Public: anyone can read this; nobody can change it.
germinate: ship Grafana observability to daughters (#6) #8
Check · Review · Land · Live — It conflicts with its base.
Threads the new gitops observability stack (`plat/gitops` `feat/observability-grafana`) through germination, so a sovereign daughter can ship Prometheus + Grafana. Closes the toolkit side of #6.
4 files · +78 −6
waiting it conflicts with main in bin/germinate, bin/lib.sh — bring the branch up to date and it can land
Check on open-platform/mitosis: has not run, as of
Checks and the preview wait for a writer to approve this head
A guest
This pull comes from a guest: its preview runs without the app's variables or a forge token until a person who can write here approves it.
This pull waits for a person who can write here to review it; it never lands on its own.
Threads the new gitops observability stack (
plat/gitopsfeat/observability-grafana) through germination, so a sovereign daughter can ship Prometheus + Grafana. Closes the toolkit side of #6.What
MONITORING=1(env; surfaced inup+germinateusage) keeps the observability stack in a lean daughter; the full profile always ships it.trim_gitops_lean: keepmonitoring/and emit its Flux Kustomization when opted in; drop it otherwise (lean stays minimal).fork_regen_secrets: resealgrafana-oauthto the sovereign key with a fresh break-glass admin password — otherwisefork_verify_all_sealedrejects the genesis-sealed placeholder. EmitsFORK_GRAFANA_ADMIN_PASSWORD.fork_register_grafana_oauth(new): post-handoff, register a sovereign Forgejo OAuth app for Grafana and seal its client id/secret (no-op when monitoring is absent), mirroring the existingfork_register_oauthfor plat-mcp.Validation (unit-tested the functions on a real gitops clone)
trim_gitops_leanopt-in keepsmonitoring/+ emits the Kustomization (8 total, valid YAML); opt-out drops both.fork_verify_all_sealedpasses: "all 10 forged secrets sovereign-sealed" (9 originals + grafana), grafana secret decrypts with the fork key.rewrite_identity_domainrewritesgrafana.<old>→grafana.<new>and the OAuthgit.<old>→git.<new>with zero stale hosts and the dot-escape-sensitiveplat-local-ca-tlsintact.bash -nclean on all scripts.