. Prove local runtime/rendered/mock-plan behaviour, integrate into just check, complete CodeRabbit review before landing code, and record live-only acceptance separately. No live deployment, image publication, new credential or CVE exception is authorized by this local implementation pass.
2026-10-21 approval authorizes the separate regulatory-only CVE-2026-93687/path exception through2026-11-15 and image publication verification. Validate scope and expiry locally, land declarative wiring, verify exact-SHA multiarch signing/publication. No live deployment is implied.
Implementation Notes
Local packaging complete: separate schema/chart, Alloy validation, normal/paused/custom-namespace/digest/capture-off renders; kubeconform validates all rendered objects. Local final image builds and runs health under read-only UID10001/network-none; guard-policy dry-run succeeds and corpus is included. Release/version/image/just/CI/precommit/GitOps wiring added without broadening any scanner exception. Local image scan FAILS exactly CVE-2026-93687 in braces 3.0.3 with no fixed version; publication is blocked pending upstream remediation or separate maintainer disposition. Runtime SDK-root/experiments import probe loads none of the Google ADK/braces chain. Existing agents-only approval remains unchanged.
Local implementation and review complete. Resume publication after upstream-compatible remediation of CVE-2026-93687 in regulatory image, or explicit maintainer approval for a separate advisory/path/expiry exception. The agents-only approval was not extended. Then verify multiarch build/signing/published image before deployment.
Exact source CI39506282163 passed for3b05093ff1324d1380ac83c9aef8728e20327ee6. Images run39506289257 regulatory amd64/arm64 jobs failed at Trivy; merge/sign/SBOM and Helm publish were skipped. GitHub code-scanning alert20 identifies CVE-2026-93687 at app/regulatory/node_modules/braces/package.json. Existing dev-workstation image also has a separate pre-existing jq advisory, recorded independently rather than changing unrelated image code.
Approved exception validation: actual local image scan exits0 with zero HIGH/CRITICAL findings using the exact approved file. Expired-date and wrong-package-path variants each exit1 and expose exactly CVE-2026-93687/braces. YAML verifies one advisory, one installed regulatory path, expiry2026-11-15, and regulatory matrix entry only. Declarative config/docs change: CodeRabbit skipped per policy; actual scanner positive/negative checks used.
Source CI39521934409 passed full check, private scrub and ci-success for eb80dd77452b8da85cfd9bf7fb096f8dc251a0eb. Operator guide records the immutable edge digest and the shared-tag host replacement boundary.
Final Summary
Separately approved regulatory-only CVE-2026-93687 exception applied through2026-11-15. Positive scan and expired/wrong-path negative checks pass. Exact source eb80dd77452b8da85cfd9bf7fb096f8dc251a0eb image run39521935151 passed regulatory amd64/arm64 builds and merge/sign/SBOM. Registry readback confirms both architectures at sha256:355b651a54090b1d53be31241e18364b3b3ffebe812de965be6910a83d7a428e; cosign verify validates signatures, transparency log, certificate identity and repository restriction. Main edge image available; no versioned release or deployment claimed. Other image jobs failed independently; the overall workflow is not green. The former no-new-exception criterion is superseded only by the explicit2026-10-21 regulatory approval.