[ROADMAP] First Client Deploy → Governance — tracker #47

📍 Status 2026-07-06: roadmap executed and shipped (0.7.6 train on prod, nightly gate green, reseed automated). Still open: Enforce flips #42/#43 (+#41 cosign keys), HYB-2 #35 + GATE #46 acceptance, design PR #48 (#36) — all labeled operator-decision. Full state: see the 2026-07-06 comment below.

First Client Deploy → Governance — the roadmap tracker. All items are goal issues under the Client Deploy → Governance Roadmap milestone, carrying native blockedBy dependencies. Two horizons; waves are seam-serialized so parallel agents don't collide on bin/germinate/bin/lib.sh, mcp/src/server.ts (overlay renderer), or the gitops root kustomization.

Async substrate (start now, non-blocking)

• #21 CI-1 — cold-start CI (Forgejo Actions + vcluster). Merges to main when robust; then everything validates through it.

Horizon 1 — Client-Deployable MVP (deploy tomorrow)

Horizon 2 — Governance (overlaps H1 where seams allow)

Backlog

• #36 HYB-3 — OpenTofu multi-cloud substrate (design only)
• BYO IdP (Entra/OIDC) — revisit when the client needs corporate SSO

Critical path (to GATE): DOM-1a → DOM-1b → RBAC-2 → RBAC-4 → DOM-2 → POL-4/POL-5 → GATE (RBAC-1 gates the RBAC chain). The MVP path (SPINE-2 → SPINE-3 → HYB-1 → SEC-1, DOM-1a in parallel) ships far earlier.

Each goal issue is written for an autonomous agent that may recurse into its own subagent team. Seam rule: land on a shared seam by rebase; don't start a seam position until the prior one merges.

Status reconciliation — 2026-07-01

Verified wave-by-wave against merged PRs on plat/{mitosis,gitops,agents,mcp,_app-template} and issue states, plus today's wb-gate E2E on a fresh plat.local daughter. Legend: DONE = merged + issue closed · LANDED/open = code merged, issue open (Audit-mode caveat or acceptance formality outstanding) · PARTIAL · IN-FLIGHT · NOT STARTED.

Shipped today (wb-gate arc, PR #61 + seed): fresh daughter germination activates the WHOLE whiteboard first-try — 10/10 Flux Kustomizations incl. kyverno + kyverno-policies, 12 ClusterPolicies (Audit); full E2E on a fresh plat.local daughter: template → agent build → browser review → auto-merge → prod 200 (pulse).

Found today (issues + fixes in flight): #63 duplicate system webhook every dispatcher boot (fix: plat/agents#10) · #57 root-caused — reviewer probe used loopback from inside the pod, ~10-min spurious fallback (fix: plat/agents#11) · #64 port-80 serves Forgejo in cleartext (first fix failed validation; rework running on plat/gitops fix/web-entrypoint-https-redirect) · #62 depth-2 reseed, delivered as PR #65.

Next horizon (proposed order)

1. agents 0.7.6 release train — #66. Merge plat/agents#10 + #11 → tag v0.7.6 → gitops pin bump → genesis reseed (follow-up to PR #65). Cheap, mechanical, retires #63/#57.
2. Land the #64 rework and fold it into the same pin/seed window — one reseed instead of two.
3. GATE regression assertions — #67. Today's two failure modes both self-heal, so a naive E2E passes while degraded; add exactly-one-webhook-after-restart + no-fallback reviewer liveness to the #21/#46 assertion set.
4. The fork in the road (operator decision): #35 HYB-2 vs #21 CI-1. HYB-2 is materially unblocked (DO + tunnel tokens in hand) and retires the real-infra unknown early, but spends money and needs the operator's go. CI-1 spends only time and is what makes GATE unattended-repeatable — #46 explicitly extends the CI-1 harness. They share no seams, so with budget they can run in parallel; if serialized, CI-1 first keeps the capstone honest, HYB-2 first buys the earliest client-shaped proof.
5. Governance tail after the train: POL Enforce flip (#42/#43 remaining scope), #38/#39/#40/#41 issue closure on acceptance evidence, #60 Cilium prerequisite (then flip PLAT_FQDN_EGRESS=1 and #13 closes), then the full #46 VPS gate.

