Skip to content

feat(kits): add missing infrastructure kits #225

Closed
Closed
feat(kits): add missing infrastructure kits#225
Labels
cross-repoCoordinates or depends on delivery in another repositoryin-progressAn agent is actively working this issue via /implementuser-facingDirectly changes a user journey or user-visible outcome

Description

@Brad-Edwards
Brad-Edwards
opened on Aug 1, 2026

Outcome

These infrastructure kits exist, in the same shape as the released ones — a node, a software source, its ports, and a seed inventory.

Kits

  • Certificate authority — step-ca
  • DHCP / IPAM — kea
  • Secrets store — openbao
  • Message broker — rabbitmq
  • Cache / key-value — valkey
  • Firewall / NAT — nftables
  • LDAP directory, non-AD — openldap
  • Container orchestration — k3s

Load balancer: check whether infrastructure.reverse-proxy-api-gateway already covers it before adding one.

Activity

  1. Brad-Edwards
    added
    cross-repoCoordinates or depends on delivery in another repository
    user-facingDirectly changes a user journey or user-visible outcome
    on Aug 1, 2026
  2. Brad-Edwards
    changed the title [-]consider(kits): qualify missing broadly useful environment primitives[/-] [+]feat(kits): add missing infrastructure kits[/+] on Sep 20, 2026
  3. Brad-Edwards
    added
    in-progressAn agent is actively working this issue via /implement
    on Sep 20, 2026

  4. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    🛠️ Picked up by /implement - driver codex, branch 225-add-infrastructure-kits, 2026-09-20T00:28:15.388Z.

  5. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    gc workflow phase recorded: preflight (issue #225). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

  6. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    gc workflow phase recorded: plan (issue #225). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

    Outcome and scope

    Publish eight independent 1.0.0 infrastructure kit releases under kits/: certificate authority (step-ca), DHCP/IPAM (kea), secrets store (openbao), message broker (rabbitmq), cache/key-value store (valkey), firewall/NAT (nftables), non-AD LDAP directory (openldap), and container orchestration (k3s). The existing infrastructure.reverse-proxy-api-gateway already provides Traefik HTTP/HTTPS listeners and upstream-binding seed inventory, so it covers the requested load-balancer check without a duplicate kit.

    Implementation

    • Path A for each of the eight kit clauses: First add a failing published-kit test for exact identity, product source, honest declared service ports, domain parameter variation, benign seed inventory, and RAES composition. Raise the expected catalog count from 38 to 46 and include the new modules in representative multi-kit composition. Confirm the test fails because the releases are absent.
    • Add each release's module.sdl.yaml, kit.yaml, README.md, assets/seed.yaml, assets/integration.md, tests/composition.yaml, and associated-artifacts.json. Follow the existing release contract and the RAES 5.0.0 SDL/module parser; use capability-oriented IDs, a product node.source, a node, applicable named Node.services, an exported content.seed_inventory with at least three benign objects, shared and domain parameters, and an explicit realization constraint. Keep each release self-contained and its artifact checksums and semantic parent digest exact.
    • Path A for the load-balancer check: Add a focused assertion that the existing reverse-proxy release retains Traefik, HTTP/HTTPS services, and upstream-binding seed inventory. No ninth kit.
    • Keep nftables policy ports in seed/network context; nftables itself has no listener. Declare optional management, cluster, TLS, or overlay ports only when the module explicitly models that surface. Keep inter-kit relationships at the consuming pack root. Do not add new SDL, kit, catalog, or backend semantics.

    Repository boundaries and risks

    The RAES SDL spec owns nodes, sources, services, variables, module exports/imports, and content; the kit carrier owns only release metadata and assets. The existing load_kit_release(), strict readers, safe file admission, source/component inventory, and RAES associated-artifact validation remain the gates. No secret material or credential-shaped parameter enters CA, secrets, broker, LDAP, or k3s assets. The modules assert static authoring state, not launch, policy enforcement, live listeners, or backend readiness. Future variation stays at a domain parameter and pack-root integration seam.

