Goal. package the hub as a Helm chart and the spoke agent as an OCM addon, support light and heavy deployment profiles and air-gapped/on-prem installs, and define an upgrade path with an ADR-gated addon version policy.
Phase / depends. M0 (addon enablement in the lab) → P1 (hub chart) → ongoing. Depends on: E0. The control plane is a single Go binary by design (ADR-0002), which keeps packaging and supply-chain hardening simple; secrets are referenced from a KMS, never baked into rendered output (E3).
Capabilities: multi-arch + air-gap + registry-relocatable packaging (China/India); cosign/SLSA/SBOM; the brew install local single binary.
Features
Tracked follow-ups
Exit criteria
- The hub installs via Helm with RLS-configured Postgres and KMS-referenced secrets; no secret literal in rendered output.
- The spoke agent ships as an OCM addon distributed through the addon framework, versions pinned.
- Light and heavy profiles deploy from one chart with identical safety controls.
- Air-gapped/on-prem install works with mirrored images, offline bundles, and an on-prem KMS.
- Upgrades apply with migrations and rollback; addon bumps are ADR-gated; audit continuity holds.
Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).
2026-07 research addendum (market research T7; standards §5.5)
Supply-chain integrity from the first tag (T7) — elevate to a day-one release gate, not later hardening. Evaluators actually check this. The trio, wired from the first tag (Slice P, docs/BUILD-SEQUENCE.md):
Phase-L subset (Slice P, parallel track — does not gate Slices 1–6): reproducible multi-arch build (linux/amd64+arm64, darwin/arm64) + a working brew tap + cosign signature + SLSA provenance + SBOM on the first tag. Required before any public brew install sith announcement, not before the binary is useful locally.
Refs: SLSA · Sigstore/cosign · identity-connections-security.md §6 supply-chain checklist. Labels: supply-chain, standards-alignment.
Goal. package the hub as a Helm chart and the spoke agent as an OCM addon, support light and heavy deployment profiles and air-gapped/on-prem installs, and define an upgrade path with an ADR-gated addon version policy.
Phase / depends. M0 (addon enablement in the lab) → P1 (hub chart) → ongoing. Depends on: E0. The control plane is a single Go binary by design (ADR-0002), which keeps packaging and supply-chain hardening simple; secrets are referenced from a KMS, never baked into rendered output (E3).
Capabilities: multi-arch + air-gap + registry-relocatable packaging (China/India); cosign/SLSA/SBOM; the
brew installlocal single binary.Features
Tracked follow-ups
Exit criteria
Source:
docs/EPICS.md,docs/SITH-NOTION.md· part of the Sith implementation backlog (see the master roadmap issue).2026-07 research addendum (market research T7; standards §5.5)
Supply-chain integrity from the first tag (T7) — elevate to a day-one release gate, not later hardening. Evaluators actually check this. The trio, wired from the first tag (Slice P,
docs/BUILD-SEQUENCE.md):Phase-L subset (Slice P, parallel track — does not gate Slices 1–6): reproducible multi-arch build (
linux/amd64+arm64,darwin/arm64) + a workingbrewtap + cosign signature + SLSA provenance + SBOM on the first tag. Required before any publicbrew install sithannouncement, not before the binary is useful locally.Refs: SLSA · Sigstore/cosign ·
identity-connections-security.md§6 supply-chain checklist. Labels:supply-chain,standards-alignment.