coffey-labs/cairnobs
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Say that Phase 4 shipped, and that the environment proving it is gone

Browse Source 
The status file and the README both still said Phase 4 was not shipped
because the environment had lost Docker and database access partway
through, and that only the audit-logging guarantees had been confirmed
against a live database. That stopped being true some time ago.
phase-4-runbook.md records the opposite in detail: Docker access came
back, a real docker-compose stack ran with real ClickHouse and Postgres
and two provisioned tenants, a local kind cluster ran the Helm chart end
to end, and both SSO protocols were verified against a real Auth0 tenant
with full browser round trips. Eight real bugs came out of that, six from
compose and two from the chart's first real install -- none of them
findable without the infrastructure.

PROJECT-SPEC.md sends readers to status.md and tells them to read it
before assuming a capability works end to end, so the one file that is
meant to be authoritative was the one understating the project by the
widest margin.

Correcting it matters more now than it would have last week, because the
evidence cannot be regenerated: proto.cairnobs.org and the VPS under it
were retired on 2026-09-04, taking the mTLS CA, the server certificate
and six enrolled agents with them. The runbooks are what is left.

Three gaps are now stated rather than implied:

The prototype is gone, so none of this can be re-run today without
building one. The DNS was kept for that; the certificates deliberately
were not.

demo.cairnobs.org is live and is not evidence for Phase 4. It runs
COMPOSE_PROFILES=single-tenant, so it exercises the OSS path and says
nothing about RBAC, tenant isolation or per-tenant ClickHouse. A healthy
demo proving multi-tenancy is exactly the wrong inference to leave
available.

SSO has been tried against one IdP and one local kind cluster, not two
IdPs and not a production-grade cluster.

