kaddy v0.9.1 — the sign-in gate actually gates

[0.9.1] — 2026-07-21

Full Changelog: v0.9.0...v0.9.1

kaddy v0.9.0 — GitOps-owned portal + edge-outage hardening

[0.9.0] — 2026-07-21

Full Changelog: v0.8.0...v0.9.0

v0.8.0

The GSK portal locks its front door, and the cloud edge goes fully
GitOps-owned. Backstage on GSK now signs in via GitHub only — guest auth is
gone, an OAuth URL contract stack keeps callbacks pinned to portal.lab, and
sign-in is restricted to catalog org users (no dangerous resolver fallback).
The GSK Traefik cloud edge moves under Argo ownership via deploy/apps-cloud,
argo-rollouts gains an amd64 overlay for the gatewayapi plugin on cloud nodes,
the AppProject description fits Argo's 255-char limit (with a gate to keep it
that way), and cost docs are reconciled to the real node_count=3 figures.

Features

• rollouts: Amd64 cloud overlay for gatewayapi plugin
• gateway: GitOps-manage GSK Traefik cloud edge
• portal: GitHub-only auth on GSK Backstage override
• portal: OAuth URL contract stack + App Manifest helper

Fixes

• portal: Disable default Guest SignInPage in GSK override
• portal: Lock GitHub OAuth to portal.lab, drop localhost helper
• portal: Clear e10 shellcheck SC2034 + OAuth stack docs
• portal: Restrict sign-in to catalog org users (drop dangerous resolver flag)
• portal: Exclude catalog entity file from Argo directory sync
• gitops: AppProject description within Argo 255-char limit + edge-up overlay handover

Documentation

• cost: Reconcile day0/README cost figures with node_count=3

Full Changelog: v0.7.0...v0.8.0

Full Changelog: v0.7.0...v0.8.0

v0.7.0

Full Changelog: v0.6.0...v0.7.0

v0.6.0 — the Nix "fourth way" goes live

The Nix "fourth way" goes live — a reproducible, flake-locked golden image, served and
scraped on gridscale. E14 completes the golden-image story: alongside the Packer/Ubuntu
path, kaddy now ships a Nix-built gridscale Marketplace image (caddy-nix) — a
minimal-CVE, full-closure NixOS 24.11 image built reproducibly from a flake, exported to
object storage, registered + imported as a one-click Marketplace app, and live-proven
end-to-end: deploy → GET / 200 + /healthz + :2019/metrics (158 caddy_ series) →
Prometheus up=1 on the standing GSK cluster, with every ephemeral VM torn down clean
(0 orphans). The serve failure that stumped two earlier attempts turned out to be a caddy
version skew — nixos-24.11's caddy 2.8.4 rejects the golden Caddyfile's metrics { per_host }
block, so caddy run exited before binding :80 — fixed at source by pinning caddy ≥ 2.9. The
Marketplace also gains engine-OS naming + logos (caddy-ubuntu, caddy-nix), and E13-S05
live-proved the one-click Caddy deploy path end to end.

Features

• e14-s01: Nix-built gridscale golden image (flake + nixos-generators)
• e14-s02: Register kaddy-nix Marketplace app from the Nix .gz (LIVE)
• marketplace: Rename templates to engine-OS names + add logos (LIVE)
• deck: Rebuild interview presentation

Fixes

• e14-s01: Address independent review (P1 gate wiring + Caddyfile validation)
• e14: Add qemu-guest profile so the Nix image boots on gridscale (virtio)
• e14: Pin caddy >=2.9 so the Nix golden image serves (E14-S03)

Tests

• e13-s05: Live-prove one-click Marketplace deploy (Caddy)

Documentation

• e1g-s06: Reconcile retired "no standing env" prose → go-live carve-out + doc-truth guard
• e14-s03: Nix VM deploy — mechanism proven, then boot-to-serve LIVE-PROVEN (caddy ≥2.9 pin)
• e14-s03: QEMU boot test narrows the diagnosis — image boots, Caddy version skew found
• coord: Handover 2026-07-19 loop2 — E14 Nix path + marketplace rename/icons

