nordisk/holger

Holger — Evolution (umbrella)

The big-picture driver for Holger's evolution, assembled from workspace_nordisk/PLAN.md

• holger's .nornir plans/design docs + Rickard's demo braindump (2026-06-28). Links out to the detail docs. The cleanup track (arsstadning-2026-06-28.md) is SEPARATE.

North star

An Artifactory/Nexus-grade, airgap-native, znippy-backed artifact server: immutable content-addressed storage, one front door for stock package managers + a holger-native gRPC surface, build-once promotion (dev→staging→release as a pointer move), and a static (sealed, zero-egress) vs dynamic (writable, proxy) profile chosen by crate boundary, not #[cfg].

Nordisk laws (hard constraints)

Zero-copy throughout · zero-alloc hot loops · GATLING for parallel produce→save (incl. the network save stage) · no shelling — pure Rust · extend helpers, never reinvent (znippy, znippy-zoomies, skidbladnir, facett, nornir) · all UI = facett components + theme, exposing state_json() · CLI ⇄ gRPC/UI symmetry · tests inject+assert real output, over the live/protocol path · perf-critical code ships a bench · every feature ships a matching .nornir/ doc.

The spine (themes → detail)

• Demo + operator UI / Tools menu → holger-demo-plan.md · shiny detail facett/.nornir/holger-demo-shiny.md. Logo splash, static "silent-running" mode, the 4 Tools (holger-ds · migrate/suck · Móðguðr security · Skíðblaðnir deploy), 3D graph views.

  • Web-demo publisher (cargo xtask demo-wasm / deploy-pages) — builds holger-demo to wasm and force-pushes the static dist/ to the pages branch (the pages host; the demo went with holger-demo). Per LAW #5 (DRY) the ~443-LOC flow that used to live in xtask/src/demo.rs (compile → wasm-bindgen → optional wasm-opt -Oz → cache-busted index.html + Pages .domains/.nojekyll → orphan-pages force-push) was deleted and now lives once in the edda/crates/nornir-pages leaf; xtask/src/main.rs just builds a nornir_pages::PagesConfig of holger's eleven knobs (demo_crate holger-demo, canvas demo_canvas, state hook __holger_state, title/description, HOLGER_PAGES_REMOTE, …) and calls nornir_pages::{demo_wasm,deploy_pages}. The gen-proto and build xtask verbs (+ gen_proto.rs) are untouched. Generated .domains/.nojekyll stay byte-identical; index.html moves to the shared (facett-canonical) template — same rendered page, canvas id, state hook and ?v=<short_rev> cache-bust, differing only in comment wording / CSS whitespace.

• Static/dynamic profile — two binaries (static-holger/holger), BackendProvider trait, egress provable from cargo tree; offline OIDC (static-dynamic-profile-design.md, auth-rbac-design.md).

• Promotion (dev→staging→release) — seal → pointer-move → audit → CLI → gate → bundles (promotion-design.md).

• Artifactory/Nexus parity — immutable znippy CAS + archive manifest (pin format version!), policy gate, virtual/group repos, retention/GC, SBOM, search, scoped tokens, replication (artifactory-parity-design.md).

• Remote-cache backend trait — implemented: RemoteUpstream trait with NexusUpstream/ArtifactoryUpstream impls, shared UpstreamAuth, wired via the nexus-remote/artifactory-remote repo types (see design.md §9b).

• Embedded-holger / nornir-release arc — in-process holger in nornir-server; tier-3 release promote --brave (workspace_nordisk/PLAN.md §O).

• Security / Móðguðr — shared scanner in a 3rd repo (vuln + SCIP world-delta + tripwires); static stays dumb-but-safe (validate-then-switch-znippy) (nornir/.nornir/modgunn-security-scanner.md).

• Hardening / OT readiness + E2E conformance — default-deny-configurable RBAC, real client⇄holger container conformance (auth-rbac-design.md, end-to-end-conformance-testing.md).

• Consolidate to helpers (from the cross-repo årsstädning) — take the znippy-zoomies gatling dep; drop holger's parallel .tar.zst engine for znippy-core; facett-ize the hand-rolled egui::Grid panels; blake3-keyed CAS. See workspace_nordisk/.nornir/arsstadning-cross-repo-2026-06-28.md.

Common-framework parity (2026-07-14)

holger's operator GUI joined the suite-wide shared common framework (JetBrains-style): it already consumed skidbladnir (lifecycle + own holger user), nornir-service (serve loop), jera (promote/GC job ledger) and facett (UI). This slice closed the two GUI gaps — an About identity surface (about.rs, names the shared components it is built on) and a Tools · Demo appliance that starts a pinned demo registry container THROUGH the shared jera job manager (infra.rs, a ContainerSpec recorded as a durable BOOT_CONTAINER job — no thread::spawn), mirroring korp's about.rs/infra.rs. See common-framework-design.md.

Cross-repo dependencies

znippy (typed-views, seal, CMS signing, format-version enforcement) · znippy-zoomies (gatling, capped codecs) · skidbladnir (install/airgap/PKI/machines/deploy) · nornir + Móðguðr (security plane, SCIP world-delta, warehouse) · facett (UI look/components) · jera (shared job manager — promote/GC ledger + the Tools demo container).

Definition of done

Smallest shippable slice; extend helpers; DONE = green tests (inject+assert, protocol path) + bench where perf matters + matching .nornir doc + CLI and gRPC/UI symmetry for any new capability.