stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

#243: VS_NFD_MODE and the machine-readable hardening-profile catalog #292

Merged
fable-5 merged 1 commits from issue-243-vs-nfd-mode into main 2026-07-31 18:48:59 +02:00
Conversation 0 Commits 1 Files Changed 16 +698 -17
fable-5 commented 2026-07-31 18:24:22 +02:00
Collaborator
Copy Link

First issue of M32 (chain start; #244–#246 will build on this branch's state).

  • VS_NFD_MODE (off | marked | hidden | enforced, default off): validated in the shared env schema, passed through compose, documented in .env.example. Deploy-level like BACKUP_ALLOWED_TARGETS — a compromised Site Admin must not be able to widen it.
  • Machine-readable catalog (packages/shared/src/vs-nfd-profile.ts): every profile-relevant setting with a decidable compliant value (equals / upper bound / non-empty) and its hardening-guide section; judgement calls in an explicit advisory list. Fence test parses the guide's reference tables (§1.1/§1.2) and fails when a switch is neither triaged into the catalog nor the advisory list (pattern of the audit-catalogue fence #201).
  • Exposure: GET /admin/system/vs-nfd-profile (Site-Admin only) reports mode + per-entry verdict + violation count, evaluated against the typed settings registry and the validated env; the admin settings view shows the card whenever the mode is not off. No UI behaviour beyond display — the treatments are #244 (marked), #245 (hidden), #246 (enforced).
  • ADR 0027 (proposed) records the mode model, the catalog as single source of truth, why off is the default, and why pond-level opt-ins are deliberately absent from the catalog.
  • Hardening guide gains its VS_NFD_MODE row in the same PR (maintenance rule).

Tests: shared suite 195 green (incl. new predicate/mode tests), api full suite 99 files / 550 green against a fresh DB (incl. the new fence and the e2e endpoint pack: admin-only, truthful verdict, verdict follows a settings change).

Issue #243 will be closed manually after green CI + merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

First issue of M32 (chain start; #244–#246 will build on this branch's state). - **`VS_NFD_MODE`** (`off | marked | hidden | enforced`, default `off`): validated in the shared env schema, passed through compose, documented in `.env.example`. Deploy-level like `BACKUP_ALLOWED_TARGETS` — a compromised Site Admin must not be able to widen it. - **Machine-readable catalog** (`packages/shared/src/vs-nfd-profile.ts`): every profile-relevant setting with a decidable compliant value (equals / upper bound / non-empty) and its hardening-guide section; judgement calls in an explicit advisory list. **Fence test** parses the guide's reference tables (§1.1/§1.2) and fails when a switch is neither triaged into the catalog nor the advisory list (pattern of the audit-catalogue fence #201). - **Exposure**: `GET /admin/system/vs-nfd-profile` (Site-Admin only) reports mode + per-entry verdict + violation count, evaluated against the typed settings registry and the validated env; the admin settings view shows the card whenever the mode is not `off`. No UI behaviour beyond display — the treatments are #244 (`marked`), #245 (`hidden`), #246 (`enforced`). - **ADR 0027** (proposed) records the mode model, the catalog as single source of truth, why `off` is the default, and why pond-level opt-ins are deliberately absent from the catalog. - Hardening guide gains its `VS_NFD_MODE` row in the same PR (maintenance rule). Tests: shared suite 195 green (incl. new predicate/mode tests), api full suite 99 files / 550 green against a fresh DB (incl. the new fence and the e2e endpoint pack: admin-only, truthful verdict, verdict follows a settings change). Issue #243 will be closed manually after green CI + merge. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
fable-5 added 1 commit 2026-07-31 18:24:22 +02:00
#243: VS_NFD_MODE and the machine-readable hardening-profile catalog
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m12s
Details
CI / Build container images (pull_request) Successful in 4m2s
Details
CI / Auth e2e pack (pull_request) Successful in 8m29s
Details
CI / Import/export fidelity gate (pull_request) Successful in 54s
Details
CD / Build and push images (push) Successful in 31s
Details
CD / Deploy to Test (push) Successful in 14s
Details
CD / Smoke tests against Test (push) Successful in 1m29s
Details
CD / Promote to Int (push) Successful in 14s
Details
CI / Build container images (push) Has been skipped
Details
CI / Lint, typecheck, test (push) Successful in 6m30s
Details
CI / Auth e2e pack (push) Successful in 8m6s
Details
CI / Import/export fidelity gate (push) Successful in 57s
Details
da5fd7c770 
The deployment declares through VS_NFD_MODE (off | marked | hidden |
enforced, default off) how the application treats configuration that
violates the VS-NfD reference profile — deploy-level like
BACKUP_ALLOWED_TARGETS, so a compromised Site Admin cannot widen it.
The catalog in shared (vs-nfd-profile.ts) is the single source of
truth: every profile-relevant setting with a decidable compliant value,
judgement calls in an explicit advisory list, and a fence test parsing
the hardening guide's reference tables so neither can drift (pattern
#201). The api evaluates the catalog against the typed settings
registry and validated env and exposes mode + verdict on
GET /admin/system/vs-nfd-profile; the admin settings view shows the
card whenever the mode is not off. Display only — the treatments land
with #244–#246 (ADR 0027, proposed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
fable-5 merged commit da5fd7c770 into main 2026-07-31 18:48:59 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
area:auth

   
area:docs

   
area:export

   
area:ops

   
area:storage

   
area:supply-chain

   
auth

Authentication, permissions, quotas

  
backend

API server (apps/api)

  
blocked

Blocked on external dependency/infrastructure

  
collab

Collaboration server (apps/collab)

  
deployment

Docker, CI/CD, hosting

  
docs

Documentation

  
effort:L

   
effort:M

   
effort:S

   
frontend

SPA (apps/web)

  
plugins

Plugin system and SDK

  
qa

Tests, fixtures, e2e

  
vs-nfd

   
vs-nfd:blocker
No Label
area:auth
area:docs
area:export
area:ops
area:storage
area:supply-chain
auth
backend
blocked
collab
deployment
docs
effort:L
effort:M
effort:S
frontend
plugins
qa
vs-nfd
vs-nfd:blocker
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#292
No description provided.
Delete Branch "issue-243-vs-nfd-mode"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?