From 6ac089bbcbfd20c52e6d9e9a1c5c216846266ba4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 22 Oct 2026 00:09:13 +0200 Subject: [PATCH] Wave-2 right-sizing: record prepared change, diff verdict and apply command Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 276069@bnt-lap001 Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c --- workplans/FLEX-WP-0038-wave2-resource-right-sizing.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md index 47ce0a3..b636642 100644 --- a/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md +++ b/workplans/FLEX-WP-0038-wave2-resource-right-sizing.md @@ -43,3 +43,12 @@ Verify: every flex-auth pod is Ready, with no restarts or OOM kills over 24 hour authorization decision latency is unchanged, and the next weekly allocation report shows no CPU throttling. Rollback: revert the values commit and redeploy through the existing path. + +## Prepared 2026-10-22 (wave-2 worker W1b) + +Status stays `wait` / `needs_human`. Local commit only: not pushed, not applied. Diff = full owner render vs live (`kubectl diff`, object names and changed key paths only, Secret objects skipped). + +- Live source: 9 Helm releases `flex-auth-*` from `charts/flex-auth` with `values/.yaml`. The `values/access-engine/*` files render differently named objects and are not deployed. +- Change: access-engine `36465de`: chart default request 25m/32Mi -> 5m/20Mi. Overrides: application-readback 24Mi, informed-decision-lifecycle 24Mi, informed-decision-sitting 40Mi (up, because p95 is 35Mi), informed-decision-t03 16Mi. CPU is 5m for every release. Total 45m/204Mi, compared with 176Mi proposed; the difference comes from per-pod rounding. +- Diff: NOT resource-only. In 8 of 9 releases, the chart at HEAD adds `--caller-audience` to the container args (`flex-auth` or `access-engine`, depending on the release). informed-decision-sitting also changes image. Only `flex-auth-ops-warden` diffs resource-only. This drift goes to the founder before any helm upgrade. +- Apply (per release, after founder OK): `helm upgrade --install flex-auth- charts/flex-auth --namespace flex-auth -f values/.yaml --wait --timeout 2m`.