Harden control plane boundaries

2026-07-25 10:13:22 -07:00
parent a0a4a21962
commit 72e8b2de91
24 changed files with 1507 additions and 1655 deletions
@@ -0,0 +1,34 @@
+# ADR 0001: Keep source inventory subordinate to Git-owned build inputs
+
+- Status: Accepted
+- Date: 2026-07-25
+
+## Context
+
+The control plane can inspect and discover repositories, while the deterministic
+builder resolves its site definition and other declared inputs from exact Git
+commits. A mutable source-management UI must not become an alternate build
+configuration channel.
+
+## Decision
+
+Repository discovery and connectivity state remain operational inventory only.
+They may not alter a release input, theme selection, project declaration, or
+source pin. Build inputs continue to come from closed-schema, Git-owned
+configuration resolved into immutable snapshots.
+
+Gitea discovery is fail-closed: its HTTPS origin must be configured and
+allow-listed, its API token comes from the process environment, requests use a
+bounded timeout, and callers are rate-limited. Discovered entries are merged
+atomically into inventory and begin with projection disabled.
+
+Source-management UX may add review and configuration workflows later, but any
+accepted change must be committed to the Git-owned configuration before it can
+affect a release.
+
+## Consequences
+
+- Discovery cannot silently expand release inputs.
+- Operators must configure Gitea credentials and origin policy explicitly.
+- A future writable source UX requires a new ADR describing its Git commit and
+  review workflow.