E0: OCM substrate and falsification

[gnanirahulnutakki]

Goal. prove, in a lab, that OCM's cluster-proxy + managed-serviceaccount deliver outbound-only, cross-network, reach-cluster-local-services connectivity with scoped tokens — so the whole "build a transport/agent" scope can be deleted.

Phase / depends. M0 · Depends on: nothing · Nature: a spike, not product code. The only artifacts are a documented yes/no verdict and a reproducible runbook. No Sith product code is written until this passes.

Capabilities: minions (OCM outbound agents); the falsification that deleted bespoke-transport scope (ADR-0001 Accepted — M0 PASSED).

Features

• F0.1 — hub + spoke lab provisioning
• F0.2 — OCM addon enablement
• F0.3 — reach a spoke-local service through the tunnel
• F0.4 — scoped token projection
• F0.5 — outbound-only verification
• F0.6 — falsification verdict and runbook

Tracked issues (already filed)

• M0: Provision OCM hub + 2 kind/k3d spokes (lab) #2 — F0.1
• M0: Enable cluster-proxy + managed-serviceaccount addons (pin v0.10.0) #3 — F0.2
• M0: Reach a spoke's in-cluster Grafana/Argo CD from the hub via scoped token #4 — F0.3 / F0.4
• M0: Verify spoke connections are outbound-only #5 — F0.5
• M0: Record falsification verdict in ADR-0001 + runbook #6 — F0.6

Exit criteria

• OCM hub + 2 spokes stand up, both Available; both addons healthy at pinned v0.10.0.
• The hub reaches a spoke-local service through the cluster-proxy tunnel using a scoped MSA token, on both spokes, with no cluster-admin kubeconfig anywhere.
• Spoke → hub traffic is verified outbound-only with no inbound port required.
• ADR-0001 records the verdict and setup time; a redacted runbook and a demo capture exist.
• The transport-build scope is deleted (on "yes"), or work stops for re-evaluation (on "no").

---

Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).

[gnanirahulnutakki]

E0 is complete through PR #73, merged into dev at 017eec0.

All tracked children #2–#6 are closed as completed. One hub plus two spokes passed the pinned addon, scoped-token reach, negative RBAC, active hub-ingress denial, and outbound-only conntrack acceptance matrix from a clean start in 151 seconds. PR CI run 29172067820 and post-merge dev CI run 29172228828 are green; cleanup left zero kind clusters and scratch directories.

ADR-0001 is accepted, the runbook and redacted capture are merged, and the bespoke transport scope is deleted. Phase 1 may proceed.