fix(govstore): authorize isolated HEX-55 native tenant namespaces #203

Merged

karsten merged 1 commit from hex-55/native-tenant-namespaces into main

2026-10-27 19:36:23 +00:00

karsten commented

2026-10-27 19:36:19 +00:00

Owner

Independent source-only review: homelab-ai-gateway/claude-sonnet-5-5, complete three-file base/candidate supplied, APPROVED for exact head 589eb04f1f. Report is attached verbatim below; no leader technical verdict. Original author evidence reused: 5 placement and 15 tenant checks and exact-pinned render 65 to 71 objects. Reviewer did not reproduce tests. Operator server-side dry-run of exact AppProject and workload-argocd Application passed. Hosted CI status is separately reconciled, not inferred green.

Normal merge is a watched-branch activation via existing automated foundation parent; same pinned foundation chart, only additive namespace/RBAC tenant inputs. Source merge, live adoption, new native release and actual business acceptance remain distinct.

Independent reviewer stdout:

VERDICT: APPROVED (source delta only; the author's render and test evidence is not reproduced)

CANDIDATE / SCOPE

Base dac96c7b737a96de8f203b093869e6051c604802, candidate 589eb04f1fe20e5735d1ced9d6d597252de764c0.
Files: config/workload-tenants/demo-apps.yml, scripts/render-workload-tenant-fragment.py, gitops/environments/assembly/spokes/demo-apps/foundations.yaml.
I compared the supplied full sources at both revisions with the supplied diff. The comparison was by reading, not by tool.

FINDINGS
None. Per-file results:

config/workload-tenants/demo-apps.yml (lines 18-19 in the candidate):
- The delta appends exactly liquio-im-hex55native and joget-im-hex55native to the govstore namespaces list.
- The seven existing namespaces keep their order.
- source_repos, namespace_rbac: true, catalog, foundation_revision: d5cd667a…, repository_url and the repo-server nodeSelector are unchanged.
- No new tenant is added.
foundations.yaml, AppProject (lines 34-35):
- Exactly two destinations are appended: {name: "demo-apps", namespace: "liquio-im-hex55native"} and {name: "demo-apps", namespace: "joget-im-hex55native"}.
- Both are pinned to the demo-apps destination cluster.
- The existing destinations, including the platform namespaces and argocd, are untouched.
- clusterResourceWhitelist is unchanged, so no cluster-scope widening.
- sourceRepos is unchanged.
foundations.yaml, workload-argocd Application (line 168):
- Only the tenants JSON changes, by the two appended namespaces.
- Their order matches the config, and the key order is still sorted as to_json emits.
- The argo-cd repo-server placement is unchanged.
- Every targetRevision still reads d5cd667a….
- All other Applications are unchanged.
render-workload-tenant-fragment.py (line 29):
- The only change is the exact-set assertion, widened from 7 to 9 names.
- Fail-deny is preserved.
  - The assertion is still set equality, so any other namespace fails.
  - The remaining guards are unchanged: the single-tenant assert, old == new apart from namespaces, old_ns <= new_ns, the pin and repoURL equality, the exact placement ValueError, and the generated-fragment equality check.
  - The check that the unrelated tail documents are unchanged is also untouched.
- The pin still comes from the pinned-commit template read via git show.
- The repo placement (scripts/, config/workload-tenants/, gitops/environments/assembly/spokes/demo-apps/) is unchanged.

CHECKS
None (no tools available; no commands run, no exit codes).

GAPS

The pinned charts/vendor/govstack-workload-argocd RBAC template was not inspected. Namespace isolation per namespace is therefore inferred from the existing seven namespaces using the same mechanism (namespace_rbac: true). The delta only adds list entries.
The author's results are not reproduced: the 5 placement + 15 tenant tests, the render from 65 to 71 objects (2 Namespaces + 4 RoleBindings), and the claim of no existing object loss. These are author evidence only.
The 6-object growth is consistent with 2 namespaces × (1 Namespace + 2 RoleBindings), but I did not verify it.
Manifest and hash verification was left to the operator.
This is not runtime or cluster acceptance.

MUTATIONS
None. The report file /srv/hex/hermes-home/cache/scratch/hex1064/namespace-review.txt was not written because no tools were available. This report is stdout only.

