infrastructure

Repository dossier

IaC — local stack + cloud provisioning

At risk

Branch: master
Commit: 02ceb2d2a57992e305ec37f58c82e363a827f7ae
Worktree: Clean
SDK: Terraform platform contract

stack

Docker Compose · Terraform ≥1.9

green (exact-head Infrastructure CI run 29755777669: Terraform validation/plans, topology and lifecycle tests, Compose validation, coverage contract, and reusable dispatch caller)

deploy

Terraform owns the complete Cloudflare, Neon, DNS, routing, secrets-reference, and environment topology contract; no apply or provider mutation was performed

coverage

not applicable; quality is enforced by validation, tests, plans, and lint

What it is. All IaC: the local Docker Compose stack (SpiceDB, Keto, mock-OIDC, Postgres, Jaeger, OTel collector, opt-in ClickHouse) plus Terraform modules and dev/staging/prod environment roots for self-host and cloud provisioning.

What’s proven. The local stack is excellent — fully aligned to the 41xxx port registry, seeded with safeId-encoded GP.Family data and three conformance checks, and it is what every live gate in the workspace runs against.

Where it falls short. The remote story is hollow: all six Terraform modules are locals-only — no cloud provider block exists anywhere, so terraform apply on any environment creates exactly two random passwords and nothing else. Remote state is commented out and its bootstrap script doesn’t exist. TLS outputs are literal PLACEHOLDER_* strings. The spec’d plan/apply CI workflows and tflint are absent, there’s no Keto seed parity, and the betterauth-dev provider image the spec references was never built.

The plan. infrastructure/specs/GAP-CLOSURE-2026-07-12.md (INFRA-1 … INFRA-9): a provider-agnostic layer with a docker target that provisions real containers today (autonomous and provable), the AWS layer specced behind the human target decision, real secrets/TLS paths, plan/apply CI, and the betterauth-dev image build that pairs with protocol’s adapter.

full spec: infrastructure/specs/GAP-CLOSURE-2026-07-12.md

Gap ledger

0 open · 9 closed

Severity

Include closed gaps

9 results

9 gap records
Evidence ID	Gap	Severity	Effort	Status
`INFRA-1`	Modules provision nothing real — locals-only, zero resources declared	Critical	`L`	Closed in v22
`INFRA-2`	Remote state unconfigured (backends commented; bootstrap script missing)Human gate	High	`S`	Closed in v24
`INFRA-3`	No cloud provider block anywhereHuman gate	High	`M`	Closed in v24
`INFRA-4`	CI plan/apply workflows + ci.tfvars missing	High	`S`	Closed in v3
`INFRA-5`	Secrets module incomplete — SSM/Vault ignored, TLS outputs are placeholders	High	`M`	Closed in v24
`INFRA-6`	betterauth-dev image never built (compose uses mock-oauth2-server)	High	`M`	Closed in v3
`INFRA-7`	No tflint in CI or locally	Medium	`S`	Closed in v3
`INFRA-8`	Keto seed script unimplemented	High	`S`	Closed in v3
`INFRA-9`	Port 41006 (keto-metrics) registered but unmapped in compose	Medium	`S`	Closed in v25