    Verification

    Run the new targeted test red then green, the existing published-kit and kit-contract tests, RAES default/variation and multi-kit composition, and the repository checks required by AGENTS.md. Review every artifact manifest against the exact release file inventory. The preflight note at docs/development/missing-infrastructure-kits-preflight.md records the architecture guardrails.

  7. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    gc_codex_review — sanitized deferred publication for issue #225, cycle 1 of 1
    Reviewed revision: 620c3cb0f29eacf9aafcc88625d9b87137a9827300e6629fb7c76b0575614c2e

    Architectural read

    The eight static kit releases use existing RAES modules and the repository's kit manifest and artifact-binding contracts. Review covered all 58 staged files and found no architectural or security findings.

    Verdict: ship

    Findings

    • (none)

  8. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    gc_codex_review pre-push cycle 1 of 1 complete for issue #225 on branch '225-add-infrastructure-kits'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

  9. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    Review decision record — codex cycle 1 (issue #225)

    Reviewer: codex
    Cycle: 1
    Verdict: ship

    Architectural read:

    The eight static kit releases use existing RAES modules and the repository's kit manifest and artifact-binding contracts. Review covered all 58 staged files and found no architectural or security findings.

    Blocking findings: 0 (clean run)

  10. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at 443248d9e236c6b10cc62b01a4f8a87d663ff9eb
    • Outcome: already_current
    • Published feature head: 45cd9e3d80e8b657e19f255af684d21d858f94b5
    • Synchronized tree: de92aa6da40b0eb6313e00e5b81eb7193c482c41

  11. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    Ready for review — issue #225

    PR: #383
    Plan: #225 (comment)

    Outcome

    Scenario authors can compose eight additional infrastructure services into RAES environment packs using published, validated kits. The existing reverse-proxy kit continues to cover load balancing.

    Files changed

    Added:

    • docs/development/missing-infrastructure-kits-preflight.md
    • kits/infrastructure.cache-key-value-store/1.0.0/README.md
    • kits/infrastructure.cache-key-value-store/1.0.0/assets/integration.md
    • kits/infrastructure.cache-key-value-store/1.0.0/assets/seed.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/associated-artifacts.json
    • kits/infrastructure.cache-key-value-store/1.0.0/kit.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/module.sdl.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/tests/composition.yaml
    • kits/infrastructure.certificate-authority/1.0.0/README.md
    • kits/infrastructure.certificate-authority/1.0.0/assets/integration.md
    • kits/infrastructure.certificate-authority/1.0.0/assets/seed.yaml