Additive reconciliation only — no issues were closed or edited; owners of the LANDED/open rows should close on their own acceptance evidence.

Tracker refresh (release engineering lane): 0.7.6 train SHIPPED to prod (agents v0.7.6 = #57+#63+#11 fixes; gitops = #64 redirect + #60-prereq hostNetwork mirror; genesis seed = released train — depth-2+ carry everything). CI-1 (#21) DELIVERED + proven: repo-scoped vxrail runner + coldstart workflow + shared gate script; germinate-touching PRs now auto-validate on a fresh platform (first consumer: #70's PR #72, gate running as this is written). Closed this cycle: #11 #21 #57 #62 #63 #64 (+#2 #15 #38 from the hygiene sweep). Two release-blockers were found BY the RC validation process and fixed same-day (germinate pre-release regex; caddy file-caps EPERM) — the strongest evidence yet for gate-everything. Open decisions for the operator: close-proposals #39/#22/#3; HYB-2 (#35, spends money) vs governance tail (POL Enforce flips #42/#43); #67's reviewer-fallback assertion needs the nightly app-E2E gate variant (sealed credential).

Board cleanup + full status — 2026-07-06

Shipped and live. Prod runs the 0.7.6 train (pod images verified today: agents 0.7.6, mcp 0.26.0). Genesis seed = r29, produced and merged by the automated reseed pipeline (#14). Fresh germinations activate the whole whiteboard (Kyverno + baselines, letsencrypt, cosign-signing, forwardAuth, webhook HMAC, credential boundary, fork genealogy).

Automation is green unattended. Nightly coldstart gate 4-for-4 since the train shipped (runs 33–36, 07-03→07-06, ~18 min each, incl. app-E2E). Reseed pipeline opened+merged r25/r29 with the no-op guard working (r27 correctly dropped). Nightly prod backups fresh through 2026-07-06 03:35.

Closed in this cleanup (all verified delivered): #3 self-serve domains (DOM-1b mcp v0.24.0 + DOM-1a, proven on product-garden.com) · #39 POL-1 Kyverno landed (gitops#4, 12 ClusterPolicies live) · #40 POL-2 generate-migration (gitops#6 + mcp#8, drift-heal proven, depth-2 evidence) · #69 canary epic (7/7 probes, superseded by the nightly E2E gate).

Remaining — operator decisions (label operator-decision):

• #42 / #43 — flip Kyverno Audit→Enforce: merge plat/gitops#14, run the ENFORCE.md checklist.
• #41 — cosign key custody (generate+seal keypair; verifyImages is a placeholder until then).
• #35 HYB-2 — real-VPS granddaughter run (spends money).
• #46 GATE — accept the assembled depth-2/vxrail evidence, or run the literal unattended VPS capstone (pairs with #35).
• #36 — review/merge design PR #48 (OpenTofu substrate contract).

Remaining — implementation work:

• #6 Grafana: PR #8 is conflicted against the post-#61 trim_gitops_lean rewrite — needs re-threading, plus the unmerged gitops branch.
• #7 agent-work: plat/agents#2 is stale against the 0.7.6 dispatcher — rebase or redo.
• #17 live transcripts: heartbeat v1 shipped; full SSE/SPA version awaits owner decisions 1–3.
• #60 → #13 Cilium: run the CNI swap on a disposable germination, then flip PLAT_FQDN_EGRESS and tighten the 443/80 default.
• #4 / #5: designs ride open PR #9.

Open PR queue: mitosis #8 (conflicted), #9 (design record — the Vault secrets doc is superseded by the shipped Forgejo-native approach), #10 (vision docs, clean merge), #48 (clean merge, closes #36) · plat/gitops#14 (Enforce flip) · plat/agents#2 (stale).

Standing security item: seal a fresh E2E_CLAUDE_TOKEN — the staged copy is still the 2026-07-01 compromised value.

Anomaly noted today: two forgejo-runner job pods in Error on k3d-staging (platform services all healthy) — worth a look.