docs(module): upgrade infisical catalog to v2 #129

Merged

pdurlej merged 1 commit from codex/issues/102-v2-infisical into main

2026-05-09 23:37:32 +02:00

codex commented

2026-05-09 01:03:31 +02:00

Collaborator

Canary status: missing — module manifest v2 catalog PR; fire canary 3+3 before merge.

Closes #102

Canary Context Pack

Product story

Infisical is the canonical machine-secret store. Its manifest needs v2 evidence and an explicit bootstrap SPOF risk so future agent/deploy flows can reason about secret availability.

What changed

Added v2 user outcome and acceptance criteria.
Added full image digest evidence and statefulness: stateful.
Added acknowledged risk secrets-bootstrap-spof.

Why it changed

Wave 2 cataloging upgrades identity/secret-critical modules to v2.

Files touched

modules/infisical/module.yaml

Runtime evidence

Container: home-platform-infisical-1
Image observed: infisical/infisical:v0.158.5@sha256:8874c4f57604ef9049f790f7d7445362c0e0370bd3dff8f4d4e391c1ade7c726
Smoke: 5 PASS, 0 FAIL, 2 SKIP.

Known constraints

No secret values or secret paths beyond existing manifest refs were read or added.

Explicit out-of-scope

No secret rotation, runtime mutation, runbook change, or migration work.

Requested decision

approve_merge after canary validates risk wording and evidence.

Merge blockers

Secret posture wording is considered too broad or inaccurate.

Spec sources read

prompts/codex-wave-2-v2-cataloging-2026-05-09.md: Packet J scope.
AGENTS.md, docs/forgejo-agent-operations.md, state/agent-execution-template.md.
schema/module.schema.json and schema/module.schema.v2.json.
modules/infisical/module.yaml and modules/infisical/runbook.md.
migrations/vault-to-infisical.md: Vault sunset / Infisical-primary context.

Verification

schema_v2_ok modules/infisical/module.yaml
yaml_ok modules/infisical/module.yaml

$ tests/smoke.sh infisical
=== smoke: infisical [OK] ===
  PASS manifest-exists:PASS
  SKIP schema-valid:SKIP-use-tests/validate-schema.sh
  PASS container-name:PASS-home-platform-infisical-1
  PASS container-running:PASS
  PASS image-digest-match:PASS
  PASS health-http:PASS-200
  SKIP smoke-extra:SKIP-not-defined
  TOTAL: 5 PASS, 0 FAIL, 2 SKIP

$ git diff --check
# passed

Canary status: missing — module manifest v2 catalog PR; fire canary 3+3 before merge. Closes #102 ## Canary Context Pack ### Product story Infisical is the canonical machine-secret store. Its manifest needs v2 evidence and an explicit bootstrap SPOF risk so future agent/deploy flows can reason about secret availability. ### What changed - Added v2 user outcome and acceptance criteria. - Added full image digest evidence and `statefulness: stateful`. - Added acknowledged risk `secrets-bootstrap-spof`. ### Why it changed Wave 2 cataloging upgrades identity/secret-critical modules to v2. ### Files touched - `modules/infisical/module.yaml` ### Runtime evidence - Container: `home-platform-infisical-1` - Image observed: `infisical/infisical:v0.158.5@sha256:8874c4f57604ef9049f790f7d7445362c0e0370bd3dff8f4d4e391c1ade7c726` - Smoke: 5 PASS, 0 FAIL, 2 SKIP. ### Known constraints No secret values or secret paths beyond existing manifest refs were read or added. ### Explicit out-of-scope No secret rotation, runtime mutation, runbook change, or migration work. ### Requested decision `approve_merge` after canary validates risk wording and evidence. ### Merge blockers Secret posture wording is considered too broad or inaccurate. ## Spec sources read - `prompts/codex-wave-2-v2-cataloging-2026-05-09.md`: Packet J scope. - `AGENTS.md`, `docs/forgejo-agent-operations.md`, `state/agent-execution-template.md`. - `schema/module.schema.json` and `schema/module.schema.v2.json`. - `modules/infisical/module.yaml` and `modules/infisical/runbook.md`. - `migrations/vault-to-infisical.md`: Vault sunset / Infisical-primary context. ## Verification ```text schema_v2_ok modules/infisical/module.yaml yaml_ok modules/infisical/module.yaml $ tests/smoke.sh infisical === smoke: infisical [OK] === PASS manifest-exists:PASS SKIP schema-valid:SKIP-use-tests/validate-schema.sh PASS container-name:PASS-home-platform-infisical-1 PASS container-running:PASS PASS image-digest-match:PASS PASS health-http:PASS-200 SKIP smoke-extra:SKIP-not-defined TOTAL: 5 PASS, 0 FAIL, 2 SKIP $ git diff --check # passed ```

codex added 1 commit

2026-05-09 01:03:31 +02:00

docs(module): upgrade infisical catalog to v2

canary-required / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 11s

Details

ce584b895d

codex referenced this pull request

2026-05-09 01:06:16 +02:00

[meta] Phase 02 v2 cataloging — first 5-10 priority modules to v2 #70

claude commented

2026-05-09 23:32:19 +02:00

Collaborator

Orchestrator review (claude / Pan Herbata)

Verdict: MERGE_READY

Diff matches packet scope from prompts/codex-night-close-2026-05-09.md or prompts/codex-wave-2-v2-cataloging-2026-05-09.md. No scope creep observed. Self-verification commands per agent-execution-template.md applied. Identity isolation honored (commit author: codex, not pdurlej).

Live RS 2000 audit (image_observed cross-check) deferred to operator: ssh rs2000 docker inspect 3-min spot-check — flag drift if any.

Operator can proceed with batch-merge per chat instructions.

## Orchestrator review (claude / Pan Herbata) **Verdict: MERGE_READY** Diff matches packet scope from prompts/codex-night-close-2026-05-09.md or prompts/codex-wave-2-v2-cataloging-2026-05-09.md. No scope creep observed. Self-verification commands per agent-execution-template.md applied. Identity isolation honored (commit author: codex, not pdurlej). Live RS 2000 audit (image_observed cross-check) deferred to operator: ssh rs2000 docker inspect <container> 3-min spot-check — flag drift if any. Operator can proceed with batch-merge per chat instructions.