diff --git a/CLAUDE.md b/CLAUDE.md index 4fda74a..40624fa 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -38,7 +38,7 @@ org-level operator tooling that governs the rest of the fleet. - **`terraform/`** — the fleet's GitHub settings as Terraform (`integrations/github`). Owns repo **existence** and identity, merge options, the topic spine, per-repo `main` rulesets, required checks, and the label - palette across all 15 org repos. Adding a repo to `fleet-ops/repos.json` and + palette across every org repo. Adding a repo to `fleet-ops/repos.json` and applying creates it; removing one is refused by `prevent_destroy`. Applies are **CI-run on merge to `main`** (phase 2, live 2026-08-17 — plan-on-PR posts to the PR, `gate` is required, Dependabot PRs skip plan by design). **Read `terraform/README.md` § Rails before touching it.** diff --git a/README.md b/README.md index cbf948a..a54682d 100644 --- a/README.md +++ b/README.md @@ -70,7 +70,9 @@ Tidewater label palette — across every repo in the org. Adding a repo to [`fleet-ops/repos.json`](fleet-ops/repos.json) and applying creates it, scaffolded from `repo-template` and wired to fleet policy from its first second. Removing one is refused by `prevent_destroy` rather than deleting -a live repository. Applies are operator-run today; apply-on-merge is phase 2. +a live repository. A merge to `main` **is** an apply: `plan` posts to every +tf-touching PR, the required `gate` check blocks a red plan, and `apply` runs on +merge (phase 2, live 2026-08-17). See [`terraform/README.md`](terraform/README.md). ### [`fleet-ops/`](fleet-ops/) @@ -153,10 +155,10 @@ This is a lab — the systems are real, the stakes are not. Pick a vector: **Add a fleet-wide required status check.** Edit [`fleet-ops/required-checks.json`](fleet-ops/required-checks.json) to add a check context for one repo or all of them, and open a PR — [`ci/validate.py`](ci/validate.py) -validates the JSON shape before it can merge. Once merged, an operator applies the +validates the JSON shape before it can merge. Once merged, CI applies the change with the [`terraform/`](terraform/) module, which reads that same JSON and owns -rulesets, required checks, and labels (applies are operator-run with an admin token in -phase 1 — see [`terraform/README.md`](terraform/README.md); `fleet-apply.sh` still +rulesets, required checks, and labels (apply-on-merge is live — phase 2, see +[`terraform/README.md`](terraform/README.md); `fleet-apply.sh` still contributes the required-context preflight, proving a check context actually reports before anything requires it). This is the same JSON-then-apply flow used repeatedly to roll checks across the fleet. @@ -167,9 +169,10 @@ roll checks across the fleet. **Migrate a settings surface to Terraform.** Extend the `terraform/*.tf` modules, which read the same `fleet-ops/*.json`, and open a PR — [`.github/workflows/terraform.yml`](.github/workflows/terraform.yml) runs `fmt` + -`validate` on it. The apply is still operator-run locally today (phase 1); apply-on-merge -is the planned phase 2 tracked in [`terraform/README.md`](terraform/README.md), so don't -expect a merge here to mutate GitHub settings yet. +`validate` and posts a `plan` to the PR, with the required `gate` check blocking a red +plan. Merging **is** the apply (phase 2, live 2026-08-17 — see +[`terraform/README.md`](terraform/README.md)): whatever is on `main` is the live fleet +settings, so a merge here really does mutate GitHub settings across the org. **Proof this works:** [PR #82 — Manage the fleet's GitHub settings with the Terraform GitHub provider](https://github.com/lentago/.github/pull/82), [PR #83 — terraform: rename the validate job to tf-validate](https://github.com/lentago/.github/pull/83). diff --git a/profile/README.md b/profile/README.md index e7a6dd8..9e58830 100644 --- a/profile/README.md +++ b/profile/README.md @@ -41,9 +41,10 @@ Everything is code. Every change is a pull request. Merges apply automatically. | [**drosera**](https://github.com/lentago/drosera) | your Grafana Cloud dashboards and alerts | | [**kalmia**](https://github.com/lentago/kalmia) | every Proxmox VM and LXC in the homelab | | [**claytonia**](https://github.com/lentago/claytonia) | the agent runner pool itself | +| [**osmunda**](https://github.com/lentago/osmunda) | the k3s cluster's workloads — Flux pulls the merge | | [**solidago**](https://github.com/lentago/solidago) | the AWS platform | | site repos | the live sites | -| [**.github**](https://github.com/lentago/.github) | repo settings and rulesets, via `fleet-ops` | +| [**.github**](https://github.com/lentago/.github) | every repo's rulesets, required checks, and labels, via `terraform/` | ### 🧰   What the estate is built on @@ -81,6 +82,10 @@ Everything is code. Every change is a pull request. Merges apply automatically. Reference three-tier AWS platform — 100% Terraform: VPC, ECS Fargate, RDS, WAF. +  osmunda
