Blockers

Generated by tools/traceability/trace.py build from the kit matrix, docs/implementation/traceability.yaml and the evidence recorded in docs/implementation/evidence/results/. Do not edit by hand.

Cross-cutting blockers

B-CLUSTER: No acceptance Kubernetes cluster

The only Kubernetes context on this host is production (eks-prod-01-admin): nothing is applied to it. Manifests are validated offline (helm, kubeconform, kyverno) and the operator is tested on envtest, without kubelets.

• What is needed: A dedicated acceptance cluster (kubelets, Cilium CNI, metrics-server, storage) and access.
• Exit criterion: Install, network isolation, drain and autoscaling tests pass on that cluster.
• Affected requirements: SECU-001, SECU-002, SECU-018, LICE-011, LICE-012, LICE-013, LICE-014, RELE-001, RELE-002, RELE-014, CLUS-001, CLUS-007, CLUS-012, HAVA-002, HAVA-003, HAVA-004, HAVA-005, HAVA-007, HAVA-011, HAVA-012, HAVA-013, HAVA-014, HAVA-015, HAVA-018, BACK-004, BACK-007, DR-002

B-CLOUD: No acceptance cloud accounts

AWS S3, Azure Blob, GCS and IBM COS adapters are proven on real emulators (SeaweedFS, Azurite, fake-gcs-server) and simulated token endpoints; the cloud profiles of this host are production and are not used.

• What is needed: Acceptance buckets or containers per provider with dedicated identities.
• Exit criterion: Storage tests pass against each real provider, immutability included.
• Affected requirements: DATA-002, DATA-003, DATA-004, AUDI-011, RELE-002, BACK-002

B-GPU: No GPU and no qualified model weights

This host has no GPU: vLLM and vision models do not really run.

• What is needed: An acceptance GPU node and the weights approved by the client.
• Exit criterion: vLLM and vision inference measured through the gateway.
• Affected requirements: LLM_-003, MULT-007, OBSE-014, HAVA-015

B-WEBRTC: No WebRTC media client

The real LiveKit server starts and accepts platform tokens; no UDP media client (browser) is available here.

• What is needed: A browser or WebRTC client on an acceptance network.
• Exit criterion: Media session, reconnect and latency measured.
• Affected requirements: MULT-001, MULT-002, RELE-011, HAVA-014

B-GATED: Gated pyannote weights

pyannote weights require accepting terms on Hugging Face.

• What is needed: Weights provided or approved by the client.
• Exit criterion: Real diarisation test green.
• Affected requirements: MULT-004

B-DOCKER: No Docker and no root

Docker (snap) is unusable and sudo is blocked: APISIX, Harbor and Tekton do not start here.

• What is needed: An acceptance host with a container engine or a cluster.
• Exit criterion: Real start and end to end tests green.
• Affected requirements: AGEN-013, BACK-012

B-CLIENT: Client decision or signature

Licence exception approval, RTO and RPO targets, PKI and HSM, acceptance signature: only the client decides.

• What is needed: The client's decisions and access.
• Exit criterion: Decisions recorded and acceptance signed.
• Affected requirements: FOUN-012, IAM_-018, MULT-011, DOCU-012, RELE-014, RELE-016, DR-002, DR-006, DR-007

