[BLOCKED: fill in the chart pin] feat(ploeg): route by named projects, write back to the board #470

Merged

ryangr0 merged 2 commits from agent/ploeg-config-file into main

2026-07-29 20:18:59 +00:00

ryangr0 commented

2026-07-29 19:19:28 +00:00

Owner

⛔ Do not merge yet

ocirepository.yaml still pins 0.2.0-rc.6 with a !! FILL IN BEFORE MERGE !! marker. The config: block needs the chart that mounts it, which ships in the release cut by webgrip/ploeg#28. Merge that, wait for the release, then set the tag + digest here and ancestry-verify per the drill-600 catch #3 rule.

Merging as-is leaves config: inert and routing unresolved.

What it does

Replaces the env-var configuration this deployment was about to grow. Routing and the roster become a file mounted at /etc/ploeg/ploeg.yaml, and projects are named rather than numbered — ploegd resolves "Ploeg Test" to its id at boot, logs what it resolved, and refuses to start if the name matches nothing.

That removes the failure this cluster was one project-rebuild away from: a bare 11 in cluster config says nothing about which board it is, cannot be reviewed, and silently routes work to the wrong repository if the id ever changes.

Also here:

the Vikunja token + ExternalSecret ploegd needs to comment the pull request link when a Shift closes;
PLOEG_DEFAULT_TEAM moves bronze → copper, so an unmapped assignee triggers a $0 exec-harness no-op instead of a live agent run against a real repository. PLOEG_TARGET_STRICT (backlog #108) supersedes this when it ships.

Known compromise

The Vikunja token reuses the vikunja/mcp OpenBao credential, so comments appear under the MCP identity — the board cannot distinguish the dispatch plane from the other consumers. A dedicated ploeg user is the agreed next step and is worth doing before anyone relies on comment authorship for audit.

Context worth knowing

The cluster is on rc.6 — three releases behind. That is why work_items has no route_rule column today: migration 0007 ships in rc.7. Nothing about Shifts, routing or the providers is running in production right now.

Supersedes agent/ploeg-shift-rollout (PR to be closed), which configured the same things through the env-var DSLs.

## ⛔ Do not merge yet `ocirepository.yaml` still pins `0.2.0-rc.6` with a `!! FILL IN BEFORE MERGE !!` marker. The `config:` block needs the chart that mounts it, which ships in the release cut by **webgrip/ploeg#28**. Merge that, wait for the release, then set the tag + digest here and ancestry-verify per the drill-600 catch #3 rule. Merging as-is leaves `config:` inert and routing unresolved. ## What it does Replaces the env-var configuration this deployment was about to grow. Routing and the roster become a file mounted at `/etc/ploeg/ploeg.yaml`, and **projects are named rather than numbered** — ploegd resolves `"Ploeg Test"` to its id at boot, logs what it resolved, and refuses to start if the name matches nothing. That removes the failure this cluster was one project-rebuild away from: a bare `11` in cluster config says nothing about which board it is, cannot be reviewed, and silently routes work to the wrong repository if the id ever changes. Also here: - the Vikunja token + ExternalSecret ploegd needs to comment the pull request link when a Shift closes; - `PLOEG_DEFAULT_TEAM` moves bronze → **copper**, so an unmapped assignee triggers a $0 exec-harness no-op instead of a live agent run against a real repository. `PLOEG_TARGET_STRICT` (backlog #108) supersedes this when it ships. ## Known compromise The Vikunja token reuses the `vikunja/mcp` OpenBao credential, so comments appear under the MCP identity — the board cannot distinguish the dispatch plane from the other consumers. A dedicated `ploeg` user is the agreed next step and is worth doing before anyone relies on comment authorship for audit. ## Context worth knowing **The cluster is on rc.6 — three releases behind.** That is why `work_items` has no `route_rule` column today: migration 0007 ships in rc.7. Nothing about Shifts, routing or the providers is running in production right now. **Supersedes agent/ploeg-shift-rollout** (PR to be closed), which configured the same things through the env-var DSLs.

ryangr0 added 1 commit

2026-07-29 19:19:28 +00:00

feat(ploeg): route by named projects, write back to the board

e2e / Validate Renovate config (pull_request) Has been cancelled

Details

e2e / Lint & static validation (pull_request) Has been cancelled

Details

e2e / Flux-local render (pull_request) Has been cancelled

Details

e2e / Kyverno Chainsaw (KinD) (pull_request) Has been cancelled

Details

455fedaba4

Replaces the env-var configuration this deployment was about to grow. Rather
than PLOEG_TARGET_MAP="11/bronze=webgrip/ploeg@development,...", routing and
the roster are a file mounted at /etc/ploeg/ploeg.yaml, and projects are named
rather than numbered — ploegd resolves "Ploeg Test" to its id at boot, logs
what it resolved, and refuses to start if the name matches nothing.

That removes the failure this cluster was one project-rebuild away from: a
bare 11 in cluster config says nothing about which board it is, cannot be
reviewed, and silently routes work to the wrong repository if the id ever
changes.

Also here: the Vikunja token and secret ploegd needs to comment the pull
request link when a Shift closes, and PLOEG_DEFAULT_TEAM moved from bronze to
copper so an unmapped assignee triggers a $0 exec-harness no-op instead of a
live agent run against a real repository.

SUPERSEDES agent/ploeg-shift-rollout, which configured the same things through
the env-var DSLs. Close that one.

DO NOT MERGE until the ocirepository pin is filled in: the config block needs
the chart that mounts it, and the cluster is currently three releases behind —
still on rc.6, which predates migration 0007, which is why work_items has no
route_rule column today.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 added 1 commit

2026-07-29 20:18:05 +00:00

feat(ploeg): pin chart 0.2.0-rc.10

e2e / Kyverno Chainsaw (KinD) (pull_request) Successful in 28s

Details

e2e / Lint & static validation (pull_request) Failing after 35s

Details

e2e / Validate Renovate config (pull_request) Successful in 2m20s

Details

e2e / Flux-local render (pull_request) Successful in 2m39s

Details

adf139255f

rc.10 is the release whose chart mounts the `config:` block at
/etc/ploeg/ploeg.yaml (templates/config.yaml + PLOEG_CONFIG on the
Deployment) and wires `tracker:` to PLOEG_VIKUNJA_URL/_TOKEN — verified
against ops/helm/ploeg at tag v0.2.0-rc.10. With rc.6 pinned both blocks
were inert.

Digest left unpinned: harbor.webgrip.dev/webgrip/charts/ploeg is a private
project and an anonymous token 401s, so Renovate adds it on its next pass
as the file header describes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ryangr0 merged commit 6e4362c1f5 into main

2026-07-29 20:18:59 +00:00

ryangr0 referenced this pull request from a commit

2026-07-29 20:19:00 +00:00

Merge pull request '[BLOCKED: fill in the chart pin] feat(ploeg): route by named projects, write back to the board' (#470) from agent/ploeg-config-file into main