Add exactly two isolated namespaces for the commissioned new native HEX-55 releases: liquio-im-hex55native and joget-im-hex55native. Existing seven namespaces, foundation pins, tenant isolation and repo-server placement preserved. No legacy retry, credential provisioning or reset. Independent source-only review: homelab-ai-gateway/claude-sonnet-5-5, complete three-file base/candidate supplied, APPROVED for exact head 589eb04f1fe20e5735d1ced9d6d597252de764c0. Report is attached verbatim below; no leader technical verdict. Original author evidence reused: 5 placement and 15 tenant checks and exact-pinned render 65 to 71 objects. Reviewer did not reproduce tests. Operator server-side dry-run of exact AppProject and workload-argocd Application passed. Hosted CI status is separately reconciled, not inferred green. Normal merge is a watched-branch activation via existing automated foundation parent; same pinned foundation chart, only additive namespace/RBAC tenant inputs. Source merge, live adoption, new native release and actual business acceptance remain distinct. Independent reviewer stdout: **VERDICT: APPROVED** (source delta only; the author's render and test evidence is not reproduced) **CANDIDATE / SCOPE** - Base `dac96c7b737a96de8f203b093869e6051c604802`, candidate `589eb04f1fe20e5735d1ced9d6d597252de764c0`. - Files: `config/workload-tenants/demo-apps.yml`, `scripts/render-workload-tenant-fragment.py`, `gitops/environments/assembly/spokes/demo-apps/foundations.yaml`. - I compared the supplied full sources at both revisions with the supplied diff. The comparison was by reading, not by tool. **FINDINGS** None. Per-file results: - **`config/workload-tenants/demo-apps.yml` (lines 18-19 in the candidate):** - The delta appends exactly `liquio-im-hex55native` and `joget-im-hex55native` to the `govstore` namespaces list. - The seven existing namespaces keep their order. - `source_repos`, `namespace_rbac: true`, `catalog`, `foundation_revision: d5cd667a…`, `repository_url` and the repo-server `nodeSelector` are unchanged. - No new tenant is added. - **`foundations.yaml`, AppProject (lines 34-35):** - Exactly two destinations are appended: `{name: "demo-apps", namespace: "liquio-im-hex55native"}` and `{name: "demo-apps", namespace: "joget-im-hex55native"}`. - Both are pinned to the `demo-apps` destination cluster. - The existing destinations, including the platform namespaces and `argocd`, are untouched. - `clusterResourceWhitelist` is unchanged, so no cluster-scope widening. - `sourceRepos` is unchanged. - **`foundations.yaml`, workload-argocd Application (line 168):** - Only the `tenants` JSON changes, by the two appended namespaces. - Their order matches the config, and the key order is still sorted as `to_json` emits. - The `argo-cd` repo-server placement is unchanged. - Every `targetRevision` still reads `d5cd667a…`. - All other Applications are unchanged. - **`render-workload-tenant-fragment.py` (line 29):** - The only change is the exact-set assertion, widened from 7 to 9 names. - Fail-deny is preserved. - The assertion is still set equality, so any other namespace fails. - The remaining guards are unchanged: the single-tenant assert, `old == new` apart from namespaces, `old_ns <= new_ns`, the pin and `repoURL` equality, the exact placement `ValueError`, and the generated-fragment equality check. - The check that the unrelated tail documents are unchanged is also untouched. - The pin still comes from the pinned-commit template read via `git show`. - The repo placement (`scripts/`, `config/workload-tenants/`, `gitops/environments/assembly/spokes/demo-apps/`) is unchanged. **CHECKS** None (no tools available; no commands run, no exit codes). **GAPS** - The pinned `charts/vendor/govstack-workload-argocd` RBAC template was not inspected. Namespace isolation per namespace is therefore inferred from the existing seven namespaces using the same mechanism (`namespace_rbac: true`). The delta only adds list entries. - The author's results are not reproduced: the 5 placement + 15 tenant tests, the render from 65 to 71 objects (2 Namespaces + 4 RoleBindings), and the claim of no existing object loss. These are author evidence only. - The 6-object growth is consistent with 2 namespaces × (1 Namespace + 2 RoleBindings), but I did not verify it. - Manifest and hash verification was left to the operator. - This is not runtime or cluster acceptance. **MUTATIONS** None. The report file `/srv/hex/hermes-home/cache/scratch/hex1064/namespace-review.txt` was not written because no tools were available. This report is stdout only.

karsten added 1 commit

2026-10-27 19:36:19 +00:00