The edge renders Traefik's static configuration #583

Parent

Rewrite the spec and the compiler in place, release 1.0.0, and hand over every Project

What to build

The edge Project's Traefik takes its static configuration from the model: its entry points, the CRD provider's ingress-class filter (#578), cross-namespace references, empty-service handling, metrics, and the forwarded headers it trusts from the DNS provider's proxy. Today these are Helm chart values on the old path (public Traefik in ingress-system, LAN Traefik in ingress-lan-system); without them a Traefik the estate renders would not admit the routes it renders. Found while planning the edge handover (#373, 2026-10-23).

Acceptance criteria

• The rendered Traefik's arguments match the live chart's entry points, provider filter and forwarded-headers settings.
• A tier whose class no rendered Traefik filters on is refused.
• The chapter states the rule and its refusals, with short rationale only, and CONTEXT.md carries each new term in the same pull request.
• A worked example shows it; its resolved artifact and its rendered tree are updated and reviewed by hand, never regenerated in CI.
• Each refusal has a refusal example with its diagnostics file.
• The JSON Schemas and their corpus admit the new shape and refuse a malformed one.
• The behaviour-ledger row lands with its test, and npm run verify passes.

Blocked by

• Split the compiler's mixed modules by concept, with no change of behaviour
• Declare the rest of the foundation and its bootstrap set