Description
Move all reusable consumer tooling, schemas, architecture and operating context into this private generic repository; leave customer identifiers and deployment values only in the deployment repository; establish the standard Backlog board so the former engagement workspace is no longer required for product maintenance.
Acceptance Criteria
- #1 The generic repository contains every reusable script and schema needed to validate, build and upgrade a pinned consumer
- #2 The deployment repository is authoritative for its customer overlay and records immutable generic, overlay and image identities
- #3 The generic identifier denylist remains clean and no customer identity is introduced
- #4 Backlog documents and tasks preserve the product decisions, migration evidence, open risks and repeatable operating model
- #5 The former engagement workspace is no longer an input to build, validation, upgrade or rollback procedures
Definition of Done
- #1 python3 -m pytest tests -q
- #2 tofu fmt -check -recursive terraform; tofu init -backend=false and tofu validate pass for terraform/ and terraform/examples/standalone/
- #3 customer-identifier and shipped-text gates from .github/workflows/ci.yml return clean
Implementation Plan
- Inventory the remaining engagement-owned consumer artifacts and classify each as reusable product tooling, deployment-specific configuration, migration-only evidence or obsolete history.
- Initialize the standard Backlog documents/tasks and register the canonical fan-out document through agent-docs without introducing customer identifiers.
- Move and genericize reusable consumer validation/build/upgrade tooling into this repository with tests; make the deployment repository own its overlay and provenance.
- Rewrite upgrade, deployment and rollback instructions so neither repository reads the former engagement workspace.
- Re-run full product, denylist, consumer, image-provenance and isolated OpenTofu gates; adversarially review permissions, schedules, credentials and destructive actions.
- Commit and push each owner repository independently, preserving unrelated work, then establish the exact live-deployment plan and stop before any live mutation unless separately approved.
Implementation Notes
Artifact classification complete: reusable schema, validation, build, exec, upgrade, architecture and rollback guidance belong here; the deployment manifest and customer values belong in the deployment repository; legacy-fork parity is migration-only evidence.
Initialized the fleet Backlog board, populated four durable product documents and six historical/open tasks, registered doc-0001 with agent-docs, rendered the canonical fan-out document, and added the repository to the OpenBao read-token permission set.
Implemented reusable manifest validation, deterministic digest regeneration, immutable source/Terraform upgrade, local-only provenance build, projected execution tooling, schema, architecture/runbook, and focused tests. Targeted tests pass: 21 passed.
CodeRabbit raised five Major issues. Fixed remote commit reachability, authority hierarchy, and unexpected-provisioner-write wording. Dismissed two findings against generated doc-0001 because its agent-docs source is outside this migration and consumer copies must not be edited.
Second CodeRabbit pass raised six in-scope Major issues and four generated-doc issues. Fixed identity-storage controls, symbolic cardinality guidance, executable identifier/core-drift checks, atomic two-file upgrade rollback, deterministic upgrade tests, and controlled end-to-end build/exec tests. Generated fan-out findings remain source-owned outside this task.
Final generic gate: 1,331 passed, 2 skipped, 6,570 subtests in 65.30s. Fresh module and standalone OpenTofu init/validate succeeded. Formatting, identifier denylist, and shipped-text gates are clean.
Superseding the earlier test total after review fixes: the final pre-commit candidate suite is 1,333 passed, 2 skipped, 6,570 subtests in 67.67s. The containing revision will be recorded after commit.
Deployment ownership proof: the deployment repository’s canonical manifest validates against product revision 8020bbfe0058ed1f5defd0c217f3069b88d1b0ec with unchanged deterministic overlay digest; its Terraform ref matches, downloaded module tree is byte-identical excluding local init artifacts, and its deployment-owned consumer check rejects former-workspace dependencies and replacement core.
Final Summary
Established the generic repository as the sole editable product source with tested immutable consumer tooling, provenance, reusable Terraform, durable Backlog context and customer-identifier gates. A deployment repository now owns its canonical overlay and rollback contract, consumes one full Git ref, and validates without the former engagement workspace. Final product suite: 1,333 passed, 2 skipped, 6,570 subtests; both fresh Terraform configurations and identifier/shipped-text gates passed.