Lock-in Ledger: fleet self-audit + client template with renewal-calendar-as-code - #158
Merged
Conversation
…newal-calendar-as-code Deliverable 1 — fleet-reports/lock-in-ledger.md: the fleet's own vendor-dependency self-audit. Seven real dependencies (domain registrar, Fastmail, GitHub, AWS, Grafana Cloud, Axiom, Anthropic/Claude Code) each scored on four exit-focused axes — export fidelity, format openness, identity/custody, documented exit — with the bad scores published honestly. This is the receipt the delivery pledge points at. Deliverable 2 — fleet-reports/lock-in/: the client-facing template (TEMPLATE.md, the blank four-axis rubric) plus renewal-calendar-as-code. renewals.yml is the fleet's real, public-safe calendar; check-renewals.py is a pure, testable date filter; .github/workflows/renewal-calendar.yml runs it daily and opens a deduped tracking issue ahead of each due date (uses GITHUB_TOKEN — issue creation, not PRs). Wired the ledger into the org profile's Fleet-in-numbers list. Public-repo safe: no credentials, account identifiers, or cost figures; comparative framing only, no correctness/novelty claims. Does not touch terraform/ or fleet-ops/. The ledger lives in files the weekly fleet-reports workflow does not overwrite. Closes #121 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #121.
Publishes the fleet's own vendor-dependency self-audit, then the reusable client-facing template — the receipt behind the delivery pledge ("firing us is a runbook").
Deliverable 1 — the self-audit
fleet-reports/lock-in-ledger.mdaudits our real dependencies — domain registrar, Fastmail (MX), GitHub (repos/Actions/attestations), AWS (solidago), Grafana Cloud (drosera), Axiom (betula), and Anthropic/Claude Code — each scored on four exit-focused axes:The bad scores are published honestly (Axiom custody: Weak; the Anthropic-substitution and Axiom-history exits: Limited), with the follow-ups they surface. The through-line: custody is strongest where we hold the names ourselves and weakest where the vendor mints an identity we can't reproduce.
Deliverable 2 — the client template + renewal-calendar-as-code
fleet-reports/lock-in/:TEMPLATE.md— the blank four-axis rubric, ready to copy per organization.renewals.yml— renewal-calendar-as-code: every dated obligation that lapses if nobody acts (domains, cert backstop, subscriptions, a PAT expiry). Our real, public-safe calendar as the working example.check-renewals.py— a pure, no-network, unit-testable date filter that emits the entries whose reminder window is open (including overdue).--checkvalidates shape;--todaypreviews..github/workflows/renewal-calendar.yml— runs the checker daily and opens a tracking issue ahead of each due date, deduped on a per-item marker so a reminder is filed once. Uses the defaultGITHUB_TOKEN(issue creation, not PRs).Wired a one-line link into the org profile's Fleet in numbers list.
Guardrails honored
terraform/orfleet-ops/.fleet-reports.ymldoes not overwrite (itsFILESlist is onlyfleet-report.md+incidents.md).python3 ci/validate.pypasses; all relative links resolve; both YAML files parse; the checker was exercised across in-window, out-of-window, and overdue dates.Left for a human to merge — not auto-merged.
🤖 Generated with Claude Code