From ca49305cb517c8427c0c097676d53a2d99546dcd Mon Sep 17 00:00:00 2001 From: rcourtman Date: Mon, 30 Mar 2026 16:54:56 +0100 Subject: [PATCH] Add VMware vCenter proof record template --- .../VMWARE_VCENTER_PHASE1_ONBOARDING_SPEC.md | 2 + .../VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md | 9 + ...RE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md | 200 ++++++++++++++++++ .../VMWARE_VSPHERE_PHASE1_EXECUTION_PLAN.md | 2 + docs/release-control/v6/internal/status.json | 5 + 5 files changed, 218 insertions(+) create mode 100644 docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md diff --git a/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_ONBOARDING_SPEC.md b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_ONBOARDING_SPEC.md index 7d7727274..935fafa06 100644 --- a/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_ONBOARDING_SPEC.md +++ b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_ONBOARDING_SPEC.md @@ -196,6 +196,8 @@ The companion live-proof checklist for the first real environment is `docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md`. The current blocked proof record is `docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-blocked-2026-03-30.md`. +The success-record and capability-entry template is +`docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md`. The companion backend contract for implementation is `docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_API_RUNTIME_SPEC.md`. diff --git a/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md index 4c5a666f2..bceb9e2f7 100644 --- a/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md +++ b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md @@ -80,6 +80,11 @@ state with a dated proof record at: `docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-.md` +Use +`docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md` +to capture both the `LOCAL_CAPABILITIES.md` entry shape and the successful +proof record shape. + That dated record should summarize: 1. the environment alias and `LOCAL_CAPABILITIES.md` entry used @@ -258,6 +263,10 @@ The expected success-record path is: `docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-.md` +Use the companion template: + +`docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md` + ## Failure Rules Do not call VMware supported if any of these are true: diff --git a/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md new file mode 100644 index 000000000..e30d602d9 --- /dev/null +++ b/docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md @@ -0,0 +1,200 @@ +# VMware vCenter Phase-1 Proof Record Template + +Use this template when the first real VMware `vCenter` environment is available +and `VC-0` through `VC-7` from +`docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md` are +being exercised. + +Save successful proof records under: + +`docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-YYYY-MM-DD.md` + +Keep the blocked state in: + +`docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-blocked-2026-03-30.md` + +until the first successful real-environment pass is complete. + +## Required Capability Entry Shape + +Before writing the proof record, add a non-secret entry to +`/Volumes/Development/pulse/LOCAL_CAPABILITIES.md` using this shape: + +```md +### VMware vCenter () +- Purpose: live VMware vSphere phase-1 proof environment for Pulse platform-admission validation. +- Access: + - endpoint: `https://` + - operator path: `` +- Verification: + - `curl -kI https://` + - `` +- Expected floor: + - at least one ESXi host + - at least one VM + - at least one datastore + - recent event or task history visible through `vCenter` + - ideally one VM snapshot for snapshot-tree visibility proof +- Secret location alias: + - `.md>` +- Safe-use notes: + - `` +``` + +Do not record usernames, passwords, tokens, certificate contents, private keys, +or raw inventory identifiers that should remain private. + +## Successful Proof Record Template + +--- + +# VMware vCenter Phase-1 Proof Record + +- Date: `YYYY-MM-DD` +- Candidate lane: `platform-admission-execution` +- Platform: `vmware-vsphere` +- Result: `pass` or `fail` + +## Environment + +- Environment alias: `...` +- `LOCAL_CAPABILITIES.md` entry heading: `...` +- `vCenter` URL or host label: `...` +- `vCenter` version/build: `...` +- Operator: `...` +- Proof scope: + - `vCenter` only + - API-first + - read-first + +## Privilege Bundle + +- Service-account role name or bundle label: `...` +- Source of privilege bundle definition: `...` +- Notes on any privilege uncertainty that remains: `...