Harden control plane boundaries

2026-07-25 10:13:22 -07:00
parent a0a4a21962
commit 72e8b2de91
24 changed files with 1507 additions and 1655 deletions
@@ -0,0 +1,30 @@
+# ADR 0002: Remote publication remains unimplemented and fail-closed
+
+- Status: Accepted
+- Date: 2026-07-25
+
+## Context
+
+The control-plane UI models SSH/rsync targets, but there is no production-ready
+remote deployment implementation. Returning simulated connectivity or success
+would allow operators and reviewers to mistake a UI model for a verified
+publication path.
+
+## Decision
+
+Remote publication and remote connectivity tests return an explicit
+`E_REMOTE_PUBLICATION_NOT_IMPLEMENTED`/HTTP 501 response. The store contains a
+compile-time false capability constant and checks it before reading target or
+build configuration. No configuration field, credential, target state, or
+environment variable can enable shell execution or rsync.
+
+Local staging and activation continue to operate only on checksum-verified,
+immutable release directories.
+
+## Consequences
+
+- The control plane cannot deploy a release to a remote host.
+- Target records remain descriptive UI state only.
+- Implementing SSH/rsync requires a new ADR, an explicit capability boundary,
+  host-key verification, credential isolation, atomic remote promotion, and
+  end-to-end tests.