From 85107bfbccf43b75935c62fc885683b29c8344a8 Mon Sep 17 00:00:00 2001
From: Marius Ciepluch <11855163+norandom@users.noreply.github.com>
Date: Fri, 2 Oct 2026 19:37:48 +0200
Subject: [PATCH] spec(plane-on-kubernetes): requirements approved; target is
 k3s with images on GitHub (GHCR)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
---
 .../specs/plane-on-kubernetes/requirements.md | 12 +++++++++++-
 .kiro/specs/plane-on-kubernetes/spec.json     | 19 ++++++++++++++-----
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/.kiro/specs/plane-on-kubernetes/requirements.md b/.kiro/specs/plane-on-kubernetes/requirements.md
index 4bbf82d..5c6296c 100644
--- a/.kiro/specs/plane-on-kubernetes/requirements.md
+++ b/.kiro/specs/plane-on-kubernetes/requirements.md
@@ -21,6 +21,16 @@ production entry point (a delta Run for a push) is added. Context: `brief.md`, `
   `harnessx-removal` Req 6 (memory on the S3 store) keeps holding; nothing is deleted before its replacement
   passes its test (the `harnessx-removal` sequencing rule).
 
+## Target Environment (maintainer, 2026-10-02)
+
+- **Cluster: k3s.** Consequences: containerd (no Docker socket; the engine's host-Docker path does not exist there),
+  gVisor needs `runsc` and a `RuntimeClass` installed on the nodes Substrate's workers run on, k3s ships Traefik
+  and local-path storage, and single-node k3s is close enough to kind that the kind proof transfers.
+- **Images and source: GitHub.** Images are published to GitHub Container Registry (`ghcr.io/norandom/...`),
+  built by GitHub Actions from tagged commits, digest-pinned in the manifests; private packages need an
+  `imagePullSecret` on the worker and reconciler ServiceAccounts. Substrate's and ax's own images are built with
+  `ko` from their checkouts and pushed to the same registry.
+
 ## Requirements
 
 ### Requirement 1: Nothing assumes this host
@@ -30,7 +40,7 @@ configuration value, so the plane runs the same on kind and on the target cluste
 
 #### Acceptance Criteria
 
-1. The kube context, the registry, the ax-server address, the router address, the receiver address and the
+1. The kube context, the registry (GHCR in production), the ax-server address, the router address, the receiver address and the
    snapshot and memory buckets are configuration (environment or one config file), with the kind values as the
    documented defaults for development; no module names `kind-ousast`, `localhost:5001` or `172.19.0.1`.
 2. `ousast plane doctor` checks the configured cluster, not kind by name, and reports each configured address.
diff --git a/.kiro/specs/plane-on-kubernetes/spec.json b/.kiro/specs/plane-on-kubernetes/spec.json
index 4c5ee44..375de51 100644
--- a/.kiro/specs/plane-on-kubernetes/spec.json
+++ b/.kiro/specs/plane-on-kubernetes/spec.json
@@ -1,13 +1,22 @@
 {
   "feature_name": "plane-on-kubernetes",
   "created_at": "2026-10-02T20:00:00Z",
-  "updated_at": "2026-10-02T20:00:00Z",
+  "updated_at": "2026-10-02T20:30:00Z",
   "language": "en",
-  "phase": "requirements-generated",
+  "phase": "requirements-approved",
   "approvals": {
-    "requirements": {"generated": true, "approved": false},
-    "design": {"generated": false, "approved": false},
-    "tasks": {"generated": false, "approved": false}
+    "requirements": {
+      "generated": true,
+      "approved": true
+    },
+    "design": {
+      "generated": false,
+      "approved": false
+    },
+    "tasks": {
+      "generated": false,
+      "approved": false
+    }
   },
   "ready_for_implementation": false
 }