` + +## Automated Proof Baseline + +- `/api/vmware/connections*` contract tests: `pass` or `fail` +- VMware projection/runtime tests: `pass` or `fail` +- Shared alerts/history tests: `pass` or `fail` +- Assistant-read classification tests: `pass` or `fail` +- Notes: + - `...` + +## Capability Registration (`VC-0`) + +Steps run: + +1. `...` +2. `...` + +Observed: + +- capability entry present: `yes` or `no` +- non-secret environment label captured: `yes` or `no` +- safe verification command works: `yes` or `no` + +## Draft Connection Test (`VC-1`) + +Steps run: + +1. `...` +2. `...` + +Observed: + +- draft test result: `...` +- failure classification exercise performed: `yes` or `no` +- green result required both API families: `yes` or `no` +- notes: `...` + +## Saved Connection Retest (`VC-2`) + +Steps run: + +1. `...` +2. `...` + +Observed: + +- masked-secret preservation: `pass` or `fail` +- saved-connection retest without secret re-entry: `pass` or `fail` +- connection-list health refreshed: `pass` or `fail` +- notes: `...` + +## Inventory Projection Floor (`VC-3`) + +Observed: + +- ESXi hosts projected as `agent`: `pass` or `fail` +- VMs projected as `vm`: `pass` or `fail` +- datastores projected as `storage`: `pass` or `fail` +- provider-local top-level types absent: `pass` or `fail` +- notes: `...` + +## Storage And Snapshot Visibility (`VC-4`) + +Observed: + +- datastore capacity/free-space visibility: `pass` or `fail` +- datastore accessibility visibility: `pass` or `fail` +- snapshot-tree visibility: `pass`, `fail`, or `n/a` +- recovery claim remained out of scope: `yes` or `no` +- notes: `...` + +## Alerts And History Floor (`VC-5`) + +Observed: + +- shared alert/incident surfacing works: `pass` or `fail` +- VMware-backed event/task context reachable on shared paths: `pass` or `fail` +- provider-local alarm/history shell absent: `pass` or `fail` +- notes: `...` + +## Assistant Read Floor (`VC-6`) + +Observed: + +- `agent` inspection works: `pass` or `fail` +- `vm` inspection works: `pass` or `fail` +- `storage` inspection works: `pass` or `fail` +- VMware-specific tools not required: `pass` or `fail` +- control remained absent: `pass` or `fail` +- notes: `...` + +## Exclusion Integrity (`VC-7`) + +Observed: + +- direct `ESXi` still excluded: `yes` or `no` +- unified-agent-required bootstrap still excluded: `yes` or `no` +- recovery support still excluded: `yes` or `no` +- assistant control still read-only / absent: `yes` or `no` +- broader VMware admin-plane promises absent: `yes` or `no` + +## Captured Evidence + +- connection-list screenshots or payloads: `...` +- canonical `agent` / `vm` / `storage` evidence: `...` +- alerts / incidents / history evidence: `...` +- Assistant read transcript or screenshots: `...` +- version/build evidence: `...` +- privilege bundle evidence: `...` + +## Outcome + +- `pass` or `fail` +- Support claim status: + - `still blocked` + - `ready to ratchet` +- Summary: + - `...` + - `...` + - `...` + +## Follow-Ups + +- `none`, or: + - `...` + - `...` diff --git a/docs/release-control/v6/internal/VMWARE_VSPHERE_PHASE1_EXECUTION_PLAN.md b/docs/release-control/v6/internal/VMWARE_VSPHERE_PHASE1_EXECUTION_PLAN.md index 5140cd691..486dce998 100644 --- a/docs/release-control/v6/internal/VMWARE_VSPHERE_PHASE1_EXECUTION_PLAN.md +++ b/docs/release-control/v6/internal/VMWARE_VSPHERE_PHASE1_EXECUTION_PLAN.md @@ -179,6 +179,7 @@ Owners: Companion proof matrix: - `docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md` +- `docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md` - `docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_RESOURCE_PROJECTION_SPEC.md` - `docs/release-control/v6/internal/records/vmware-vcenter-phase1-proof-blocked-2026-03-30.md` @@ -188,6 +189,7 @@ Deliver: - minimum privilege bundle documented - explicit phase-1 exclusions documented in support language - support matrix changed only after live proof exists +- successful proof record written from the shared VMware proof template - blocked proof state replaced by a dated successful proof record only after the first real `vCenter` pass diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index 925f5e101..d6de5228b 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -3571,6 +3571,11 @@ "path": "docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_MATRIX.md", "kind": "file" }, + { + "repo": "pulse", + "path": "docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_PROOF_RECORD_TEMPLATE.md", + "kind": "file" + }, { "repo": "pulse", "path": "docs/release-control/v6/internal/VMWARE_VCENTER_PHASE1_RESOURCE_PROJECTION_SPEC.md",