    • kits/infrastructure.certificate-authority/1.0.0/associated-artifacts.json
    • kits/infrastructure.certificate-authority/1.0.0/kit.yaml
    • kits/infrastructure.certificate-authority/1.0.0/module.sdl.yaml
    • kits/infrastructure.certificate-authority/1.0.0/tests/composition.yaml
    • kits/infrastructure.container-orchestration/1.0.0/README.md
    • kits/infrastructure.container-orchestration/1.0.0/assets/integration.md
    • kits/infrastructure.container-orchestration/1.0.0/assets/seed.yaml
    • kits/infrastructure.container-orchestration/1.0.0/associated-artifacts.json
    • kits/infrastructure.container-orchestration/1.0.0/kit.yaml
    • kits/infrastructure.container-orchestration/1.0.0/module.sdl.yaml
    • kits/infrastructure.container-orchestration/1.0.0/tests/composition.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/README.md
    • kits/infrastructure.dhcp-ipam-service/1.0.0/assets/integration.md
    • kits/infrastructure.dhcp-ipam-service/1.0.0/assets/seed.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/associated-artifacts.json
    • kits/infrastructure.dhcp-ipam-service/1.0.0/kit.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/module.sdl.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/tests/composition.yaml
    • kits/infrastructure.firewall-nat/1.0.0/README.md
    • kits/infrastructure.firewall-nat/1.0.0/assets/integration.md
    • kits/infrastructure.firewall-nat/1.0.0/assets/seed.yaml
    • kits/infrastructure.firewall-nat/1.0.0/associated-artifacts.json
    • kits/infrastructure.firewall-nat/1.0.0/kit.yaml
    • kits/infrastructure.firewall-nat/1.0.0/module.sdl.yaml
    • kits/infrastructure.firewall-nat/1.0.0/tests/composition.yaml
    • kits/infrastructure.ldap-directory/1.0.0/README.md
    • kits/infrastructure.ldap-directory/1.0.0/assets/integration.md
    • kits/infrastructure.ldap-directory/1.0.0/assets/seed.yaml
    • kits/infrastructure.ldap-directory/1.0.0/associated-artifacts.json
    • kits/infrastructure.ldap-directory/1.0.0/kit.yaml
    • kits/infrastructure.ldap-directory/1.0.0/module.sdl.yaml
    • kits/infrastructure.ldap-directory/1.0.0/tests/composition.yaml
    • kits/infrastructure.message-broker/1.0.0/README.md
    • kits/infrastructure.message-broker/1.0.0/assets/integration.md
    • kits/infrastructure.message-broker/1.0.0/assets/seed.yaml
    • kits/infrastructure.message-broker/1.0.0/associated-artifacts.json
    • kits/infrastructure.message-broker/1.0.0/kit.yaml
    • kits/infrastructure.message-broker/1.0.0/module.sdl.yaml
    • kits/infrastructure.message-broker/1.0.0/tests/composition.yaml
    • kits/infrastructure.secrets-store/1.0.0/README.md
    • kits/infrastructure.secrets-store/1.0.0/assets/integration.md
    • kits/infrastructure.secrets-store/1.0.0/assets/seed.yaml
    • kits/infrastructure.secrets-store/1.0.0/associated-artifacts.json
    • kits/infrastructure.secrets-store/1.0.0/kit.yaml
    • kits/infrastructure.secrets-store/1.0.0/module.sdl.yaml
    • kits/infrastructure.secrets-store/1.0.0/tests/composition.yaml

