Week 5 of Building a Software Factory: Running It Without SSH
Kairos is at 100% on the OpenSSF Best Practices badge, at the passing level. I checked the project page directly rather than take an internal report's word for it: badge_percentage_0: 100, badge_level: passing. The rest of the week went to supply chain fixes, maintainer lifecycle documentation, and closing out the monorepo consolidation.
What shipped
OpenSSF badge. Two code changes helped close the last of it. yamllint is now strict, which is what the badge's warnings_strict criterion asks for (kairos#4440), and generated release notes carry a "Security fixes" section (kairos#4436). Both merged on 1 September. Most of the work was not code: an audit of the remaining criteria found 11 answers that had gone stale since the repositories were reorganized into one, and those are corrected. The audit's tracking issue (kairos#4243) is still open.
Supply chain. A memory-exhaustion denial of service, fixed by bumping the quic-go/webtransport-go dependency (kairos#4497), and the kcrypt-challenger base image pinned by digest instead of a floating tag (kairos#4498). Both merged on 4 September.
Issue tracking consolidation. The consolidation of every kairos-io repository's issue tracking into a single place is finished, and it is now written up publicly as "One Repo, One Pipeline, One Version", merged on 31 August.
Maintainer lifecycle. Onboarding and emeritus-maintainer sections were added to GOVERNANCE.md (community#41) and the contributor ladder is now linked from CONTRIBUTING.md (kairos#4501). Both are items on the CNCF Incubation application checklist.
Disclosure on merged commits
Commits on this website's repository and on my homelab repository now carry a Co-developed-by: <model> <email> trailer in the commit message body. That is the same mechanism I already use on contributions to kairos-io.
The mechanism these two repositories were using did not survive merging. Both use GitHub's squash and rebase strategies, which rewrite the commit's committer field to GitHub itself, and a distinct committer field was what marked a commit as having involved AI assistance. I checked the default branches: 0 of 25 commits on homelab and 0 of 6 on this site carried the mark after merging, even though the mark was real on the branch before the merge. A trailer in the message body survives a squash or a rebase.
The numbers
| Activity | 22–28 Aug | 29 Aug – 4 Sep |
|---|---|---|
| Changes shipped to Kairos | 12 | 36 |
| Changes to the agent factory itself | 27 | 14 |
| Changes to this website and the homelab | 18 | 1 |
| Architecture decision records written | 2 | 1 |
| Postmortems filed | 0 | 0 |
| Internal board: issues opened / closed | 94 / 79 | 114 / 101 |
I counted this week's column directly, with GitHub search and git log over the 29 August to 4 September window. That is not necessarily the same counting method behind the earlier columns, so read the comparison with that in mind.
Last week I subtracted twenty-four date-triggered reminder tickets from the opened count. There was nothing to subtract this week: of the 114 issues opened, none were that kind of ticket.
The single architecture decision record is the one about the disclosure trailer above.
Working from an airport
I was away for a wedding this week. At the airport I discovered I couldn't SSH into the machine running the factory. A Tailscale update had broken the way I reach it, and because that machine is also my jump host into the rest of the homelab, there wasn't much I could do about it remotely.
It turned out I didn't need to. The factory kept delivering tickets without me making any manual changes on the machine.
With this many tickets moving at once, the harder part was figuring out which ones were actually blocked on me. The morning standup I added this week gave me that view.
As before: this post was drafted by the system it describes, and I reviewed, edited and merged it myself. If you want to follow along you can subscribe to the RSS feed, find me on LinkedIn or YouTube, or say hello through my contact page.