From 1f7340b713a6c0051b87cb6078869ea54f50f415 Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Wed, 24 Jun 2026 11:52:19 +0200 Subject: [PATCH] =?UTF-8?q?docs(rfc-0001):=20retag=20=C2=A76.3=20+=20C.3?= =?UTF-8?q?=20cluster=5Fid=20anchor=20to=20its=20own=20ticket=20(backend#8?= =?UTF-8?q?83)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The cluster_id anchor (field + get-or-create + cross-account 409 + adopt- backfill) was attributed to backend#836 in §6.3 and C.3, but #836/#862 ship only namespace validation + per-action RBAC. Split the anchor out to its own ticket so the critical-path lynchpin is tracked: - §6.3: retag the cluster_id sub-bullet to backend#883 (split out of #836). - C.3: heading now credits #836 (namespace + RBAC) and #883 (the [NEW] cluster_id items) separately, so the doc no longer self-contradicts §6.3. - Ref-links for backend#862 (PR) and backend#883 (issue). Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/rfcs/0001-cli-auth-and-client-provisioning.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/docs/rfcs/0001-cli-auth-and-client-provisioning.md b/docs/rfcs/0001-cli-auth-and-client-provisioning.md index 4d3eb97c..653cdb4a 100644 --- a/docs/rfcs/0001-cli-auth-and-client-provisioning.md +++ b/docs/rfcs/0001-cli-auth-and-client-provisioning.md @@ -329,7 +329,9 @@ it can diagnose a failed *provision*, not just cluster health. operator kubeconfig and can read the `kube-system` UID, which the heartbeat sender can't (§10, R7). Until then, the §7.2 step-2a live-release guard stops a re-mint. (The backend accepts a CLI-supplied `cluster_id`; see C.3.) - - ([backend#836]; server-side token revoke for `logout` lands as backend#845.) + - (Anchor field + get-or-create + 409 + adopt-backfill: [backend#883], + split out of #836 — which ships namespace validation + RBAC only (see PR + [backend#862]). Server-side token revoke for `logout` lands as backend#845.) ### 6.4 Installer reorder (in `tracebloc/client`) @@ -1136,7 +1138,7 @@ GET /activate # frontend, token-authed (R1): "connect machine X to ac # binds approval to request.user (RFC §6.3) ``` -### C.3 Provisioning — backend#836, `/edge-device/` (Bearer) +### C.3 Provisioning — `/edge-device/` (Bearer) — backend#836 (namespace + RBAC); the `[NEW]` `cluster_id` items: backend#883 ```http POST /edge-device/ # get-or-create, account-scoped on cluster_id @@ -1235,4 +1237,6 @@ class Meta: [backend#830]: https://github.com/tracebloc/backend/issues/830 [backend#835]: https://github.com/tracebloc/backend/issues/835 [backend#836]: https://github.com/tracebloc/backend/issues/836 +[backend#862]: https://github.com/tracebloc/backend/pull/862 [backend#863]: https://github.com/tracebloc/backend/issues/863 +[backend#883]: https://github.com/tracebloc/backend/issues/883