From b71ff906615640a8530bed21b724a60498da4358 Mon Sep 17 00:00:00 2001 From: atlas Date: Thu, 17 Sep 2026 00:02:00 +0200 Subject: [PATCH] docs/swarm/credentials.md: restore the new-vs-existing progressive-enhancement split The rewrite in #4445 flattened this section's new-functionality-vs- existing-functionality split into unconditional rules, because it had been anchored to the current-state table that PR deleted. Restore the split on its own terms, per #4445's own description of the rule: new functionality has to match the target shape immediately; existing functionality can move step by step, provided each step moves toward the target shape. Refs #4445 --- docs/swarm/credentials.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md index 680848b6..61b89a4d 100644 --- a/docs/swarm/credentials.md +++ b/docs/swarm/credentials.md @@ -56,7 +56,12 @@ strategy for every credential, including the mTLS leaf. | `swarm/services//oidc/client` | authelia | the service process that presents the client secret, under the certificate of the host it runs on | must be stated | | _(not in the store)_ the mTLS client leaf | the store's own PKI, or an operator placing it by hand | its own client, off disk — the sole exception above, because it's what makes every other row's pull possible | must be stated | -## Touching a credential +## Progressive enhancement + +New functionality has to match this shape immediately — no PR introducing a +credential gets a pass on any of the rules below. Existing functionality can +be moved step by step, as long as each individual step moves toward the +target shape; a step that doesn't isn't allowed just because it's existing. A pull request that touches a credential can't: