knacky/mimic-big
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
39 Commits 2 Branches 1 Tag
c44f8b90ad6f75b01be60976076d6f9b6a4871f9
Commit Graph
4 Commits
Author SHA1 Message Date
knacky c44f8b90ad docs: archive Podman runner setup runbook + track F-D1..F-D5
ci / frontend (lint + typecheck + build + unit tests) (push) Failing after 0s
Details
ci / backend (lint + typecheck + unit tests) (push) Failing after 1s
Details 
Two changes scoped together since both stem from the post-PR2 wrap-up.

docs/podman-runner-setup.md (new, ~190 LOC):

Operational runbook for the gitea-runner host that drives CI. The first
attempt at install hit four traps that this archived version documents
so we don't lose the lesson:

 1. `act_runner register` performs a sanity ping against the container
    daemon before writing the credential. Without the Podman socket
    mounted on the *register one-shot*, register fails silently and no
    .runner file is produced. The runbook mounts the socket on both
    register and daemon containers.
 2. SELinux blocks rootless socket access by default. Quadlet
    SecurityLabelDisable=true (or --security-opt label=disable for the
    legacy CLI form) is the documented bypass. No-op on Debian, required
    on RHEL/Fedora hosts.
 3. The runner user UID is not 1000 on every host (gitea = 1005 here).
    Quadlet `%U` substitution makes the unit portable; hardcoded UIDs
    are explicitly called out as a sprint 0 mistake.
 4. `podman generate systemd` is officially deprecated. Quadlet is the
    only supported pattern going forward and is what this runbook ships;
    legacy alternative is omitted on purpose.

Also captures: token placeholder convention (<TOKEN_FROM_GITEA_UI>,
never the real value in archived docs), single-use semantics, the
"secrets via file, not chat" convention, the `:X.Y.Z` pin policy versus
`:latest` in prod (ties into follow-up F-D1), and a decommissioning
section that cleans up state without nuking the user-level Podman socket.

tasks/todo.md:

New section "Frontend follow-ups (sprint 1+)" with F-D1..F-D5 from
code-reviewer on `chore/frontend-dockerfile` (649194b). All deferred,
none blocking. F-D1 (digest pinning) is project-wide and explicitly
references the backend image and the runner image alongside the
frontend ones for a single chore commit.
 2026-05-23 03:08:03 +02:00
knacky df6294ed7b docs: align doc references with compose.yml rename (code-reviewer M1) 
Three docs still referenced the old docker-compose.yml path. Replace
with compose.yml so a future reader cloning at this hash finds the
file at the documented path.

- CHANGELOG.md:31 — backend skeleton recap line.
- docs/architecture.md:28 — deployment artifacts note (D-010 scope).
- tasks/todo.md:9 — B0.1 task description.

Also adds a "CI follow-ups (sprint 1+)" section to tasks/todo.md
capturing the 3 MINOR + 6 NIT deferred from code-reviewer's review
of chore/podman-and-ci, plus a FERNET-KEY tracker for the secret
provisioning before c2_credential.config_fernet (D-004) is wired.
 2026-05-22 19:49:16 +02:00
knacky 05f60cde6d docs: add docs/architecture.md (sprint 0 mirror) 
High-level architecture snapshot reflecting feature/backend-skeleton
@ 12d131c and feature/frontend-skeleton @ b505a65. Covers:

- Repo + backend + frontend module trees.
- §8 aggregates with delta annotations vs the frozen spec.
- F11 permission matrix mapping to rbac/matrix.py.
- Auth split (RT bcrypt session vs SOC opaque token) per D-003 / D-006.
- Cleanup templating (Jinja sandbox + regex_extract D-011 semantics).
- C2 abstraction layer + Mythic / Home stub.
- Storage pools layout (CAS blobs + flat evidence) per D-012.
- Sprint 0 happy-path flow + post-sprint scope boundary.
- Known WARN items (audit chain unverified, scope on /engagements,
  role free-text on engagement_member, deferred Q-003..Q-005).
- Anticipated-vs-v2 table summarising D-004 / D-008 / D-012 / D-013.

This is a living mirror — when code disagrees, code wins, file a doc fix.
 2026-05-22 05:11:25 +02:00
knackyandClaude Opus 4.7 047583eb9c chore: bootstrap repo skeleton with sprint 0 plan 
- .gitignore (Python, Node, RT/maldev hygiene, secrets)
- README.md (project framing, stack, conventions, status)
- CHANGELOG.md (team kickoff decisions Q1/Q2/Q3, T2/T3/T4, auth strategy)
- tasks/spec-decisions.md (D-001..D-007 arbitrations on top of frozen spec)
- tasks/todo.md (sprint 0 backlog: B0.* / F0.* / S0.* / R0.*)
- tasks/lessons.md (empty, populated as work progresses)
- backend/ frontend/ docs/ scaffolding

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-21 20:10:47 +02:00