[ORESoftware]

Purpose

Add a source-byte rendering proof for the submodule-backed GitOps catalog without weakening the private-repository credential boundary. Static validation proves declaration/gitlink integrity; this lane proves that the exact exported deployment bytes from the declared private child commit still render deterministically and that the checked-in NetworkPolicy permits the Deployment's declared endpoint ports.

Findings that drove this lane

1. A credential-free checkout of daedalus-fab/fabrication-server.rs failed from the test-org workflow with Repository not found. That is expected: a test-repository GITHUB_TOKEN cannot read a private repository in another organization.
2. The owner repository's Actions currently fail before job start because of its billing/spending-limit state.
3. The original exact source snapshot showed OTEL_EXPORTER_OTLP_ENDPOINT on TCP 4318 but NetworkPolicy egress on TCP 4317.

No PAT or broad credential was added. The source fix is proposed in daedalus-fab/fabrication-server.rs#11; the exact gitlink/catalog update is stacked in ORESoftware/k8s-cluster#1211.

The five deployment files from the source repair commit are committed here as a checksum-pinned fixture. Their Git blobs exactly match the private source Git blob SHAs. This PR proves source-byte provenance, endpoint-policy parity, and renderability. Live private-repository reachability remains a separate owner-scoped GitHub App contract.

Immutable inputs

ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577
Kustomize v5.8.1

Ubuntu, macOS, and Windows proof

Each runner:

• checks out the cluster with submodules: false;
• recomputes each snapshot file's Git blob SHA and compares it with the private source commit manifest;
• verifies .gitmodules, the mode-160000 Git index entry, catalog inventory, direct Argo source, and snapshot revision/repository are identical;
• proves the source is not materialized under the superproject;
• runs a unit regression showing an OTLP 4318 endpoint with only 4317 egress fails closed;
• extracts the real snapshot's NATS and OTLP ports and requires the NetworkPolicy to permit both;
• downloads the official platform-specific Kustomize v5.8.1 asset and verifies a hard-coded official SHA-256 before safe extraction;
• renders the snapshot k8s path twice and requires byte-identical output;
• requires exactly Deployment, Service, NetworkPolicy, and ExternalSecret, all namespaced to daedalus;
• rejects cluster-scoped kinds, a rendered Kubernetes Secret, and plaintext stringData; and
• uploads endpoint-policy, source-blob, binary, render, and rendered-YAML evidence.

Safety

Checkouts disable persisted credentials. The workflow uses no user PAT, private key, registry credential, Kubernetes credential, Cloudflare token, DNS permission, R2 key, or database access. It runs kustomize build only and never invokes an apply, push, deployment, or reconciliation operation.

This does not activate the inert ApplicationSet.

Coordination

• Owner source repair: https://github.com/daedalus-fab/fabrication-server.rs/pull/11
• Stacked exact-pin update: chore(DEN-2724): pin fabrication OTLP egress repair ORESoftware/k8s-cluster#1211
• Baseline catalog/trigger repair: fix(DEN-2724): keep GitOps catalog aligned with deployment gitlinks ORESoftware/k8s-cluster#1209
• Current-main adversarial matrix: test(DEN-2724): certify current-main GitOps fail-closed behavior security-adversarial-e2e#6
• Root dispatcher merge: feat(DEN-2725): route root gitops commands safely on current main zed-pkg/zed-cli#242
• Roadmap: [GitOps roadmap] Submodule-backed app catalog, ApplicationSets, and zed gitops validate ORESoftware/k8s-cluster#1097
• Linear: DEN-2724, DEN-2725, DEN-630

[linear-code]

DEN-2724

[ORESoftware]

Final exact-source evidence is green across Linux, macOS, and Windows

The immutable test package is 153d65ad2b3cf5fc139efb0dbdf29fa816ce55d2, pinned to:

ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577

Platform evidence

• Windows Server 2025 passed in this PR's run 31279806290.
• Ubuntu 22.04 and macOS 14 ARM64 passed in the independent exact-package reproduction security-adversarial-e2e#9, run 31280074691.
• A second independent Windows reproduction also passed in security-adversarial-e2e#8.

All three platform artifacts agree exactly:

render SHA-256: 440b6306c5306a6aef01c83f96cb3a00eb2b42c38be78aebf9ef1e4682920415
render bytes:   4745
resources:      4
source files:   7 exact Git blobs

Rendered resources are one Service, Deployment, ExternalSecret, and NetworkPolicy, all in namespace daedalus. No cluster-scoped resource, Kubernetes Secret, or plaintext stringData is emitted.

Endpoint-policy evidence is also identical:

NATS_URL:                      4222
OTEL_EXPORTER_OTLP_ENDPOINT:   4318
allowed TCP ports:             53, 4222, 4318, 8113

Each platform executed both the exact owner-repo regression files by Git blob ID and an independent test-org implementation. Official Kustomize v5.8.1 assets were selected per platform and verified against hard-coded release SHA-256 values before extraction.

Modern Ubuntu 24.04/macOS 15 jobs in this repository remain queued due the repository's concurrent workflow load, but the exact test-package commit has already passed equivalent Linux/macOS execution from the independent test repo. This PR is ready for review. It remains read-only and does not claim live private-repository reachability or authorize ApplicationSet activation.