certctl

mirror of https://github.com/shankar0123/certctl.git synced 2026-06-07 16:01:30 +00:00

Files

T

shankar0123 264015059d ci(guards): fix G-3 (CERTCTL_MCP_READ_ONLY phantom) + S-1 (hardcoded 45)

Two CI guards tripped on the B4 + B5 closure commits:

1. G-3 env-docs-drift caught `CERTCTL_MCP_READ_ONLY` mentioned in
   docs/operator/security-bundle-5-audit-closure.md (Bundle 5 S8
   row) without a corresponding entry in internal/config/config.go.
   The env var is a v3 idea, not a shipped feature — the doc now
   describes the future gate without naming the literal env var,
   matching the G-3 phantom-env-var contract.

2. S-1 hardcoded-source-counts caught "all 45 migrations" in
   docs/operator/scheduler-ha.md (Bundle 4 D8 closure prose). Per
   the CLAUDE.md operating rule "Numeric claims about current state
   rot", swapped the literal count for the rebuild command
   `ls migrations/*.up.sql | wc -l`.

Both fixes are doc-only — no code change, no test change. The
underlying Bundle 4 + Bundle 5 closures stand.

Verification:
  bash scripts/ci-guards/G-3-env-docs-drift.sh            # clean
  bash scripts/ci-guards/S-1-hardcoded-source-counts.sh   # clean

2026-05-13 01:24:06 +00:00

oidc-runbooks

docs: v2.1.0 release polish — strip internal bundle/phase tags, update status for OIDC ship

2026-05-11 16:54:07 +00:00

runbooks

docs: v2.1.0 release polish — strip internal bundle/phase tags, update status for OIDC ship

2026-05-11 16:54:07 +00:00

approval-workflow.md

docs: retire compliance subtree + sweep framework name-drops from prose

2026-05-05 05:26:44 +00:00

auth-benchmarks.md

docs: v2.1.0 release polish — strip internal bundle/phase tags, update status for OIDC ship