Repository navigation
Register the public-only business-site staging tenant #5247
Description
🤖 Generated by the Agentic Engineer
Problem and audience
The business operator needs a remotely reachable public-only staging instance of the unified application before private portal activation. The application has a verified signed runtime pair, but Platform has no business-site registration or approved route, so published artifacts alone do not create a working service.
Evidence and approach
Platform main da6dcc1accac960f6f103256004c448cc7ece3eb retains the namespaced Tenant/WebApp contracts, own-namespace WebApp opt-in, selected read-only input projection and fail-closed hostname policy. Its source contains no business-site tenant or per-consumer publisher approval. Source issue devantler-tech/business-site#293 and PR devantler-tech/business-site#294 prepare the exact proposed public staging name business-site.platform.devantler.tech. The already verified v1.0.1 pair still contains the inert example hostname and is not the staging package.
Use only the source-owned deployment artifact and normal typed Tenant/WebApp path. Platform owns registration, narrow route admission and private-input materialization—not a copy of application code or an independent site publisher. The exact newer signed pair must be published and independently verified before consumption. Existing capability work #5163/#5195 is delivered; #4854 retains broader projection/controller acceptance. This task is the concrete consumer-registration increment, not a replacement capability foundation.
Acceptance
- Rebind current Platform and application sources, native ownership/activity, the accepted immutable publisher and independently verified newer image/manifest pair. Record the actual version, source and paired digests; do not guess a future digest or reuse the old inert package.
- Register only the business-site namespace and its typed public WebApp consumer, with a narrowly reviewed consumer-publisher record and exactly the staging hostname. Keep other tenants, production
devantler.tech, wildcard/lookalike routes and omitted-hostname escalation excluded. Retain negative controls against the real policy/admission path. - Establish an explicitly owned, same-namespace company-disclosure input using the maintained private-input mechanism. Do not put its value, private address, credentials or customer data in source, images, artifacts or public logs. Observe generic refusal when required input is missing or unsafe. No private portal, database, migration, real identity-provider registration or payments are enabled.
- Run the affected manifest, naming, namespace/ownership, graph/compiler, network, image provenance and resource/probe checks. Use normal exact-head review, merge-queue deployment and pipeline-owned reconciliation; no copied legacy Deployment, manual cluster apply, template patch bypass or takeover of active recovery.
- Read actual controller/kubelet/projection results through authorized read-only surfaces and verify the selected signed artifact, restricted execution, health, EN/DA public routes and closed portal/API paths at the staging hostname. Capture routing/certificate and rollback evidence; static rendering is not live acceptance.
- Keep current Pages publication and its production hostname unchanged. Record the result on parent Publish verified tenant deployment artifacts for portal staging business-site#102; private portal activation and eventual production-hostname cutover remain separate reviewed decisions under Deploy and verify the unified business site and private portal monorepo#3939.
Priority and readiness
Priority High; Effort Medium; Standard service class. This directly unlocks the next visible portal-deployment milestone while containing risk to a public-only staging tenant. Do not pull implementation until source #293 and its newer verified publication are ready, required private-input ownership is established and conflicting live claims are absent. No new paid services or customer access are authorized by this issue.
Part of devantler-tech/business-site#102.
Activity
devantler commentedon Oct 22, 2026
The source/publication prerequisite is now delivered: business-site #294 merged normally as signed
e5eb256dcb5dbf3857257e9072937ab95f1ea6c3, and #293 is CLOSED. Actual v1.0.2, original main CI 39867770434 attempt 1, real credential dry run 39869327358, release 39869716084 and publisher 39869859801 attempt 1 all succeed. Publication was restored to false and read back at 23:12:15 UTC.Consume only this independently verified immutable pair, not the earlier inert-hostname v1.0.1 package:
ghcr.io/devantler-tech/business-site@sha256:d71c867ac38472643dc38669b3b71d9ee3db4062ac46654314fde864846a9471ghcr.io/devantler-tech/business-site/manifests@sha256:6adcb1794ebdf5de4e1b03f758d44d6f9061eee43b863b1b1f4955a1e1d2615e467f07582436a26b62cf4aa756423512f85ba0c03b0947c7936b1003898d87d7e6d21b680cb1b0be087ce6ee40890b872bfbd7aca00334688cc4f8ddeaacb14cbb96c76c2c68ae09ad018855d47f31a959d8ba25.Independent host verification checks both signed immutable subjects and version aliases, complete paired source/version/input/original-CI/publication claims, actual Flux-pulled content against source (only verified image substitution), and byte-for-byte equality with the actual publication receipt. A wrong paired public-input claim refuses without a receipt. The pulled package contains the exact reviewed public staging hostname. Original real-archive wrong-source and wrong-digest refusals also pass. All 58 real package/refusal controls pass on the byte-identical merged tree; static/source fixtures are not controller proof.