Chores

• marketplace: Tofu fmt the caddy/nix stack edits (align icon_path)
• e14: Add hack/e14-s03-live-prove.sh — one-shot live deploy→prove→teardown
• e14: Scrape-prove hook + teardown-order fix + wire nix into e13:up/down

v0.5.0 — gridscale cloud-edge LIVE

The gridscale cloud-edge goes live — real public URLs with real certs. The phase-2 substrate swap is complete: kaddy serves on a standing gridscale GSK cluster behind a Traefik v3 Gateway-API edge with publicly-trusted Let's Encrypt certs.

Live demo URLs (all HTTP 200, verifiable chain):

• https://argocd.lab.platformrelay.dev — Argo CD (GitOps)
• https://grafana.lab.platformrelay.dev — Grafana (observability)
• https://caddy.lab.platformrelay.dev — caddy-mvp (Argo Rollouts canary showcase)
• https://demo.lab.platformrelay.dev — demo landing page

Lanes E1g-S05a–i + S06 (all independently reviewed, 0 P0/P1). Key findings: GSK managed Cilium can't serve Gateway API (→ Traefik, D-042); GSK has a service-LoadBalancer CCM (auto public IP); Gateway API v1.5.1 CRDs need the k8s-1.31 isIP CEL rules stripped for GSK's k8s 1.30. Full notes: CHANGELOG.md.

v0.4.1 — hardening, real CI gates, GSK :6443 live-proven open

Hardening, real CI gates, and a live :6443 proof. A remediation loop that burned
down the D-039 next-session lanes and the audit backlog, then closed the one remaining
environment block. Highlights: SEC-14 pins explicit securityContext on the
observability workloads (Grafana/Prometheus/Alertmanager/Loki; Alloy + node-exporter kept
as documented host-access exceptions); DOC-13 turns the markdownlint gate from inert to
genuinely enforced in CI (pinned markdownlint-cli2@0.23.1, narrowed to shippable docs, 0
issues across 160 files); a new release-provenance guard fails CI on a false "shipped in
vX" claim (with a companion guard that keeps the CI checkout deep + tagged); the E6g
Website composition drops a dead composed Network managed-resource (proven 3-kind serving
topology); and the deck token gate + provenance guard were fixed to actually run where
they're wired (three "inert gate" defects found by independent review). Finally, with the
corporate VPN disconnected, the GSK API :6443 egress is now OPEN — proven on an
ephemeral cluster (kubectl get nodes → Ready) then torn down (tenant clean), un-blocking
the E8b app-layer. Audit verdict: READY (0 P0/P1, 0 regressions).

Security

• SEC-14: Explicit securityContext on observability workloads (Grafana/Prometheus/Alertmanager/Loki; Alloy + node-exporter documented host-access exceptions)

Fixes

• e1g: Scrub leftover .terraform in the offline gate + teardown (ENV-1); reconcile the e6g evidence Network-MR claim (DOC-14)

Refactoring

• deck: Delete orphaned .kw-* CSS; assert token application not mere presence (D-039 F2)
• e6g: Drop the unattached composed Network MR; relax the composition gate to the proven 3-kind topology (D-039)

Tests

• meta: Add a release-provenance ancestry guard — an epic's commits must be ancestors of the tag it claims to have shipped in
• meta: Give the release-provenance guard teeth on CI (fetch full history + tags; wiring guard; fail-not-skip on CI)

CI & build

• doc13: Enforce markdownlint over shippable docs (narrowed globs, line-length noise relaxed) and pin markdownlint-cli2@0.23.1 (SEC-4)
• deck: Wire theme-tokens.sh into the deck CI composite + guard the wiring so it can't silently un-wire (DECK-1)

Documentation

• e8b: Live-prove GSK :6443 egress OPEN with the VPN disconnected (ephemeral cluster, torn down, tenant clean)
• e6g: Drop the stale composed-Network claim in the openspec tasks (review F1)
• inbox / coord: Log the D-039 operator answers, the loop3 lanes, and decision D-040

v0.4.0 — phase-2 live extensions + deck refresh

Phase-2 live extensions + deck refresh. The gridscale delivery is now proven live end-to-end on
real infrastructure (ephemeral create→verify→destroy, tenant clean after each): the E6g Website
Crossplane composition provisions a real gridscale nginx VM serving /legacy + /metrics on a
public IP; the E13 Marketplace register+import works for both Caddy and nginx engines; and the
E8b GSK substrate (cluster + network + object-storage anchor) provisions cleanly. The E12c deck
refresh reframes the interview deck around landed gridscale value (the provider + 3 upstream bug-fix
PRs) with a gate-exempt appendix and a hybrid workshop visual identity. Audit verdict: READY.

Features

• deck: E12c-S01 appendix-exempt gates + raised main budget
• deck: E12c-S02 gridscale value hero + Crossplane-as-IaC
• deck: E12c-S03 agentic-workflow beat (epic -> plan -> story -> test)
• deck: E12c-S04 appendix — NixOS path, repo-tree, quickstart, solved-different-ways
• deck: E12c-S05 hybrid k8s-workshop styling port (ADR-0112)
• deck: E12c-S06 wire recorded-surface fallback slots to guide names
• deck: E12c-S07 Kaddy README badge row

Fixes

• deck: E12c-S05 theme-tokens.sh — drop backticks in fail message
• e6g: Live-prove Website composition VM + fix real defects
• e6g: Migrate in-cluster Website claim to v2 selector + tighten gate

Tests

• e13: Live-prove S02 Marketplace register+import (both engines)
• e6g: Init v1_sel guard var (tech-review F4)

Documentation

• inbox: Session close — phase-2 live-proof cycle + operator answers
• adr: ADR-0303 + E14 — Phase 3 Nix golden images (forward-looking)
• e12c: Ratify design-lane spec + admit E12c/D-038 to backlog
• roadmap: Complete E12c backlog rows (S05-S07,S09)
• hygiene: E12c-S09 rename HIRING_EXERCISE, fix broken E14 links
• hygiene: E12c-S09 complete — commit the README+ROADMAP link fixes
• coord: Log E6g/E13-S02 live proofs + deck merge + review outcomes
• DOC-10: Drop stale 15/15 GitOps-apps count + fix its guard
• e8b: GSK substrate live-proven; app-layer egress-blocked (decide-and-log)

v0.3.1 — phase-2 live-proof cycle

Tests

• e6g: Live-prove provider-gridscale actuates real gridscale infra
• e13: Live-prove deploy->serve->scrape on a real gridscale VM

v0.3.0 — phase 2 (gridscale) + E10 Backstage portal

Features

• gridscale: E1g day-0 IaC — Terramate stacks + offline gates
• gridscale: E6g — consume Upjet provider-gridscale (offline)
• gridscale: E8b — on-demand live demo env (offline)
• gridscale: E13 — gridscale Marketplace template (offline)
• portal: E10 Backstage portal — GitOps wiring (offline)

Fixes

• e13: Correct gridscale packer builder args + strict validate gate
• e8b: SEC-19 dataplane carve-out for the demo surfaces
• e13: Packer build needs ssh_password + a template UUID

Tests

• e1g: Live-prove GSK substrate on gridscale
• e13: Live-prove the Caddy golden-image build on gridscale

Documentation

• inbox: V0.2.0 released; phase-2 next (E1g→E6g→E8b)
• inbox: Phase-2 live provisioning permitted but cost-sensitive (destroy after each test)
• inbox: DOC-10 guard-gap follow-up (release-provenance assertion)
• status: DOC-10 #6 — README/ROADMAP intro reflect phase-2 + E10 landed