exp(M0): OCM falsification PASS — adopt OCM, delete bespoke-transport scope

[gnanirahulnutakki]

Milestone-0 — the OCM falsification test → ✅ PASS

The falsification-first experiment that gates ADR-0001. Run before any product code, exactly as ROADMAP Milestone-0 specifies.

Verdict

A central OCM hub reached an in-cluster service (nginx.sith-demo) on a managed spoke using a scoped managed-serviceaccount token, over the cluster-proxy reverse (konnectivity) tunnel, with the spoke connecting outbound-only and the hub holding no admin kubeconfig.

➡️ The "build the transport/agent" scope is deleted. Adopt OCM; build only the federation/governance layer above it. ADR-0001 → Accepted. Proceed to Phase 1.

The three claims, each with a negative control that would have falsified it

• Reach: hub GET of the spoke's cluster-local nginx returned the page — through the tunnel.
• Scoped, not admin: the same token was denied cluster-wide secrets and nodes (403) while in-scope service/pod reads succeeded. Reach and privilege are decoupled; the hub holds only the scoped token secret, no kubeconfig.
• Outbound-only: spoke conntrack shows every hub-directed flow originating on the spoke to hub:6443, and zero hub→spoke-initiated flows. The spoke needs no inbound port.

Environment / pins

kind (k8s v1.34.0) · clusteradm/OCM core v1.3.1 · cluster-proxy 0.10.0 · managed-serviceaccount 0.10.0 (matches the ADR pin). ~15 min end-to-end — well inside the ≤ ~1 day gate. System disk kept safe (182 GiB free after). Clusters torn down at the end.

Changes (docs only — no product code)

• docs/experiments/M0-ocm-falsification.md — runbook + verbatim command output for every claim, topology, caveats, resource footprint.
• docs/adr/0001-… — status Proposed → Accepted; falsification-evidence section filled in.

Honesty note

Found + worked around one upstream cluster-proxy 0.10.0 chart packaging skew (template sets a ManagedProxyConfiguration field its bundled CRD doesn't declare). Cosmetic, unrelated to transport; one-line CRD workaround documented. Worth filing upstream.

Based on docs/initial-plan (PR #1) so the diff is only the two M0 files. Addresses #2 #3 #4 #5 #6.

[gnanirahulnutakki]

Superseded by PR #73, which implemented and merged the final two-spoke M0 falsification into dev at 017eec0.

PR #73 includes the accepted ADR, reproducible fail-closed runner, one-hub/two-spoke evidence, active network-denial proof, least-privilege service-account validation, redacted capture, and signed GSTACK journal. Its PR CI run 29172067820 and post-merge dev CI run 29172228828 are green.

This older PR targets the obsolete docs/initial-plan branch and covers only the earlier one-spoke experiment, so it must not be merged.