Private company-disclosure input ownership/materialization, concrete namespace/consumer/route approval and actual controller/kubelet/routing/rollback acceptance remain OPEN here. No implementation or live tenant registration is asserted, no private value is published, Pages remains authoritative and private portal/customer/payment/API/MCP access stays off. Parent devantler-tech/business-site#102 remains OPEN and now names this concrete consumer task as its native delivery predecessor. Preserve existing clocks and the issue's Backlog position until its remaining readiness inputs and safe ownership are verified.
devantler commentedon Oct 22, 2026
Bounded source refinement after the publication receipt: fresh Platform main is
e21406316b3b075c574c72b33a5f0af773ffd8bf. Since the earlierda6dcc1ainspection, only the Go module files and Cilium version changed; the Tenant, admission, private-input and first-consumer contracts inspected here are unchanged. This is source evidence, not a fresh live-controller or cluster-health verdict.Two concrete integration points must be included in this issue's existing approval/input acceptance, not bypassed or replaced with another generic foundation:
The concrete consumer remains Backlog until that plan and the private input's actual ownership are ready. The signed pair is delivered; no source or runtime capability, registration, secret value or controller acceptance was created by this refinement. Existing parent, dependencies, High/Medium/Standard planning values and clocks are unchanged.
devantler commentedon Oct 23, 2026
The publication-profile seam is now an explicit, non-activating child: #5248, implemented in draft PR #5249 at signed
075feed652a4d5a601d89ccac04f86c583ec68bc. It was reproduced RED, passes its complete local refusal controls and retained suites, and its actual read-only command verifies the existing v1.0.2 manifest publication. Hosted CI and substantive review are still pending; this is not delivered approval or registration.The native child and blocked-by relationship are verified. This parent retains its original Backlog position and clocks: private-input ownership/materialization, typed source-before-reconciliation ordering, canonical consumer admission, narrow route approval and real workload/rollback proof remain here. No guessed approval, legacy identity reinterpretation, tenant registration, private value or production route was introduced.
devantler commentedon Oct 23, 2026
Concrete registration plan from current Platform source
32e5761d3c2e785edb8bc62d58b6fdedc63420f7and business-site source9ba95bebb331cc25617d7fa5ddc0054e6d955a94(source inspection, not deployment clearance):These coupled registration requirements stay under this parent; they are not more generic platform replacements or claims of completed runtime acceptance. #5249 is still a draft with corrected-head CI in progress and no substantive review yet. The parent remains Backlog with its original clocks. Production Pages, hostname, private portal, identity providers, database, payments and API/MCP execution stay unchanged.
