dorfteich/docs/vs-nfd
Claude Fable 5 4d9f913845
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m18s
CI / Build container images (pull_request) Successful in 4m3s
CI / Auth e2e pack (pull_request) Successful in 8m43s
CI / Import/export fidelity gate (pull_request) Successful in 1m0s
CD / Build and push images (push) Successful in 23s
CD / Smoke tests against Test (push) Successful in 1m22s
CD / Deploy to Test (push) Successful in 12s
CD / Promote to Int (push) Successful in 13s
CI / Lint, typecheck, test (push) Successful in 6m27s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m24s
CI / Import/export fidelity gate (push) Successful in 58s
#246: mode enforced — reject profile-violating configuration writes
In enforced mode the ONE settings write path every caller uses rejects
catalog-violating values with the stable code vs_nfd_profile_violation
(403 — the request is well-formed, the policy says no). Existing
violating values are reported at startup (log line, database-less boots
must not fail) and on the admin card, never auto-changed. The UI
renders as in hidden (#245 already keys on hidden|enforced). The
hardening guide now names enforced as the recommended mode for VS-NfD
reference operation. Tests: violating write rejected with the stable
code and nothing stored; compliant writes pass; the same violating
write passes in marked and hidden (own app boots); pre-existing
violation reported and untouched. Full api suite 100 files / 555 green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
2026-07-31 19:48:37 +02:00
..
00-analyse-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
10-ist-aufnahme.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
20-massnahmenplan.md #221: offline update path incl. migrations, rehearsed with rollback 2026-07-31 17:26:50 +02:00
30-issue-adr-auftrag.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
31-issue-entwurf.md docs: VS-NfD readiness planning (ist-aufnahme, plan, ADRs 0019-0026, issue drafts) 2026-07-30 01:48:05 +02:00
40-abgrenzungserklaerung.md #227: hardening guide with the VS-NfD reference configuration 2026-07-31 10:35:26 +02:00
50-haertungsleitfaden.md #246: mode enforced — reject profile-violating configuration writes 2026-07-31 19:48:37 +02:00
60-sicherheitsdokumentation.md #215: trusted reverse-proxy header / mTLS client-certificate path 2026-07-31 12:50:09 +02:00
70-betriebshandbuch.md #221: offline update path incl. migrations, rehearsed with rollback 2026-07-31 17:26:50 +02:00
80-grundschutz-mapping.md #230: IT-Grundschutz mapping for APP.3.1 and CON.11.1 2026-07-31 10:35:26 +02:00
90-restrisiken.md #216: hard AUTH_LOCAL_ENABLED switch over every local credential flow 2026-07-31 12:58:07 +02:00
95-mirror-protokoll.md #218: mirror procedure into an internal registry 2026-07-31 14:33:04 +02:00
96-offline-build-protokoll.md #219: verified reproducible build without network access 2026-07-31 14:39:35 +02:00
97-isolationslauf-protokoll.md #220: protocol of the isolated deployment run 2026-07-31 17:05:08 +02:00
98-update-rollback-protokoll.md #221: offline update path incl. migrations, rehearsed with rollback 2026-07-31 17:26:50 +02:00