DeepWiki ↗ +Kubernetes platform — standing k3s on lab guests, an ephemeral EKS overlay, Flux GitOps throughout. + +   drosera
DeepWiki ↗ Git-driven observability into Grafana Cloud — one Alloy container, Terraform-provisioned dashboards. @@ -97,6 +102,10 @@ Everything is code. Every change is a pull request. Merges apply automatically. Full-volume log capture & archive → Axiom, at zero query cost. +  monarda
DeepWiki ↗ +Campaign-site kit — an Astro template, intake, and a timed dry-run, deploying to the client's own GitHub Pages or S3. + +   asclepias
DeepWiki ↗ The field guide — operations manual, day-one path, hands-on labs. @@ -120,22 +129,23 @@ Three ways in, depending on why you're here. 1. [**solidago**](https://github.com/lentago/solidago) — the reference AWS platform, 100% Terraform. 2. [**claytonia**](https://github.com/lentago/claytonia) — the self-hosted agent fleet that does the directed work. -3. [**homeassistant-config**](https://github.com/lentago/homeassistant-config) — physical-world monitoring, version-controlled. +3. [**epigaea**](https://github.com/lentago/epigaea) — physical-world monitoring, version-controlled. Then the [incident register](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) for how things break, and the [field-guide glossary](https://github.com/lentago/asclepias/blob/main/manual/glossary.md) to map it all onto enterprise practice. **Evaluating the practice**  (mission-driven organizations) 1. **The pledge** (above) — you own every piece, we teach your people, firing us is a runbook. -2. [**site-pondviewlane-com**](https://github.com/lentago/site-pondviewlane-com) — a community organization's public-record fact base with a grounded Ask box. -3. [**homeassistant-config**](https://github.com/lentago/homeassistant-config) — physical-world monitoring on a donated-scale budget. -4. [**Incident register**](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) — post-mortems published verbatim. +2. [**monarda**](https://github.com/lentago/monarda) — the campaign-site kit: a fundraising site in a day, deployed into *your* GitHub or AWS account. +3. [**site-pondviewlane-com**](https://github.com/lentago/site-pondviewlane-com) — a community organization's public-record fact base with a grounded Ask box. +4. [**epigaea**](https://github.com/lentago/epigaea) — physical-world monitoring on a donated-scale budget. +5. [**Incident register**](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) — post-mortems published verbatim. ### 📊   Fleet in numbers Regenerated weekly from the repos themselves — we operate in the open. -- **[Fleet report](https://github.com/lentago/.github/blob/main/fleet-reports/fleet-report.md)** — open issues by repo, a 7-day activity snapshot, and a code census that counts the `CLAUDE.md`-family instruction files as natural-language code. +- **[Fleet report](https://github.com/lentago/.github/blob/main/fleet-reports/fleet-report.md)** — open issues by repo, a 30-day activity snapshot, and a code census that counts the `CLAUDE.md`-family instruction files as natural-language code. - **[Language census](https://github.com/lentago/.github/blob/main/metrics/language-census.md)** — the canonical all-languages breakdown. - **[Incident register](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md)** — post-mortems from lab operations, with what broke, what did *not*, and the governance lessons. - **[Lock-in ledger](https://github.com/lentago/.github/blob/main/fleet-reports/lock-in-ledger.md)** — our own vendor dependencies, each scored on export fidelity, format openness, custody, and a documented exit. The receipt behind *"firing us is a runbook."*