The grafana deploy went through sorb's hands and never got its AAR. Writing it
now surfaced the actual mistake, which sits in gate 1 rather than in the rollout:
I wrote two acceptance criteria that need an authenticated grafana, and I have
none. That was as true when I wrote them as when I came to check them; I simply
never asked. Both are still unchecked today.
The decision to keep decided findings visible instead of feeding them to trivy's
ignore file is binding and lasting, and it existed only in a design document and
a README. It is ADR-0029 now, with the note that it was made and executed before
it was written down — the same fault ADR-0009 admits to about itself.
Both ledgers dated the 22nd and 23rd now carry one line about their commits
saying the 21st, since sorb chose to leave the dates rather than rewrite three
mirrored repositories over it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2Q4Ri8NGwyTZzScvKnWFM
Thore CimbalandClaude Opus 5
1a23346c30