docs: register governed-action-preflight and action-page-controls-and-queries; skills carry the approval-operating lessons by rbuergi · Pull Request #5787 · Systemorph/MeshWeaver

rbuergi · 2026-09-27T06:40:08Z

Follow-up to #5786, which was already in the merge queue. It is stacked on that branch, so until #5786 merges the diff also shows #5786's commits. Only the last commit is new.

PolicyNotProse: two proposed rows, from maintainer rules relayed today.
- governed-action-preflight: every step of a governed action runs as system, and rights and scale are pre-flighted at PLAN time, so an action refuses at park and never partway through a destructive run. The evidence is a DeleteSpace that failed at step 9, on 31,138 per-node delete validations against a 25 s bound, after its grant and GitSync were already removed.
- action-page-controls-and-queries: an activity or action page is built from controls (cards, grids, query controls with "show matching nodes"), sets are mesh queries (top-level + scope:subtree), and the summary goes last.
- Both rows are proposed because their implementation in MeshWeaver.Plugins is in flight. Plugins Progress-streaming tests gate the script on an attached subscriber (#2421 was a subscribe-late race, not batching) #2424 documents them in Hosting/AksOperationsViaActions and Hosting/DeleteSpaceAction.
/deployment: the pre-flight rule. The maintainer self-approval now follows the operating lessons Plugins feat(slideshow): SlideShowControl gains frames mode — the whole deck, pre-rendered #2422 recorded: wait for the park; approvedPlan is recomputed from actionPlan because the node does not store it; the digest binds commands, not the values file or operator environment; and approvable is not yet runnable.
/gui: the action-page rule.

MeshWeaver.Documentation.Test passes locally (649/649).

Pairs-with: none — documentation and skills only.

🤖 Generated with Claude Code

…ions into pages and skills - TheBakeGateOnlyStallsARoll: the post-fix startup budget (60 on memex + memex-cloud) and an incident history table. - PlanningADatabaseMigration: the V58 unblock needed a vault capture before the Reconcile; Related. - DeploymentAKS: link the migration process; the 600 s budget; Recycle/DeleteSpace rows; approval bound to the plan; the Key Vault key -> Restart finding; the --subscription trap. - IssueTaxonomy: how an issue reaches triage (org webhook, periodic sweep, triage scope). - SelfUpdateAnnouncementKey: where the rollout stands. - Skills: /deployment (governed actions, probes, migrations, subscription trap; control-instance host corrected), /ci, /testing, /gui, /release, /pullrequest (working beside other sessions), /worktree. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

… a roll gate in the probe summary; the 600 s budget needs #5749 AND #5754 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

…-queries (proposed); skills carry them and the approval-operating lessons Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Copilot

Copilot review overview

🟡 Changes recommended

Critical deployment documentation issues and a moderate approval-procedure issue remain unresolved.

Review effort: Lite
Findings: 2 · 1

Open (3)

Remove exposed Azure subscription and tenant identifiers · New
Add --subscription to every az command example · New
Fix the ungrammatical outage introduction · New

What changed in this PR

Updates architecture documentation and operational skills with governed-action, deployment, migration, testing, GUI, CI, and collaboration guidance.

Changes:

Registers two proposed governance policies.
Documents deployment, migration, rollout, triage, and incident lessons.
Updates skills for approvals, testing, releases, GUI composition, CI, and worktrees.

File	Description
`src/MeshWeaver.Documentation/Data/Architecture/TheBakeGateOnlyStallsARoll.md`	Adds startup-budget guidance and incident history.
`src/MeshWeaver.Documentation/Data/Architecture/SelfUpdateAnnouncementKey.md`	Records rollout status.
`src/MeshWeaver.Documentation/Data/Architecture/PolicyNotProse.md`	Registers two proposed policies.
`src/MeshWeaver.Documentation/Data/Architecture/PlanningADatabaseMigration.md`	Documents Key Vault capture prerequisites.
`src/MeshWeaver.Documentation/Data/Architecture/IssueTaxonomy.md`	Documents issue-triage routes.
`src/MeshWeaver.Documentation/Data/Architecture/DeploymentAKS.md`	Adds AKS subscription and governed-action guidance.
`.claude/skills/worktree/SKILL.md`	Adds worktree collision safeguards.
`.claude/skills/testing/SKILL.md`	Documents in-mesh test execution.
`.claude/skills/release/SKILL.md`	Clarifies source-sync and seal behavior.
`.claude/skills/pullrequest/SKILL.md`	Adds multi-session workflow guidance.
`.claude/skills/gui/SKILL.md`	Adds action-page composition rules.
`.claude/skills/deployment/SKILL.md`	Adds plan-bound approval guidance.
`.claude/skills/ci/SKILL.md`	Adds migration and probe invariants.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

rbuergi · 2026-09-27T06:51:00Z

+🚨 **Pass `--subscription 7ecc5974-5319-4596-ad2b-3470f6b7f85c` on EVERY `az` call** — written
+`<subscription>` in every example below. The default
+subscription may be "PartnerRe Memex", which holds another cluster with the SAME name
+(`<aks-cluster>`); without the flag you read the wrong system and nothing says so.
+`az role assignment delete --ids …` needs it too, or it fails with `InvalidAuthenticationTokenTenant`.


Fixed in 50c477b. The skill (and DeploymentAKS) now use the placeholder and point to the private Memex repo (docs/aks-ops.md) for the id. The other tenant's name is gone; the text says only that the default subscription may belong to another tenant's installation. Older public files that already carry the id (delete-user, new-repo and release skills, operator tests) are outside this diff.

(re-posted 2026-10-11; originally by Copilot on 2026-09-27)

This committed skill also exposes the deployment's real Azure subscription ID and tenant name (ClientA Memex) in a public skill. Deployment identities must remain private; use the existing <subscription> placeholder instead of copying the value from Memex.

rbuergi · 2026-09-27T06:51:01Z

+🚨 **Always pass `--subscription 7ecc5974-5319-4596-ad2b-3470f6b7f85c` to every `az` call on this
+page** (`<subscription>` in the examples). The
+signed-in account's DEFAULT subscription may be "PartnerRe Memex", which holds ANOTHER cluster with
+the same name in a resource group of the same name (`<aks-cluster>` in `<aks-resource-group>`). Without the flag, `az aks command invoke`
+answers from that cluster, with different nodes and a different migration history, and nothing in
+the output says so. The same applies to `az role assignment delete --ids …`: it does not take the
+subscription from the id, uses the default account's tenant, and fails with
+`InvalidAuthenticationTokenTenant`. Pass `--subscription` there too.


Fixed in 50c477b. The onboarding example now reads az identity federated-credential create --subscription …, so every concrete az command on the page carries the flag. The warning's own mention of role assignment delete --ids already says to pass --subscription.

(re-posted 2026-10-11; originally by Copilot on 2026-09-27)

This new blanket instruction is not true for every az command on the page: the onboarding alternative at line 426 still shows az identity federated-credential create without --subscription. An operator following that example can resolve the same-named resource in the default ClientA subscription, exactly the ambiguity this addition is meant to prevent. Add the subscription to every concrete command (including that onboarding example), or narrow this warning and link to the corrected command.

This issue also appears on line 730 of the same file.

rbuergi · 2026-09-27T06:51:02Z


+## Incident history
+
+The outage of the control instance, 2026-09-25/26, as three failures and the change that closed


Fixed in 50c477b. It now reads: "The table lists the control instance's outage of 2026-09-25/26 as three failures, each with the change that closed it."

github-actions · 2026-09-27T06:46:15Z