feat: tier_trial group + trial kill-switch + downgrade runbook (ADR 0036) #233

Sammanfogat

supernaut sammanfogade 1 incheckning från feat/tier-trial-group in i main

2026-07-28 13:08:54 +00:00

supernaut kommenterad

2026-07-28 12:22:12 +00:00

Ägare

What

Identity + reconciler + web wiring for the time-boxed sign-up trial (ADR 0036).

Implements bitborg-infra#232 (epic bitborg-docs#51).

Changes

Kanidm (roles/kanidm/defaults/main.yml): new tier_trial group, nested into ent_orgs,
ent_runners_shared and ent_runners_priority (same as tier_pro) so trial members get the
full paid capability set — quota + organisation creation + Actions.
Reconciler (roles/reconciler): render KANIDM_GROUP_TIER_TRIAL so the reconciler reads the
trial group and maps it to the paid quota group.
Web (roles/web + group_vars/all/vars.yml): KANIDM_TRIAL_GROUP and a TRIAL_OPEN runtime
kill switch (mirrors SIGNUPS_OPEN); document tier_participant as the non-trial baseline
(already the live value — the role default was just stale).
Runbook: a "Sign-up trial & end-of-August downgrade" section — the TRIAL_OPEN switch and an
idempotent, operator-gated batch that moves tier_trial members to tier_participant (the
reconciler then projects the zero-quota downgrade), with a hold-if-payments-slip caveat.

Testing

ansible-playbook site.yml --syntax-check passes; edited YAML/Markdown validated and prettier-clean.
Cadence intentionally unchanged (5 min) — see the epic/ADR 0036 discussion.

Rollout (user-gated, via infra-apply)

Apply the kanidm, reconciler and web roles together so the group exists, is projected, and the web
env references it. Pairs with the bitborg-auth-reconciler PR (KANIDM_GROUP_TIER_TRIAL is required
there). Nothing here has been applied to prod.

## What Identity + reconciler + web wiring for the time-boxed sign-up trial (ADR 0036). Implements bitborg-infra#232 (epic bitborg-docs#51). ## Changes - **Kanidm** (`roles/kanidm/defaults/main.yml`): new `tier_trial` group, nested into `ent_orgs`, `ent_runners_shared` and `ent_runners_priority` (same as `tier_pro`) so trial members get the full paid capability set — quota + organisation creation + Actions. - **Reconciler** (`roles/reconciler`): render `KANIDM_GROUP_TIER_TRIAL` so the reconciler reads the trial group and maps it to the `paid` quota group. - **Web** (`roles/web` + `group_vars/all/vars.yml`): `KANIDM_TRIAL_GROUP` and a `TRIAL_OPEN` runtime kill switch (mirrors `SIGNUPS_OPEN`); document `tier_participant` as the non-trial baseline (already the live value — the role default was just stale). - **Runbook:** a "Sign-up trial & end-of-August downgrade" section — the `TRIAL_OPEN` switch and an idempotent, operator-gated batch that moves `tier_trial` members to `tier_participant` (the reconciler then projects the zero-quota downgrade), with a hold-if-payments-slip caveat. ## Testing `ansible-playbook site.yml --syntax-check` passes; edited YAML/Markdown validated and prettier-clean. Cadence intentionally unchanged (5 min) — see the epic/ADR 0036 discussion. ## Rollout (user-gated, via infra-apply) Apply the kanidm, reconciler and web roles together so the group exists, is projected, and the web env references it. Pairs with the bitborg-auth-reconciler PR (`KANIDM_GROUP_TIER_TRIAL` is required there). Nothing here has been applied to prod.

supernaut lade till 1 incheckning

2026-07-28 12:22:12 +00:00

feat: add tier_trial group + trial kill-switch + downgrade runbook (ADR 0036)

ci / ci (pull_request) Successful in 1m32s

Detaljer

3cc71e7037

- kanidm: new tier_trial group, nested into ent_orgs/ent_runners_* like tier_pro
  so trial members get the full paid capability set
- reconciler: render KANIDM_GROUP_TIER_TRIAL so it reads the trial group as paid
- web: KANIDM_TRIAL_GROUP + TRIAL_OPEN kill-switch env; document tier_participant
  as the (already-live) non-trial baseline
- runbook: trial checkbox switch + end-of-August operator-gated downgrade procedure

Refs gitborg-infra#232, gitborg-docs#51

supernaut lade till etiketterna

2026-07-28 12:22:40 +00:00

supernaut sammanfogade incheckning f2d9ec6180 till main

2026-07-28 13:08:54 +00:00

supernaut tog bort grenen feat/tier-trial-group

2026-07-28 13:08:54 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-28 13:08:55 +00:00