docs(launchpad): record ADR-0011 -- external security smoke test floor - #177
Merged
tucktuck101 merged 1 commit intoAug 16, 2026
Merged
Conversation
Records the decision for #47: the minimum external security smoke test before a deployment is declared healthy is Floor B -- reachability/TLS plus negative port assertions confirming PostgreSQL, Redis, object-storage admin, and the relay's own health/metrics ports are not reachable from the internet. Floor A alone is rejected (passes even with Postgres open); Floor D is rejected (sets no reachable bar at all). Includes a contingency for the accepted gap: Floor B doesn't confirm the deployed image matches the pinned version. Trigger to upgrade to Floor C: either #26 (admin access model) lands, or a real incident where a deployment passed Floor B while running the wrong version. Notes the gap is already narrower in practice than it sounds, since the deploy guard (#141) and the ADR-0005 boundary check both enforce image-namespace constraints internally already. Decided directly with the repository owner following the recommendation and contingency plan both posted as comments on #47, the same pattern ADR-0008/0009 recorded. Verified: $ bash launchpad/scripts/test-adr-0011-frontmatter.sh 6 passed, 0 failed Closes #47 Signed-off-by: Serina Mcfall <serina.mcfall@gmail.com>
serina-mcfall
marked this pull request as ready for review
August 14, 2026 23:09
10 tasks
serina-mcfall
deleted the
docs/adr-0011-external-security-smoke-test-floor
branch
August 31, 2026 20:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Records ADR-0011 for #47: the minimum external security smoke test before a deployment is declared healthy is Floor B (reachability/TLS plus negative port assertions), with a documented contingency for upgrading to Floor C once #26 lands or if a version-mismatch incident occurs.
Related issue
Closes #47
Issue type
ADR
Agent provenance
Objective
Write
launchpad/decisions/ADR-0011-external-security-smoke-test-floor.md, recording the decision confirmed with the repository owner via comments on #47, and close the issue.Impacted components
launchpad/decisions/ADR-0011-external-security-smoke-test-floor.md(new)launchpad/scripts/test-adr-0011-frontmatter.sh(new)Approach and rejected alternatives
Floor B was recommended, discussed, and confirmed directly with the repository owner (see #47's comment thread). No alternative approach considered for the document structure — this PR only formalizes an already-confirmed decision plus its contingency plan.
Verification
Command run:
Raw output:
Not verified
Security implications
None new beyond what's recorded in the ADR: this sets the floor for external verification and explicitly names the accepted gap (image-version confirmation deferred to Floor C) rather than leaving it implicit.
Escalations
None — this was a live back-and-forth with the repository owner (recorded via the recommendation and contingency-plan comments on #47) rather than an agent decision.