Auto-PR: docs(fleet): revise §6 — no rendered dirs in git; registry + ephemeral render + state-per-tenant

[weown-bot]

🤖 Automated Pull Request — authored by weown-bot (ecosystem service account)

Opened by: @ncimino
Last pushed by: @ncimino
Branch: docs/nik-fleet-iac-topology → main

Contributors on this branch:

• @ncimino (1 commit)

---

📋 Human Review Checklist — NIST CSF 2.0 Functions

Review per the 6 NIST CSF Functions. Frameworks referenced: NIST CSF 2.0, CIS Controls v8 IG1, CSA CCM v4, ISO/IEC 27001:2022, SOC 2, ISO/IEC 42001:2023. See docs/COMPLIANCE_ROADMAP.md.

🏛️ Govern (GV)

• CODEOWNERS correct for affected paths (.github/CODEOWNERS)
• ADR required/updated if an architectural decision is introduced
• Policy impact considered and documented
• All Copilot AI review comments addressed or explicitly deferred with rationale

🔍 Identify (ID)

• New assets inventoried (Helm values, container images, dependencies)
• SBOM regenerated if dependencies changed
• Risk register / threat model touched if threat surface changed (.github/SECURITY_ASSESSMENT.md)

🛡️ Protect (PR)

• Least privilege: RBAC, ServiceAccounts, scoped PATs (NIST PR.AC, CIS 5/6, ISO A.5.15-A.5.18)
• Secrets managed via Infisical (never --from-literal, never /tmp, always $(mktemp) — ISO A.8.24)
• NetworkPolicy present for new deployments (NIST PR.AC-5, CIS 12, CSA IVS)
• TLS 1.3 with strong cipher suites where applicable (NIST PR.DS-1, CIS 3)
• Container security: non-root UID 1000+, Pod Security restricted (NIST PR.IP, CIS 4)

🕵️ Detect (DE)

• Logs / metrics added for new components (NIST DE.CM, CIS 8/13)
• Alert rules updated if thresholds change
• Health checks (livenessProbe + readinessProbe) configured

🚨 Respond (RS)

• Runbook updated if operational behavior changes (.github/INCIDENT_RESPONSE.md)
• Incident response impact considered (escalation paths, on-call)

♻️ Recover (RC)

• Backup strategy covers new persistent data (NIST RC.RP, CIS 11, ISO A.8.13)
• Rollback procedure tested or documented
• DR impact assessed for new critical components

📚 Documentation & Versioning

• Relevant CHANGELOG.md updated (per-directory or repo-level /CHANGELOG.md)
• #WeOwnVer version bumped per docs/VERSIONING_WEOWNVER.md
• READMEs / ADRs / inline comments updated

---

📝 Recent Commits (full bodies for Copilot context)

3872727 docs(fleet): revise §6 — no rendered dirs in git; registry + ephemeral render + state-per-tenant

Author: Nik
Date: Wed Jul 15 18:04:16 2026 -0600

Supersedes the private-repo-of-rendered-dirs proposal after industry research
(2025-26 consensus) + vault prior art (Komodo git-is-truth verdict, OpenTofu
MAIT state/drift loop, s004 tombstone pathology): git holds template code +
a small private tenants.yaml registry ONLY; copier render becomes an ephemeral
CI/deploy artifact; tofu state-per-tenant via generated backend keys in
weown-prod-state; day-2 via DO-tag dynamic inventory (no checked-in
inventories); orchestration graduates operator-wrapper -> Terragrunt Stacks /
CI render -> Terrateam/Digger -> DB control plane. Existing site dirs stay as
reference; no new customer dirs get committed.

---

---

🔍 Copilot AI Review: Copilot is configured to auto-request review for bot-authored PRs. If an auto-created PR opens without an initial Copilot review, push a follow-up commit to the same open PR (review_on_push: true) to trigger review automatically.

👥 Required Reviewers: human approval enforced by branch protection + CODEOWNERS. @ncimino requested automatically.

📚 Review Guidelines: .github/copilot-instructions.md (phase-aware compliance directives)

🛠️ Workflow Operations: .github/workflows/README.md

Auto-generated by .github/workflows/auto-pr-to-main.yml

[Copilot]

Pull request overview

Updates the fleet operations design documentation to revise the proposed IaC/topology approach: moving away from committing rendered per-tenant directories, and toward a private tenant registry + ephemeral template renders + per-tenant OpenTofu state and dynamic inventory.

Changes:

• Replaces the earlier “private repo of rendered customer dirs” proposal with a registry-driven, ephemeral-render pipeline model.
• Documents per-tenant state isolation (separate backend keys) and day-2 operations via dynamic inventory sourced from DigitalOcean tags.
• Outlines an incremental orchestration maturity path (operator wrapper → stack tooling → PR-gated applies → eventual control plane).