Change history

v37 · 2026-07-28
canonical Dagger remote-delivery foundation
Infrastructure PR 18 head d83c28f pins the same canonical Dagger action as Site. CI run 30410137243 and Terraform Plan run 30410137256 passed all bootstrap, Site, staging, and production matrices.
The Infrastructure caller migration still requires an independent last-push approval before merge. Provider mutations remain disabled; `package-site`, provider-host deployment/verification, exact cutover apply, and automatic Site enablement must retain their named fail-closed boundaries until their bounded contracts and negative tests are reviewed.
Root, Protocol, Research, Market, Sandbox, Cloud, Admin, SDK, Site, and Infrastructure produced green hosted evidence during this migration. Brand's replacement canonical-action run remained non-terminal when polling stopped; no success is claimed for it.
This burst performed no Cloudflare, Neon, DNS, Terraform apply, package publication, GitHub environment mutation, or 1Password write. Site and Infrastructure production changes remain review- and evidence-gated.
v36 · 2026-07-20
Authenticated Admin and evidence-bound CI mesh
Terraform remains the sole owner of Cloudflare, Neon, DNS, routing, secret references, and environment topology. The caller rollout performed no apply or provider mutation.
Every sibling caller is pinned to reviewed DevOps dispatch workflow commit `d39572723b2815bd1175546210325959883c3200`, waits for its real terminal CI DAG, and removes the legacy inline `FRAUTHY_CI_TOKEN` / `peter-evans` sender.
No secret was created, copied, printed, or persisted. No Cloudflare or Neon account was assumed to exist; no Terraform apply, DNS change, deployment, image publication, or SDK/UI package publication occurred.
All implementation used isolated worktrees. Active UI and product checkouts, including untracked Project Management UI work, were preserved.
v35 · 2026-07-20
Terraform-owned topology and Dagger master delivery
Bootstrap remains fail-closed until dedicated Cloudflare and Neon accounts, the Frauthy 1Password vault and secret references, remote state, imports, and reviewed no-replacement plans exist.
No Cloudflare or Neon account was assumed to exist. No Terraform apply, DNS mutation, Pages deployment, database creation, secret write, container publication, or SDK/UI package publication occurred.
Active product and UI worktrees were preserved. This program used isolated worktrees and exact-master ancestry checks so concurrent work was not overwritten.
v34 · 2026-07-19
Infrastructure-owned Site Pages contract
Production state owns exactly one account-global Pages project with `master` as its production branch and `prevent_destroy`; staging owns none, while preview deployments share the production-owned project.
The resource intentionally omits Git source integration, build configuration, custom domains, DNS records, and credentials. The Site workflow remains limited to uploading an immutable built artifact.
Production preflight now verifies Pages read access and documents the required Pages Read/Write token scope. A pre-existing `frauthy-site` project must be imported once into production and produce a no-replacement plan before any apply.
No live Cloudflare API mutation, Terraform apply, Pages deployment, GitHub secret write, DNS change, or cache pruning occurred in this version.
v33 · 2026-07-19
Authenticated workspace installs and gated Site delivery
Active Root, Site, and Project Management UI checkouts were preserved. The untracked `research/packages/ui/ui` tree and all product UI SDK surfaces were untouched.
v32 · 2026-07-16
Site typed content architecture
No public UI SDK package changed or was published. The active Site, Brand, and Research UI checkouts were not modified; implementation and ledger ingestion used isolated latest-master worktrees.
v31 · 2026-07-16
Site production quality gates and interactive GP.Family lab
No package was published, no production deployment occurred, and no active Brand or Research UI checkout was modified. Work was performed in isolated latest-master worktrees to preserve concurrent frontend changes.
v30 · 2026-07-16
Portal quality program assessment
No ledger gaps are open. Amber reflects credential/account and live-apply gates, not a source failure.
v29 · 2026-07-15
CI mesh completion and Market container contract
This burst stayed outside the concurrent frontend program's ownership: no Brand, Site UI, Admin web, Cloud web, Market web, DevOps Portal, Research UI, or product `packages/ui` implementation was changed.
v25 · 2026-07-15
data-plane, authentication, and persistence burst
The local Keto metrics contract is verified at the actual v0.12 endpoint `/metrics/prometheus` on registered port 41006, with 47 Prometheus metric families observed. The lifecycle verifier starts no unrelated services and the exact test container/network were removed afterward.
v24 · 2026-07-15
deconflicted backend gap burst
R2 remote-state bootstrap and locked runtime backends, Cloudflare/Neon hosted resources, and 1Password credential persistence are code-complete. Identity guards fail closed until dedicated Frauthy Cloudflare, Neon, and 1Password accounts exist.
v23 · 2026-07-15
Cloud runtime contract moved to Cloudflare
Runtime hosting decisions are now standardized on Cloudflare. Provider-specific deployment and persistence requirements should use Cloudflare primitives; prior Kubernetes/AWS/provider-selection placeholders are no longer authoritative.
v22 · 2026-07-15
Infrastructure Docker lifecycle proven end to end
The Docker target now provisions Postgres, SpiceDB, BetterAuth, Jaeger, the shared network, generated secrets, and persistent storage as real Terraform-managed resources.
Postgres credentials are URL-encoded and consumers use the container-network endpoint; initialization SQL is uploaded through the Docker API so worktrees and remote Docker contexts behave consistently.