devantler commentedon Oct 23, 2026
The source-owned input-reference publication prerequisite is now delivered as genuine business-site v1.0.3, source
498248e86e49024b72f3249b518e4dd1cef0104bfrom protected #301. Original main CI 39918674596 attempt 1, real credential dry run 39921229184, release 39921481263 and publisher 39921694859 attempt 1 all succeed. This pair contains both newly reviewed source-owned disclosure-input declarations; v1.0.2 must not be relabeled as containing them.ghcr.io/devantler-tech/business-site@sha256:a70bf9cb5f174b709b452870aaf899daf671fba717ee8580feef2c5aab362256ghcr.io/devantler-tech/business-site/manifests@sha256:fa22e5796a39872feb8c75b5d56e2c6d68ff289230e2c5762f0bbfa0b30d6744467f07582436a26b62cf4aa756423512f85ba0c05ef904e17bfa2758fcc85e714a63f284b1b90c22af180fa5920d4263a80a24a567e4a77cde7589150b531b98dcda35414bc290b8d15415cf1e34a43063aee83d.Independent host verification authenticates both immutable subjects and both version aliases, complete source/version/original-CI/publication/public-input claims, and actual pulled content against source, allowing only the verified image pin. Its receipt equals the digest-verified actual publication receipt byte-for-byte. A wrong paired public-input claim refuses without emitting a receipt. Publication is restored to false and read back at 08:03:38 UTC. No retry, occupied-version reuse or recovery bypass occurred.
This changes the available package, not registration authority. Fresh Platform source
840972ba426ed11e6ad5bf328335995464667af1and the existing four comments retain this issue's concrete approval, typed immutable-source-before-application sequencing, private-input provisioning and live controller/routing/rollback requirements. No guessed approval, copied source object, private value, tenant registration or activation is asserted. Parent business-site #102 remains OPEN; Pages remains authoritative and customer/provider/payment/API/MCP access stays off. Existing board position and clocks are unchanged.devantler commentedon Oct 24, 2026
Concrete source rebind at Platform
8dd8d608cfc7c3ba930c553848b2f13e0b978c22: #5248 and #5259 are CLOSED; #5261 is MERGED. No matching open implementation PR or business-site registration was found in this bounded read. This is source investigation, not live health/deployment clearance.Finish this product-specific onboarding with the existing contracts:
The next implementation is this concrete registration/admission integration, not another generic Tenant/WebApp capability issue. Public staging and its private input, actual identity runtime and customer activation remain separate acceptance. No code, claim, private value, cluster operation or deployment changed in this investigation.
devantler commentedon Oct 25, 2026
The source/publication prerequisite is freshly verified in the v1.0.3 readback. That includes current release/tag/original-CI/publication-attempt checks, both immutable signed subjects and version aliases, and an actual pull/source comparison of the complete deployment package. Source #293 and #300 are closed. This removes the stale publication uncertainty; it does not establish Platform deployment or private input availability.
A fresh API-only audit binds Platform main
960fc884add62091ede9087ca05b2bd4e7817e9f. The full 17-open-PR read and matching claim/work-branch reads found no #5247 implementation; physical checkout ownership was not checked or acquired. Current source still has three concrete admission gaps: canonical approvals assume legacy registration history, binding verification assumes a legacy signer, and conservation rejects instantiated Tenant constructors that produce OCIRepository children. Extend the existing canonical generator/writer/guard/report/bootstrap schema and exact constructor attribution; do not fabricate legacy history or insert unbound publisher hashes. ExistingreconcileApplication:falsealready supplies the source-only registration seam, so another generic lifecycle foundation is unnecessary.The implementation remains narrowly scoped to this consumer's canonical approval, exact Tenant source/publication identity, initial source-only registration, the exact proposed staging hostname and its real negative admission fixtures. Preserve refusal of missing/duplicate/unknown or modified constructors and omitted/wildcard/lookalike/production-apex routes. Source-only registration must be observed before the separately reviewed application-enable transition; do not claim that disabling it later is a supported rollback.
The package already declares its confined disclosure store, ExternalSecret and required projection. Platform's maintained tenant documentation assigns private-value ownership and entry directly to the tenant owner; Platform supplies the same-namespace role/isolation, not a seeded value. Current source has no business-site role/policy. The eventual role must be limited to this service account, namespace and single input, without infrastructure-role reuse or value-write authority. A private operator entry path exists, but no product-specific automated materialization/readback helper was found. Actual value availability is UNVERIFIED, not known absent. Establish the owner/materialization privately before application activation; do not expose the value in source or public proof.
No issue reservation, checkout claim, code, credentials, private value, cluster resource or activation setting was changed by this audit. This issue and the business-site deployment/identity parents remain open; production Pages and the closed portal are unchanged.