Blockers per requirement

ID	Priority	Requirement (kit wording, French)	What remains or what blocks
FOUN-012	P0	Exceptions de licence PostgreSQL Redis client models	Client approval of the licence exceptions [B-CLIENT]
IAM_-018	P0	KMS HSM integration via client	client HSM or KMS (slot, PIN, key labels) [B-CLIENT]
AGEN-013	P0	API gateway APISIX auth rate limit	real APISIX start and ingress and egress policy test under traffic: Docker absent [B-DOCKER]
LLM_-003	P1	vLLM inference locale	real vLLM inference of an acceptance model: no GPU on this host [B-GPU]
MULT-001	P1	LiveKit room et streaming temps réel	voice session with real WebRTC media (UDP, ICE, codecs) needs a WebRTC client [B-WEBRTC]
MULT-002	P1	WebRTC reconnect low-latency	end-to-end WebRTC reconnect and latency: no WebRTC client [B-WEBRTC]
MULT-004	P1	pyannote diarisation	pyannote/speaker-diarization-3.1 weights gated on Hugging Face [B-GATED]
MULT-007	P1	VLM image/doc et vidéo frames	real vision model inference (GPU and qualified weights) [B-GPU]
MULT-011	P1	Licences codecs drivers models weights	model qualification: client approval of the exceptions (approval_status pending) [B-CLIENT]
OBSE-014	P0	Performance CPU GPU RAM concurrency	GPU measurements impossible: no GPU on this host [B-GPU]
SECU-001	P0	Falco runtime detection	Real Falco alert on a node (eBPF) not observable without a cluster [B-CLUSTER]
SECU-002	P0	Tetragon runtime enforcement	Tetragon enforcement effect measurable only on a cluster kernel [B-CLUSTER]
SECU-018	P0	Kill Switch network Cilium	Real CiliumNetworkPolicy isolation not verifiable without a cluster [B-CLUSTER]
AUDI-011	P0	Client storage WORM Object Lock capability	real Azure and GCS immutability [B-CLOUD]
LICE-011	P0	Registry Harbor and CI Tekton	Real publish then pull in Harbor through Tekton: cluster needed [B-CLUSTER]
LICE-012	P0	Git Gitea and GitOps ArgoCD	Real Argo CD sync: cluster needed [B-CLUSTER]
LICE-013	P0	Kyverno Cilium KEDA HPA Helm	In-cluster Kyverno, Cilium, KEDA, HPA controls [B-CLUSTER]
LICE-014	P0	Backup Velero and restoration	Real Velero backup and restore [B-CLUSTER]
DOCU-012	P1	Conformance and customer acceptance report	The PASS FAIL BLOCKED report with evidence is generated (RELEASE_READINESS, TEST_EVIDENCE); its signature by the client is still to obtain [B-CLIENT].
RELE-001	P0	Fresh cluster install automated	Automated install on a blank acceptance Kubernetes cluster cannot be replayed here [B-CLUSTER].
RELE-002	P0	BYO Kubernetes Postgres Redis storage	Real client Kubernetes, PostgreSQL, Redis and storage not available [B-CLUSTER] [B-CLOUD].
RELE-011	P0	Voice consent and participant identity	End to end WebRTC audio media (UDP, ICE, codecs) needs a WebRTC client [B-WEBRTC].
RELE-014	P0	Performance HA scale and RTO RPO measured	High availability, scale and node loss on a real cluster [B-CLUSTER]; RTO and RPO targets to be set by the client [B-CLIENT].
RELE-016	P0	Docs and support handover complete	Documentation and handover file delivered in FR and EN; the end to end acceptance signed by the client is still to obtain [B-CLIENT].
CLUS-001	P0	Six modes single host node group K8s existing K8s managed multi cluster external	Kubernetes mode operations on real kubelets and real multi-cluster [B-CLUSTER]
CLUS-007	P0	Node pools CPU GPU labels et placement contraint	actual pod placement on real GPU/CPU nodes [B-CLUSTER]
CLUS-012	P0	Gestion de plusieurs clusters et perte de connexion WAN	several real clusters separated by a WAN [B-CLUSTER]
HAVA-002	P0	Frontend backend Manager gateway répliqués en HA	real frontend/API/worker/Manager replica failure under load [B-CLUSTER]
HAVA-003	P0	HA Identity Policy Context Authority et Security Controllers	real IAM/policy replica failure [B-CLUSTER]
HAVA-004	P0	HA Audit Evidence SOC Kill Switch et Licensing	real central Manager and SOC loss on a cluster [B-CLUSTER]
HAVA-005	P0	Topology spread affinity PDB et drains planifiés	real PDB-compatible node and zone drain [B-CLUSTER]
HAVA-007	P0	HA PostgreSQL sous K8s via CloudNativePG	real CloudNativePG operator failover [B-CLUSTER]
HAVA-011	P0	HA Temporal persistence et jobs durables	multi-replica Temporal HA [B-CLUSTER]
HAVA-012	P0	HA des dépendances Keycloak LiteLLM Opik OpenFGA Qdrant OpenSearch	real HA of the dependencies at pinned versions [B-CLUSTER]
HAVA-013	P1	HA OTel Collector Prometheus Alertmanager	real OTel/Prometheus/Alertmanager replica failure [B-CLUSTER]
HAVA-014	P0	HA LiveKit avec limites de reconnexion rooms	real LiveKit node loss with a WebRTC client [B-CLUSTER] [B-WEBRTC]
HAVA-015	P1	HA vLLM et capacity GPU failover	real vLLM failover [B-GPU] [B-CLUSTER]
HAVA-018	P1	Autoscaling horizontal KEDA HPA et politique de quotas	real KEDA/HPA scale-up and stable return [B-CLUSTER]
BACK-002	P0	Storage adapter S3 Azure GCS IBM Seaweed BYO	Azure, GCS, IBM COS adapters against real providers [B-CLOUD]
BACK-004	P0	Velero backup Kubernetes manifests CRDs volumes compatibles	real Velero backup and restore [B-CLUSTER]
BACK-007	P0	Snapshots etcd et procédure restore control plane	real Kubernetes control plane rebuild [B-CLUSTER]
BACK-012	P0	Backup OCI Harbor manifests prompts skills plugins policies modèles	backup and reload of a real Harbor (projects, robot accounts, replication) impossible here, Harbor ships only as container images (core, jobservice, registry) with no standalone binary, and Docker, Podman and root are absent [B-DOCKER]
DR-002	P0	Modes active passive warm cold et active active stateless	real second site for active-passive and active-active [B-CLUSTER] [B-CLIENT]
DR-006	P0	DNS load balancer routes reconfiguration failover	real reconfiguration of the client's DNS and load balancer [B-CLIENT]
DR-007	P0	RPO RTO objectifs client et valeurs observées	RPO/RTO targets to be set by the client; measurement on a real site [B-CLIENT]