Live verification proved four expected databases, a successful SpiceDB migration, SERVING gRPC health, host-correct OIDC discovery, HTTP 200 metrics and Jaeger probes, and a zero-change detailed-exitcode plan.
Final destroy removed all 13 resources; no managed container, network, volume, or Terraform state entry remained. Infrastructure master ef49038 contains the implementation and evidence checklist.
v19 · 2026-07-14
Wave 14 Protocol platform and app initialization
Wave 14 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI code, tests, documentation, its gap checklist, and this Research ledger event changed; no UI-owned surface, product packages/ui, Portal, registry publication, release tag, or concurrent UI branch was touched.
v18 · 2026-07-14
Wave 13 Protocol mapping completion
Wave 13 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol mapping/lifecycle code, tests, dependency metadata, its gap checklist, and this Research ledger event changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v17 · 2026-07-14
Frontend SDK federation prerelease gate
Frontend SDK Federation automated prerelease gate complete: seven Internal @frauthy/*-ui packages at 1.0.0-next.0, exact immutable tags and registry versions, seven verified Brand Portal libraries, 240 public components, and 634 catalog previews. Stable 1.0.0 promotion remains blocked only on the planned manual VoiceOver, NVDA, and TalkBack/touch-AT evidence.
v16 · 2026-07-14
Wave 12 Protocol LSP completion
Wave 12 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol LSP code/tests/documentation and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v15 · 2026-07-14
Wave 11 Protocol async contracts
Wave 11 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol core/backend contracts, Protocol tests/documentation, and the Research ledger changed; no UI-owned, product packages/ui, Portal, registry publication, or tag path was touched.
v14 · 2026-07-14
Wave 10 Protocol dev runner
Wave 10 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Only Protocol CLI, Protocol documentation, and the Research ledger changed; no UI-owned, package publication, registry, or tag path was touched.
v13 · 2026-07-14
Wave 9 Protocol-SDK type contract
Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.
v12 · 2026-07-14
Wave 8 Protocol release readiness
Wave 8 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol is wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, or product UI path changed.
v11 · 2026-07-14
Wave 7 branch protection
Wave 7 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
v10 · 2026-07-14
Wave 6 Protocol and SDK coverage gates
Wave 6 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, packages/ui, frontend composition, DevOps Portal, Research UI, or Sandbox UI path changed.
GitHub Actions billing is restored; all Protocol, SDK, and DevOps master workflows in this wave received runners and completed successfully.
v9 · 2026-07-14
Wave 5 coverage producers verified
GitHub Packages authentication was verified through the local gh credential. Brand packages are available at 1.0.0-next.1 and all seven product UI packages at 1.0.0-next.0 with internal visibility.
Verification remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v8 · 2026-07-14
Wave 5 Cloud and Market coverage producers
Local gates passed: Cloud 208 tests with 30 live-service tests gated, Market 176 tests with 29 live-service tests gated, and DevOps 132 tests; all three typechecks passed.
GitHub marked the DevOps, Cloud, and Market jobs failed without starting a runner because recent account payments failed or the spending limit must be increased. This is recorded as a human-gated infrastructure blocker, not as code verification.
Wave 5 remained inside the ownership boundary in root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md; no Brand, packages/ui, web composition, Portal, Research UI, or Sandbox UI path changed.
v7 · 2026-07-13
Wave 4 Rust telemetry and real CI enforcement
Wave 4 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. No Brand, product packages/ui, web composition, DevOps Portal, Research UI, or Sandbox UI path was changed.
GitHub Packages publication and UI release coordination remain owned by the concurrent Frontend SDK Federation.
v6 · 2026-07-13
Wave 3 cross-backend verification and observability
Wave 3 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v5 · 2026-07-12
Wave 2 deconflicted backend and CI mesh
Infrastructure adopted the shared private CI-mesh contract; no deployment target or human-gated infrastructure gap is claimed closed.
Wave 2 followed root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Brand, Site, product packages/ui, Cloud/Market web migration, Admin editor composition, DevOps Portal, Research UI, and Sandbox UI were intentionally untouched.
GitHub Packages publication remains blocked on a registry-compatible PAT in the concurrent federation session; no package publication is claimed here.
v4 · 2026-07-12
Wave 1 remote CI gate
Docker target, local target, AWS placeholder plan, Compose profiles, and the BetterAuth health/discovery runtime smoke all passed.
Remote gate complete: SDK CI, infrastructure CI/image build, sandbox tokenless integration, and the manually-dispatched SDK staleness workflow are green.
v3 · 2026-07-12
Wave 1 deconflicted backend lanes
Offline-safe plan/apply workflows, the runnable BetterAuth development image, Terraform lint gates, and Keto seeding are implemented. Docker target plans produce concrete containers across the six modules.
Full target apply/destroy, AWS state/SSM activation, and a live Keto metrics probe remain open and human/environment gated.
Wave 1 was deconflicted from the concurrent Frontend SDK Federation. Brand, site, root, research UI, and all owned web/portal surfaces were intentionally untouched.
v1 · 2026-07-12
Baseline — workspace-wide gap audit
Seeded from the 2026-07-12 twelve-agent audit of all eleven repos plus the Cuitty capability catalog. Eleven gap-closure specs written; orchestration plan at root/specs/06-GAP-CLOSURE-ORCHESTRATION.md.