# Phase 1 — atlas core

~4 days. Every surface depends on this. RED → GREEN → REFACTOR.

## RED (write tests first, confirm they fail)

- [ ] `redact_test.go` — golden test: serialized snapshot contains none of the denied fields, run against a fixture captured from the real cluster
- [ ] `rbac_test.go` — atlas ServiceAccount receives 403 on `get secrets` in every namespace
- [ ] `snapshot_test.go` — an informer event produces the expected delta

## GREEN

- [ ] ClusterRole: verbs `get,list,watch` only, explicit resource list — no `secrets`, no `*`, no wildcard apiGroups
- [ ] client-go informers: kube API (nodes, namespaces, workloads), Argo CD `Application` CRs
- [ ] Reducer: informer events → in-memory snapshot, redacted **at write time**
- [ ] DTO construction — allowlist only. Emitted: name, namespace, kind, phase, ready counts, restart count, age, node name, health status, sync status, sync wave, explicit label subset. Never emitted: container env/args, image digests/tags, `spec.source.repoURL`, `spec.source.path`, annotations, pod IPs, cluster IPs, Secret names, `status.conditions[].message`, node internal IPs
- [ ] Redis publish (snapshot deltas → `kmsvc-redis-master.sqs:6379`)
- [ ] NetworkPolicy on atlas: egress restricted to kube API, `prometheus-operated.monitoring`, `reasoning-predictor.llm-serving`, `kmsvc-redis-master.sqs`; ingress from `ingress-nginx` only
- [ ] Container hardening: `runAsNonRoot`, read-only root filesystem, all capabilities dropped, `seccompProfile: RuntimeDefault`

## REFACTOR

- [ ] Run `simplify` skill pass on reducer/DTO code
- [ ] Confirm no `_ =` on errors, no naked returns, every upstream call carries a `context.Context` (go-error-handling, go-context skills)

## Verify

```bash
kubectl auth can-i get secrets --as=system:serviceaccount:portfolio:atlas   # no
go test ./... -run TestRedact -v
go test ./... -run TestRBAC -v
go test ./... -run TestSnapshot -v
```

Next: [03-phase2-topology.md](03-phase2-topology.md)