The Terraform entry now names its cause instead of pointing at another
file: alerting exposes no PUT for rules or targets, and neither
rulestore.Store nor notifystore.Store has an Update method to wire one
to, so Terraform destroys and recreates -- which resets alert_state and
delivery-log continuity.
This commit is contained in:
jcoffey-dev
2026-09-04 15:11:51 -07:00
parent 1565d4791c
commit 5742901fc5
2 changed files with 59 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -6
View File
@@ -122,18 +122,25 @@ Full per-phase detail is in [`docs/status.md`](docs/status.md).
| 1 | Windows Event Log + journald, SQL and full-text paths | Shipped |
| 2 | Unified query language across both stores | Shipped |
| 3 | Dashboards, alert rules, notification delivery | Shipped |
| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | **In progress** |
| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | Shipped |
| 5 | Frontend redesign and design system | Shipped |
| 6 | License compliance audit and remediation | Shipped |
| 7 | AI-assisted query authoring | Shipped |
**Phase 4 is not shipped.** The code is built and tested, but the environment
lost Docker and database access partway through, so only the audit-logging
guarantees were confirmed against a live database. The rest compiles and skips
cleanly when no live database is configured, but is otherwise unverified — see
the verification-status section of
**Phase 4 is shipped, and the environment that proved it is gone.** Every
control the phase defines was verified against real infrastructure at least
once — a docker-compose stack with real ClickHouse and Postgres, a local `kind`
cluster, and both SSO protocols against a real Auth0 tenant — finding eight
bugs that no amount of Docker-free testing could have caught. The prototype
VPS was retired on 2026-09-04, so that verification is a record rather than
something you can re-run: see
[`docs/phase-4-runbook.md`](docs/phase-4-runbook.md).
Two limits worth stating plainly. SSO has been tried against one IdP, not two,
and no production-grade cluster has run this. And `demo.cairnobs.org` is **not**
evidence for any of it — the demo runs the single-tenant profile, so it
exercises the OSS path and says nothing about RBAC or tenant isolation.
The Windows agent code (`EvtSubscribe`, ETW, service registration) has never
run on real Windows — no Windows toolchain existed in the build environment.
ETW additionally sits behind a feature flag, since it needs elevated
docs/status.md
+46 -14
View File
@@ -16,20 +16,41 @@ verification procedure and its results.
| 1 | Windows Event Log + journald, SQL and full-text paths | Shipped |
| 2 | Unified query language across both stores | Shipped |
| 3 | Dashboards, alert rules, notification delivery | Shipped |
| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | **In progress** |
| 4 | RBAC, tenant isolation, audit logging, per-tenant ClickHouse | Shipped |
| 5 | Frontend redesign and design system | Shipped |
| 6 | License compliance audit and remediation | Shipped |
| 7 | AI-assisted query authoring | Shipped |
**Known verification gaps**, carried forward rather than buried:
- **Phase 4 is not shipped.** Built and unit-tested, but the environment
lost Docker/database access partway through; only the audit-logging
guarantees were confirmed against a live database.
- **The prototype environment no longer exists.** `proto.cairnobs.org` and
the VPS under it were retired on 2026-09-04; the mTLS CA, the server
certificate and six enrolled field agents went with the host. Nothing
below is *un*-verified because of that — the verification happened while
the environment stood, and the per-phase runbooks are the record of it —
but none of it can be re-run today without building a prototype again.
The DNS was preserved for exactly that, in
[`/deploy/retired-prototype-dns.json`](../deploy/retired-prototype-dns.json);
the certificates deliberately were not, and a new prototype issues its own.
- **The live demo does not cover Phase 4.** `demo.cairnobs.org` runs, and is
rebuilt nightly from [`/hack/demo-seed`](../hack/demo-seed), but it runs
`COMPOSE_PROFILES=single-tenant` — so it exercises the OSS path and says
nothing about RBAC, tenant isolation or per-tenant ClickHouse. Do not read
a healthy demo as evidence for Phase 4.
- **Phase 4's SSO has been tried against one IdP, not two.** OIDC and SAML
were both verified end to end against a real Auth0 developer tenant,
browser round trips included. A second, independent IdP has never been
tried, and no production-grade cluster has run this — the Kubernetes
verification was against a local `kind` cluster.
- **The Windows agent path has never run on real Windows** — no Windows
toolchain existed in the build environment. See `/agent/README.md`.
- **Terraform coverage is partial** — see `/terraform/README.md` for the
full accounting.
- **Terraform coverage is partial**, and the cause is an API gap rather than
a Terraform one: `alerting` exposes no `PUT /rules/{id}` or
`PUT /targets/{id}`, and neither `rulestore.Store` nor `notifystore.Store`
has an `Update` method to wire one to. So alert rules and notification
targets are create/destroy only, and changing any attribute destroys and
recreates — which also resets `alert_state` and delivery-log continuity.
See `/terraform/README.md` for the full accounting.
## What "done" looks like for Phase 0 (MVP)
@@ -128,19 +149,30 @@ Non-goals for this phase (same discipline as every phase so far):
## What "done" looks like for Phase 4
**Status: in progress, not shipped.** RBAC enforcement (`api/authz`), the
**Status: shipped.** Every control this phase defines has been verified
against real infrastructure at least once, and the residual gaps are named
in the list at the top of this file rather than here. What follows is the
build record; `/docs/phase-4-runbook.md`'s "Verification status" section is
the authoritative account of what was run and what it found — including the
eight real bugs that only live infrastructure could have surfaced, six from
the docker-compose stack and two from the Helm chart's first real install.
Read that runbook rather than re-running it: the environment it describes
was retired on 2026-09-04.
RBAC enforcement (`api/authz`), the
`alerting`↔`api` service-identity credential, tenant-scoped dashboards,
append-only audit logging, and — since the second pass on this phase —
real per-tenant ClickHouse provisioning and query routing
(`enterprise/internal/tenantprovision`, `enterprise/internal/chrunner`,
wired into a new `enterprise/cmd/enterprise-api` binary alongside plain
`api/cmd/api`) are all built and tested — real integration tests exist
for the ClickHouse pieces, but this environment lost Docker/database
access partway through the phase, so only the audit-logging guarantees
were actually confirmed against a live database; the rest is untested
beyond "compiles, and skips cleanly when no live database is
configured" (see `/docs/phase-4-runbook.md`'s verification-status
section). Human SSO login is now built for both protocols
`api/cmd/api`) are all built and tested. Docker access was lost partway
through this phase and later came back, and the ClickHouse pieces were
then run for real: a docker-compose stack with real ClickHouse and
Postgres, real `enterprise-auth`/`enterprise-api`/`enterprise-ingest`
containers and two provisioned tenants (`acme`, `globex`), which closed
every "written but never run" gap on that side and found six real bugs
doing it (see `/docs/phase-4-runbook.md`'s verification-status section). Human SSO login is now built for both protocols
(`enterprise/internal/loginhandler`: `GET /auth/oidc/login` +
`GET /auth/oidc/callback`, and `GET /auth/saml/login` +
`POST /auth/saml/acs` via `enterprise/internal/saml`'s `crewjam/saml`