[VS-NfD] Mode "enforced": reject profile-violating configuration writes server-side #246

New Issue

fable-5 · 2026-07-30T11:59:32+02:00

fable-5 commented

2026-07-30 11:59:32 +02:00

Plan reference: M32, option c)
ADR: the one from #243
Effort: M (2 AT)
Depends on: #243, #245

Context

Option c): profile-violating configuration is not available at all. Hiding alone is UI cosmetics - the API must reject the write, otherwise a scripted client bypasses the profile.

Acceptance criteria

In mode enforced, settings writes (instance and pond level) that would set a catalog-violating value are rejected with a clear, documented error code.
Values that were already non-compliant when the mode was activated are reported (admin view; log line at startup) but never auto-changed - the operator resolves them consciously.
The UI renders as in hidden.
Tests: violating write rejected in enforced; the same write passes in off/marked/hidden; existing violating value is reported; the error code is stable.
The hardening guide (#227) names enforced as the recommended mode for VS-NfD reference operation.

Out of scope

Auto-remediation of existing values, and any change outside the catalog-listed settings.

**Plan reference:** M32, option c) **ADR:** the one from #243 **Effort:** M (2 AT) **Depends on:** #243, #245 ## Context Option c): profile-violating configuration is not available at all. Hiding alone is UI cosmetics - the API must reject the write, otherwise a scripted client bypasses the profile. ## Acceptance criteria - [ ] In mode `enforced`, settings writes (instance and pond level) that would set a catalog-violating value are rejected with a clear, documented error code. - [ ] Values that were already non-compliant when the mode was activated are reported (admin view; log line at startup) but never auto-changed - the operator resolves them consciously. - [ ] The UI renders as in `hidden`. - [ ] Tests: violating write rejected in `enforced`; the same write passes in `off`/`marked`/`hidden`; existing violating value is reported; the error code is stable. - [ ] The hardening guide (#227) names `enforced` as the recommended mode for VS-NfD reference operation. ## Out of scope Auto-remediation of existing values, and any change outside the catalog-listed settings.

fable-5 added this to the M32 - VS-NfD: deployment profile & UI modes milestone 2026-07-30 11:59:32 +02:00

fable-5 added the

effort:M

vs-nfd

area:ops

labels 2026-07-30 11:59:32 +02:00

fable-5 referenced this issue

2026-07-31 18:24:22 +02:00

#243: VS_NFD_MODE and the machine-readable hardening-profile catalog #292

fable-5 referenced this issue from a commit

2026-07-31 19:10:53 +02:00

#245: mode hidden — hide profile-violating options, mark the hiding

fable-5 referenced this issue

2026-07-31 19:11:07 +02:00

#245: mode hidden — hide profile-violating options, mark the hiding #294

fable-5 referenced this issue from a commit

2026-07-31 19:27:19 +02:00

#245: mode hidden — hide profile-violating options, mark the hiding

fable-5 referenced this issue from a commit

2026-07-31 19:48:40 +02:00

#246: mode enforced — reject profile-violating configuration writes

fable-5 referenced this issue

2026-07-31 19:48:52 +02:00

#246: mode enforced — reject profile-violating configuration writes #295

fable-5 commented

2026-07-31 20:08:37 +02:00

Done via PR #295 (merged, CI run 638 green, CD 639 deployed Test+Int, readyz fully green on both). M32 complete.

All acceptance criteria met: violating settings writes rejected in the one write path with the stable code vs_nfd_profile_violation (403, i18n de+en); pond-level writes are covered generically over the catalog (whose deliberate lack of pond entries is the ADR 0027 decision); existing violations reported at startup and on the admin card, never auto-changed; UI renders as in hidden; hardening guide names enforced as the recommended mode. Tests: reject in enforced (nothing stored), pass in marked/hidden (own app boots) and off (every existing settings-write test), pre-existing violation reported and untouched; full api suite 100 files / 555 green.

Done via PR #295 (merged, CI run 638 green, CD 639 deployed Test+Int, readyz fully green on both). **M32 complete.** All acceptance criteria met: violating settings writes rejected in the one write path with the stable code `vs_nfd_profile_violation` (403, i18n de+en); pond-level writes are covered generically over the catalog (whose deliberate lack of pond entries is the ADR 0027 decision); existing violations reported at startup and on the admin card, never auto-changed; UI renders as in `hidden`; hardening guide names `enforced` as the recommended mode. Tests: reject in enforced (nothing stored), pass in marked/hidden (own app boots) and off (every existing settings-write test), pre-existing violation reported and untouched; full api suite 100 files / 555 green.

fable-5 closed this issue

2026-07-31 20:08:37 +02:00

Sign in to join this conversation.