    Modified:

    • docs/development/kits-integration-runbook.md
    • tests/test_published_kits.py
    • tests_integration/kit_author_walkthrough.py

    Reviews

    • codex: Clean pre-push review of the kit implementation; no findings.

    Traceability reconciliation

    • Pending — requirement status transition and IMPLEMENTS/TESTS reconciliation run in Phase E once the PR merges.

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge. Ground Control reconciliation (requirement status + traceability) runs on merge (Phase E).

  12. Brad-Edwards commented on Sep 20, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 20, 2026
    CollaboratorAuthor

    Final report — issue #225 complete

    PR: #383
    Plan: #225 (comment)

    Outcome

    Scenario authors can compose eight additional infrastructure services into RAES environment packs using published, validated kits. The existing reverse-proxy kit continues to cover load balancing.

    Files changed

    Added:

    • docs/development/missing-infrastructure-kits-preflight.md
    • kits/infrastructure.cache-key-value-store/1.0.0/README.md
    • kits/infrastructure.cache-key-value-store/1.0.0/assets/integration.md
    • kits/infrastructure.cache-key-value-store/1.0.0/assets/seed.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/associated-artifacts.json
    • kits/infrastructure.cache-key-value-store/1.0.0/kit.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/module.sdl.yaml
    • kits/infrastructure.cache-key-value-store/1.0.0/tests/composition.yaml
    • kits/infrastructure.certificate-authority/1.0.0/README.md
    • kits/infrastructure.certificate-authority/1.0.0/assets/integration.md
    • kits/infrastructure.certificate-authority/1.0.0/assets/seed.yaml
    • kits/infrastructure.certificate-authority/1.0.0/associated-artifacts.json
    • kits/infrastructure.certificate-authority/1.0.0/kit.yaml
    • kits/infrastructure.certificate-authority/1.0.0/module.sdl.yaml
    • kits/infrastructure.certificate-authority/1.0.0/tests/composition.yaml
    • kits/infrastructure.container-orchestration/1.0.0/README.md
    • kits/infrastructure.container-orchestration/1.0.0/assets/integration.md
    • kits/infrastructure.container-orchestration/1.0.0/assets/seed.yaml
    • kits/infrastructure.container-orchestration/1.0.0/associated-artifacts.json
    • kits/infrastructure.container-orchestration/1.0.0/kit.yaml
    • kits/infrastructure.container-orchestration/1.0.0/module.sdl.yaml
    • kits/infrastructure.container-orchestration/1.0.0/tests/composition.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/README.md
    • kits/infrastructure.dhcp-ipam-service/1.0.0/assets/integration.md
    • kits/infrastructure.dhcp-ipam-service/1.0.0/assets/seed.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/associated-artifacts.json
    • kits/infrastructure.dhcp-ipam-service/1.0.0/kit.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/module.sdl.yaml
    • kits/infrastructure.dhcp-ipam-service/1.0.0/tests/composition.yaml
    • kits/infrastructure.firewall-nat/1.0.0/README.md
    • kits/infrastructure.firewall-nat/1.0.0/assets/integration.md
    • kits/infrastructure.firewall-nat/1.0.0/assets/seed.yaml
    • kits/infrastructure.firewall-nat/1.0.0/associated-artifacts.json
    • kits/infrastructure.firewall-nat/1.0.0/kit.yaml
    • kits/infrastructure.firewall-nat/1.0.0/module.sdl.yaml
    • kits/infrastructure.firewall-nat/1.0.0/tests/composition.yaml
    • kits/infrastructure.ldap-directory/1.0.0/README.md
    • kits/infrastructure.ldap-directory/1.0.0/assets/integration.md
    • kits/infrastructure.ldap-directory/1.0.0/assets/seed.yaml
    • kits/infrastructure.ldap-directory/1.0.0/associated-artifacts.json
    • kits/infrastructure.ldap-directory/1.0.0/kit.yaml
    • kits/infrastructure.ldap-directory/1.0.0/module.sdl.yaml
    • kits/infrastructure.ldap-directory/1.0.0/tests/composition.yaml
    • kits/infrastructure.message-broker/1.0.0/README.md
    • kits/infrastructure.message-broker/1.0.0/assets/integration.md
    • kits/infrastructure.message-broker/1.0.0/assets/seed.yaml
    • kits/infrastructure.message-broker/1.0.0/associated-artifacts.json
    • kits/infrastructure.message-broker/1.0.0/kit.yaml
    • kits/infrastructure.message-broker/1.0.0/module.sdl.yaml
    • kits/infrastructure.message-broker/1.0.0/tests/composition.yaml
    • kits/infrastructure.secrets-store/1.0.0/README.md
    • kits/infrastructure.secrets-store/1.0.0/assets/integration.md
    • kits/infrastructure.secrets-store/1.0.0/assets/seed.yaml
    • kits/infrastructure.secrets-store/1.0.0/associated-artifacts.json
    • kits/infrastructure.secrets-store/1.0.0/kit.yaml
    • kits/infrastructure.secrets-store/1.0.0/module.sdl.yaml
    • kits/infrastructure.secrets-store/1.0.0/tests/composition.yaml

    Modified:

    • docs/development/kits-integration-runbook.md
    • tests/test_published_kits.py
    • tests_integration/kit_author_walkthrough.py

    Reviews

    • codex: Clean pre-push review of the kit implementation; no findings.

    Traceability reconciliation

    • IMPLEMENTS / TESTS / DOCUMENTS added: 0
    • Links updated: 0
    • Stale links removed: 0

    Issue #225 has no requirement UIDs; tests and composition coverage are linked in the PR.

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge.
  13. Brad-Edwards
    closed this as completedon Sep 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cross-repoCoordinates or depends on delivery in another repositoryin-progressAn agent is actively working this issue via /implementuser-facingDirectly changes a user journey or user-visible outcome

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions