docs(rfc): fill the D12 §8.3 guarantee matrix (RFC-0003, #1184-1)

[LukasWodka]

Summary

#1184 residual, PR 1 of 3 — fills the RFC-0003 §8.3 guarantee matrix (D12). Docs-only.

The matrix was placeholder cells + a "to be filled precisely as part of D12" note. It's now the honest, customer-quotable artifact — enforced / conditional / recommended / not available per substrate, grounded in the chart-side seal-check table (client/docs/SEAL-CHECK.md) and the recorded k3d substrate run (client#504).

• k3d NetworkPolicy → conditional → substrate-verified: k3s v1.33.6+k3s1 blocks egress (2026-07-30); the full-chart probe run is still pending.
• cloud / bare-metal netpol → conditional on the CNI, verified per-fleet by the egress-enforcement probe; OpenShift enforced natively (OVN).
• storage → enforced (Option C node-local, verified by storage-assertions); encryption + confidential-compute rows filled per substrate.
• §8.4 updated to record the substrate run so it matches the matrix.

Honesty

Only cells naming a live check ("verified by …") are proven on that cluster today; cloud netpol reads conditional because it depends on the operator's CNI. Nothing is claimed "enforced" that the seal check can't confirm.

Residual #1184: #1184-2 (the full-chart e2e probe run → bumps the k3d cell to fully-verified) · #1184-3 (optional membership guard). Epic: backend#1151 (D12). The RFC lives in the cli code repo, so this targets develop (not the docs-repo main exception).

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only changes to RFC-0003; no runtime, auth, or deployment behavior.

Overview
Docs-only (D12 / #1184-1): RFC-0003 §8.3 no longer uses placeholder matrix cells — it now defines the customer-quotable guarantee matrix with explicit cell vocabulary (enforced / conditional / recommended / not available), ties claims to tracebloc client status --seal and client/docs/SEAL-CHECK.md, and fills per-substrate rows for storage, NetworkPolicy egress, encryption at rest, and confidential compute.

k3d netpol is documented as substrate-verified (k3s blocks egress on k3d v5.8.3 / v1.33.6+k3s1, 2026-07-30) with the full-chart egress-enforcement probe still pending. §8.4 records that substrate run and points evidence to SEAL-CHECK; prose clarifies that only “verified by …” cells are proven today and cloud/bare-metal netpol stays conditional on CNI until per-fleet probes run after lockdown (D6 / #199).

^{Reviewed by Cursor Bugbot for commit d0574b2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b97c3d7. Configure here.}

[saqlainsyed007]

Review — docs(rfc): fill the D12 §8.3 guarantee matrix (#1184-1)

Docs-only. The matrix is a genuine improvement: the placeholder cells are replaced with an honest enforced / conditional / recommended / not available vocabulary, and I cross-checked the substantive claims against the cited source (client/docs/SEAL-CHECK.md) — probe names (storage-assertions, egress-enforcement), the OpenShift PV-scan-degraded-when-clusterScope=false caveat, and the CNI-conditional netpol language all line up. The conditional → substrate-verified framing for k3d is appropriately careful.

Two things to fix before merge:

1. Broken cross-repo links (blocking). The two SEAL-CHECK.md links use a relative path (../../../client/...) that escapes the tracebloc/cli repo root and 404s on GitHub / any rendered docs site. For a customer-quotable artifact whose whole value is pointing reviewers at the seal-check evidence, the evidence link must resolve. Use an absolute URL, as the PR description already does for client#504. Inline on lines 492 & 516.
2. Source-of-truth divergence (non-blocking). §8.4 now asserts the k3d egress run as run-verified (2026-07-30), but the linked SEAL-CHECK.md still records it as "verification run pending". Inline on line 516.

Neither is a runtime/security-behavior change; risk is limited to doc accuracy and link integrity.

[LukasWodka]

Both link issues addressed in the latest push (absolute URLs + §8.4 rewording so the claim matches its linked target). bugbot run

[saqlainsyed007]

Re-review — d0574b2 ✅ both findings resolved

1. Broken cross-repo links (was blocking) — fixed. Both SEAL-CHECK.md links (§8.3 and §8.4) now use the absolute https://github.com/tracebloc/client/blob/develop/docs/SEAL-CHECK.md, which resolves — the file is present on client's develop. They'll render live on GitHub / any docs site now.

2. Source-of-truth divergence (was non-blocking) — resolved. The §8.4 reword now claims the substrate run's evidence "is recorded in SEAL-CHECK.md §8.4" — and that's now true: the companion doc on client develop was updated in tandem. Its k3d row reads "Substrate verified; full-probe run pending — k3s enforces egress NetworkPolicy (… 2026-07-30)", and its §8.4 Status block carries the matching reachable → BLOCKED → reachable evidence and calls itself "the single record of that run." The two docs now agree exactly: k3s substrate verified, full-chart egress-enforcement probe run still pending.

The update diff is small and clean; no new issues. Approving.

(Residual, as the PR notes — out of scope here: #1184-2 bumps the k3d cell to fully-verified once the full-chart probe run is recorded.)

[LukasWodka]

/fr-pass