docs(adr): 0022 — spaces-key plan Tasks 5+6 land as no-op confirmation#586
Merged
Conversation
Records the closeout for Tasks 5+6 of the spaces-key-iac-resource plan (docs/plans/2026-05-08-spaces-key-iac-resource.md, commit 316559f7). The plan's PR2 was specified as a migration of core-dump/infra.yaml from a two-entry SPACES_access_key/SPACES_secret_key provider_credential schema to canonical single-entry. At impl time, verification against origin/main HEAD 3bb46833 showed the file already had the canonical shape — the migration had landed in PR #190 (TC1 cutover) or PR #194 (TC2 cutover) before the plan was authored. Smoke-confirmed: `wfctl infra align --strict -c infra.yaml --env staging` returns exit 0 with "No alignment issues found." — no R-A9 firing because there's nothing to fire on. Tasks 5+6 are marked completed as a no-op confirmation. PR1's R-A9 severity flip (workflow #583, merged) provides the ongoing regression protection: any future reintroduction of the two-entry shape will hit ERROR R-A9 at align-strict time, exit 1. ADR also captures the planner-blindspot lesson (operator memory about file shapes is unreliable; re-fetch origin/main before locking a plan that mutates external repo files) for the post-merge retro. Per team-lead's user-direction routing of the (a/b/c) options I had surfaced. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds ADR 0022 to document that “spaces-key-iac-resource” plan Tasks 5+6 (intended core-dump/infra.yaml migration) were already completed in earlier cutover PRs, so the planned PR2 lands as a no-op confirmation.
Changes:
- Add a new ADR under
decisions/explaining the no-op resolution for Tasks 5+6 and the evidence (wfctl infra align --strictpass) supporting it. - Capture lessons learned about re-verifying
origin/mainHEAD before locking plans that mutate external repos.
| @@ -0,0 +1,192 @@ | |||
| # 0022: Spaces-key plan Tasks 5+6 land as no-op confirmation | |||
Comment on lines
+90
to
+94
| the two-entry pattern in any `infra.yaml` will hit | ||
| `ERROR R-A9: provider_credential key %q ends in %q; use canonical %q | ||
| (auto-derives sub-keys via providerCredentialSubKeys[%q])` from | ||
| `wfctl infra align --strict`, exit code 1, before the bad shape | ||
| ever touches `wfctl infra plan` or apply. |
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes Tasks 5+6 of the spaces-key-iac-resource plan as a no-op confirmation. The planned migration of
core-dump/infra.yamlfrom a two-entryprovider_credentialschema to canonical single-entry was already done in a prior PR (#190 TC1 cutover or #194 TC2 cutover) before the plan was authored.This PR is just the durable record (ADR 0022) of that resolution per the user's 1(a) direction.
Smoke evidence
(
/tmp/wfctlbuilt fromfeat/r-a9-errorbranch, commit288f68d7, which is the R-A9-as-error change merged in PR #583.)Reading
core-dump/infra.yamlatorigin/mainHEAD3bb46833lines 32-36 confirms canonical single-entry shape:```yaml
secrets:
generate:
- key: SPACES
type: provider_credential
source: digitalocean.spaces
name: coredump-deploy-key
```
What's protecting against regression going forward
PR1 (workflow #583, merged) flipped R-A9 from WARN to ERROR. Any future reintroduction of the two-entry shape in any
infra.yamlwill hitERROR R-A9fromwfctl infra align --strict, exit code 1, before plan/apply ever touches the cloud. PR0 (workflow #581, merged) addedwfctl infra audit-secretsas the proactive companion check. Together they cover the same attack surface Tasks 5+6 were originally going to fix manually — at lint time, going forward, for any caller.Lessons captured in the ADR
origin/mainHEAD at plan-write time.git fetch origin main && grep -A 10 '<target-block>' <file>) and paste actual BEFORE state into the plan.Test plan
decisions/matching in-tree format (5 H2 sections: Context / Decision / Consequences / Alternatives considered / Lessons / Related)wfctl infra align --strictagainstcore-dump/infra.yamlHEAD 3bb46833 → exit 0, no findingsdecisions/path🤖 Generated with Claude Code