Update docs, threat model, and red-team tests for single-binary OCI rollout #120

New issue

Closed

opened 2026-05-06 11:57:45 -07:00 by jwilger · 0 comments

jwilger commented

2026-05-06 11:57:45 -07:00

Owner

Follow-up implementation slice from #115.

Decision context

The ADR-only PR will record the accepted single-binary and embedded OCI decisions. Implementation must then update operator docs, the threat model, and red-team/contract tests to match shipped behavior.

Scope

Update THREAT-MODEL.md for:
- binary release assets and provenance;
- embedded OCI default gateway isolation;
- explicit bare opt-out behavior;
- release-publish PAT blast radius for binary assets.
Update ADR-0002 references if the new OCI isolation supersedes or complements linter-era sandbox history.
Update QUICKSTART.md, docs/OPERATIONS.md, systemd docs, E2E runbook, CLI README, and release announcement docs after the implementation exists.
Add or update red-team tests for launcher fail-closed behavior, rootfs restrictions, secret handling, and any future repo-controlled execution guardrails.

Acceptance criteria

Docs describe both recommended Docker production deployment and downloadable binary usage honestly.
Bare mode documentation is explicit opt-out language, not a silent default.
Threat-model claims are backed by tests or clearly marked as operator/deployment assumptions.
No docs mention unimplemented commands before the implementing PR lands.

Required tests

Existing docs/contract tests updated for new command names and release assets.
New red-team tests for embedded OCI and fallback semantics where feasible.
Manual docs review against the accepted ADR decisions.

Follow-up implementation slice from #115. ## Decision context The ADR-only PR will record the accepted single-binary and embedded OCI decisions. Implementation must then update operator docs, the threat model, and red-team/contract tests to match shipped behavior. ## Scope - Update `THREAT-MODEL.md` for: - binary release assets and provenance; - embedded OCI default gateway isolation; - explicit bare opt-out behavior; - release-publish PAT blast radius for binary assets. - Update `ADR-0002` references if the new OCI isolation supersedes or complements linter-era sandbox history. - Update `QUICKSTART.md`, `docs/OPERATIONS.md`, systemd docs, E2E runbook, CLI README, and release announcement docs after the implementation exists. - Add or update red-team tests for launcher fail-closed behavior, rootfs restrictions, secret handling, and any future repo-controlled execution guardrails. ## Acceptance criteria - Docs describe both recommended Docker production deployment and downloadable binary usage honestly. - Bare mode documentation is explicit opt-out language, not a silent default. - Threat-model claims are backed by tests or clearly marked as operator/deployment assumptions. - No docs mention unimplemented commands before the implementing PR lands. ## Required tests - Existing docs/contract tests updated for new command names and release assets. - New red-team tests for embedded OCI and fallback semantics where feasible. - Manual docs review against the accepted ADR decisions.

jwilger added a new dependency

2026-05-06 12:14:08 -07:00

#119 Run the Docker image through the unified auto-review binary

jwilger added a new dependency

2026-05-06 12:14:08 -07:00

#121 Publish Linux auto-review binaries with full provenance

jwilger added this to the 1.0 milestone

2026-05-06 12:17:51 -07:00

jwilger referenced this issue from a pull request that will close it,

2026-05-07 11:04:41 -07:00

docs: document single-binary rollout #133

jwilger closed this issue