docs(adr): 0035 extract the Kanidm-Forgejo reconciler (proposed) #48

Sammanfogat

supernaut sammanfogade 1 incheckning från adr-0035-extract-reconciler in i main

2026-07-25 05:49:28 +00:00

supernaut kommenterad

2026-07-24 10:01:12 +00:00

Ägare

Proposes extracting the Kanidm→Forgejo entitlement reconciler out of bitborg-infra's
Ansible-templated bash role into its own first-class, unit-tested service/repo (gitborg/reconciler,
TypeScript, OCI images via the Forgejo registry). Kanidm stays the entitlement source of truth and the
reconciler stays a pure one-way Kanidm→Forgejo projector.

Why: domain/business logic (tier→entitlement rules) currently lives in the IaC repo with no
realistic unit-test story and unclear ownership.
Migration: faithful TS port with matching tests → dry-run parallel-run alongside the existing
bash timer → diff proposed actions → cut over → remove the old role. Idempotent, so double-running
during burn-in is safe; backout = re-enable the old timer.
Follows the ADR 0033 (runner-controller) extraction precedent. Status: Proposed — for review.

Proposes extracting the **Kanidm→Forgejo entitlement reconciler** out of bitborg-infra's Ansible-templated bash role into its own first-class, unit-tested service/repo (`gitborg/reconciler`, TypeScript, OCI images via the Forgejo registry). Kanidm stays the entitlement source of truth and the reconciler stays a pure one-way Kanidm→Forgejo projector. - **Why:** domain/business logic (tier→entitlement rules) currently lives in the IaC repo with no realistic unit-test story and unclear ownership. - **Migration:** faithful TS port with matching tests → dry-run parallel-run alongside the existing bash timer → diff proposed actions → cut over → remove the old role. Idempotent, so double-running during burn-in is safe; backout = re-enable the old timer. - Follows the ADR 0033 (runner-controller) extraction precedent. Status: **Proposed** — for review.

supernaut lade till 1 incheckning

2026-07-24 10:01:12 +00:00