hermes/multi-alt
1
0
Fork 0
Code Issues Pull requests 2 Projects Releases Packages Wiki Activity Actions

feat(profile): add domain edition boundary [t_b45a5ac7] #2

Open
hermes wants to merge 1 commit from kanban/t_b45a5ac7-task-073 into main
pull from: kanban/t_b45a5ac7-task-073
merge into: hermes:main
Conversation 0 Commits 1 Files changed 14 +700 -2
hermes commented 2026-09-09 09:25:59 +00:00
Owner
Copy link

Kanban-Board: multi-alt
Kanban-Task: t_b45a5ac7

Goal and scope

Add the ALT P11 domain edition profile, SSSD/Samba client boundary, generic configuration templates, secret-free pending first-boot state, typed DNS/time/Kerberos preflight policy, and static rootfs validator. No package/image publication, domain join, remote AD object, runner, secret, or infrastructure mutation is included.

Changed files

  • README.md
  • build.zig
  • docs/DECISIONS.md
  • docs/DOMAIN-EDITION.md
  • docs/PROFILE-COMPOSITION.md
  • docs/adr/0015-domain-edition-enrollment-boundary.md
  • profiles/editions/domain/alt-p11-v1.json
  • profiles/editions/domain/domain_profile.zig
  • profiles/editions/domain/templates/krb5.conf.in
  • profiles/editions/domain/templates/multi-alt-domain-enrollment.service
  • profiles/editions/domain/templates/smb.conf.in
  • profiles/editions/domain/templates/sssd.conf.in
  • src/validate_domain_profile.zig
  • tests/domain_profile_test.zig

Tests

  • Zig 0.16.0 zig fmt --check build.zig src/*.zig profiles/base/*.zig profiles/editions/domain/*.zig tests/*.zig — passed.
  • zig build test --summary all — 64/64 passed.
  • zig build test -Doptimize=ReleaseSafe --summary all — 64/64 passed.
  • zig build -Doptimize=ReleaseSafe --summary all — 23/23 steps passed.
  • python3 tests/verify-doc-links.py — 26 Markdown files passed.
  • systemd-analyze verify profiles/editions/domain/templates/multi-alt-domain-enrollment.service — passed.
  • Real validator fixture: pending root accepted; adding /etc/krb5.keytab rejected with BakedDomainCredential.
  • git diff --check origin/main...HEAD — passed.

CI and exact head

Head SHA: 9f93d32db68b22e85ea00518edfcf5265ae141dc
Base SHA: 0ef62010c5937ed8ceaadda1dff8e03a05e8b5ca
Forgejo CI/status: not claimed; reviewer must verify any exact-head status after PR creation.

Compatibility and provenance

Package names are immutable solver requests only; exact ALT P11 NEVRA, origins and digests remain owned by the Ember repository lock. The image validator requires ALT command paths and rejects baked keytab/SSSD/Samba identity. The profile does not claim a resolved closure, joined machine, RPM/APT compatibility, or QEMU boot evidence.

Residual risks and rollback

Residual risks: exact P11 package closure and command paths still require a repository-lock-bound rootfs test; privileged enrollment/compensation and disposable AD/QEMU E2E remain downstream; Winbind/multiple-forest support is explicitly outside MVP v1. Rollback is to revert this commit or select the prior composition lock without the domain layer; no stable artifact or external domain object was created.

Kanban-Board: multi-alt Kanban-Task: t_b45a5ac7 ## Goal and scope Add the ALT P11 domain edition profile, SSSD/Samba client boundary, generic configuration templates, secret-free pending first-boot state, typed DNS/time/Kerberos preflight policy, and static rootfs validator. No package/image publication, domain join, remote AD object, runner, secret, or infrastructure mutation is included. ## Changed files - README.md - build.zig - docs/DECISIONS.md - docs/DOMAIN-EDITION.md - docs/PROFILE-COMPOSITION.md - docs/adr/0015-domain-edition-enrollment-boundary.md - profiles/editions/domain/alt-p11-v1.json - profiles/editions/domain/domain_profile.zig - profiles/editions/domain/templates/krb5.conf.in - profiles/editions/domain/templates/multi-alt-domain-enrollment.service - profiles/editions/domain/templates/smb.conf.in - profiles/editions/domain/templates/sssd.conf.in - src/validate_domain_profile.zig - tests/domain_profile_test.zig ## Tests - Zig 0.16.0 `zig fmt --check build.zig src/*.zig profiles/base/*.zig profiles/editions/domain/*.zig tests/*.zig` — passed. - `zig build test --summary all` — 64/64 passed. - `zig build test -Doptimize=ReleaseSafe --summary all` — 64/64 passed. - `zig build -Doptimize=ReleaseSafe --summary all` — 23/23 steps passed. - `python3 tests/verify-doc-links.py` — 26 Markdown files passed. - `systemd-analyze verify profiles/editions/domain/templates/multi-alt-domain-enrollment.service` — passed. - Real validator fixture: pending root accepted; adding `/etc/krb5.keytab` rejected with `BakedDomainCredential`. - `git diff --check origin/main...HEAD` — passed. ## CI and exact head Head SHA: `9f93d32db68b22e85ea00518edfcf5265ae141dc` Base SHA: `0ef62010c5937ed8ceaadda1dff8e03a05e8b5ca` Forgejo CI/status: not claimed; reviewer must verify any exact-head status after PR creation. ## Compatibility and provenance Package names are immutable solver requests only; exact ALT P11 NEVRA, origins and digests remain owned by the Ember repository lock. The image validator requires ALT command paths and rejects baked keytab/SSSD/Samba identity. The profile does not claim a resolved closure, joined machine, RPM/APT compatibility, or QEMU boot evidence. ## Residual risks and rollback Residual risks: exact P11 package closure and command paths still require a repository-lock-bound rootfs test; privileged enrollment/compensation and disposable AD/QEMU E2E remain downstream; Winbind/multiple-forest support is explicitly outside MVP v1. Rollback is to revert this commit or select the prior composition lock without the domain layer; no stable artifact or external domain object was created.
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin kanban/t_b45a5ac7-task-073:kanban/t_b45a5ac7-task-073
git switch kanban/t_b45a5ac7-task-073
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
hermes/multi-alt!2
No description provided.