tier_trial group + reconciler paid mapping + end-of-August downgrade runbook

supernaut kommenterad

2026-07-28 10:55:05 +00:00

Ägare

Part of the sign-up trial epic (bitborg-docs#51). See ADR 0036.

What

Identity + reconciler support for the time-boxed trial.

tier_trial Kanidm group: add it, and nest it into the same entitlement groups as the paid
tier (ent_orgs, ent_runners_shared, ent_runners_priority) so trial members inherit
organisation creation and Actions/CI without any reconciler special-casing.
Reconciler (bitborg-auth-reconciler): read the tier_trial group and map its members to the
paid quota group (and the pro Renovate cap). This is the only projection code change — org-create
and Actions come from the entitlement nesting above. Add the group name to reconciler config +
.env.example; render the env var from the Ansible role.
Downgrade runbook + script: an idempotent, operator-triggered batch that moves every
tier_trial member into the participant group (the reconciler then projects the zero-quota
downgrade within one run). Includes a dry-run and verification steps.

Cadence note

The reconciler timer stays at 5 minutes — a tighter cadence is not needed for the trial (expiry is a
one-off dated batch, not a poll). Rationale captured in the epic/ADR discussion.

Acceptance

A person added to tier_trial gets the paid quota group + org-create + Actions after one reconcile.
Emptying tier_trial (downgrade) moves members to the participant zero-quota group after one
reconcile, with org-create and Actions removed.
Reconciler unit tests cover the tier_trial → paid mapping.

Part of the sign-up trial epic (bitborg-docs#51). See ADR 0036. ## What Identity + reconciler support for the time-boxed trial. - **`tier_trial` Kanidm group**: add it, and nest it into the same entitlement groups as the paid tier (`ent_orgs`, `ent_runners_shared`, `ent_runners_priority`) so trial members inherit organisation creation and Actions/CI without any reconciler special-casing. - **Reconciler** (bitborg-auth-reconciler): read the `tier_trial` group and map its members to the `paid` quota group (and the pro Renovate cap). This is the only projection code change — org-create and Actions come from the entitlement nesting above. Add the group name to reconciler config + `.env.example`; render the env var from the Ansible role. - **Downgrade runbook + script**: an idempotent, operator-triggered batch that moves every `tier_trial` member into the participant group (the reconciler then projects the zero-quota downgrade within one run). Includes a dry-run and verification steps. ## Cadence note The reconciler timer stays at 5 minutes — a tighter cadence is not needed for the trial (expiry is a one-off dated batch, not a poll). Rationale captured in the epic/ADR discussion. ## Acceptance - A person added to `tier_trial` gets the paid quota group + org-create + Actions after one reconcile. - Emptying `tier_trial` (downgrade) moves members to the participant zero-quota group after one reconcile, with org-create and Actions removed. - Reconciler unit tests cover the `tier_trial` → paid mapping.

supernaut lade till etiketterna

area/identity

area/infra

ready-for-implementation

type

task

2026-07-28 10:55:53 +00:00

supernaut kommenterad

2026-07-28 16:16:45 +00:00

Upphovsperson

Ägare

Merged and deployed to production (2026-07-28). Verified live: sign-up trial checkbox + /trial-terms page serving, Kanidm tier_trial group present and read by the reconciler (GET /v1/group/tier_trial → 200), quota groups healthy, reconciler last_run_status=0 and fresh, no firing alerts. Closing.

supernaut stängde ärendet

2026-07-28 16:16:45 +00:00

supernaut lade till detta till projektet Bitborg Infrastructure

2026-07-28 16:17:59 +00:00

supernaut refererade till detta ärende

2026-07-30 22:34:16 +00:00

Execute the tier_trial → participant downgrade (operator-gated, 30-day notice first) #270

Rader
Kolumner

tier_trial group + reconciler paid mapping + end-of-August downgrade runbook #232

What

Cadence note

Acceptance