Endura scope for CIQs own pipelines - include Fuzzball, Warewulf, Ascender and Depot; exclude Apptainer

Situation

Eric Sheridan of Infrared Security updated Peter on the Endura proposal for securing CIQ build pipelines, noting Nathan and Justin had reviewed the Koji integration strategy positively and that Bjorn was excited about using Endura to protect Rocky core packages. Eric asked whether scope should extend beyond Rocky to Fuzzball, Warewulf, Apptainer and Ascender. Peter replied to include Fuzzball, Warewulf and Ascender, said Apptainer should not be necessary, and added a product Eric had not asked about - Depot - on the grounds that projects which serve CIQ products to customers should be included as well. Pricing follows this scope, and a call with Greg and Bjorn was set for Wednesday.

Reasoning

This is a different axis of the Endura relationship from the 7/24 pass-through decision, and Peter confirmed the split. The 7/24 decision gated an Endura pass-through go-to-market OFFERING on it consuming zero engineering this half. This email concerns Endura securing CIQs OWN build pipelines - a cost line, not a product line - so the zero-engineering gate does not bind and Peter was free to widen rather than narrow. His inclusion test is customer exposure, not dependency count: he explicitly discounted the technical argument by noting the products do not have terribly many upstream dependencies but there is no reason not to include them, then reached past Erics list to add Depot because it serves CIQ products to customers. The Apptainer exclusion follows the same logic in reverse - it is the one item CIQ does not commercially deliver the same way. Answering before pricing means the scope Peter chose is what gets priced, rather than Peter reacting to a number built on Erics default scope.

Additional Context

Nathan, Justin and Eric had already met on the architectural strategy for integrating secure builds into the Koji runtime; Endura built Koji package discovery in Team Server and documented a Mock plugin strategy for the Runtime Sensor. Bjorn met Eric the prior Thursday. Peter confirmed both the reading and the split from the 7/24 pass-through decision.

Observed Evidence

Direct quote from Peters sent email, answering a scope question and volunteering an addition beyond what was asked.

Matching Patterns

Confidence Breakdown

Reasoning Depth Analysis