audit-core/workplans/AUDIT-WP-0016-wave2-resource-right-sizing.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
AUDIT-WP-0016	workplan	Wave-2 resource right-sizing from the 2026-10-21 allocation review	infotech	audit-core	ready	implementation	claude	audit-evidence-dependencies	2026-10-21	2026-10-21	CUST-WP-0071 RESOURCE-WP-0008	83580194-1df2-586d-8c97-aabbfe185716

AUDIT-WP-0016 — Wave-2 resource right-sizing from the 2026-10-21 allocation review

Receiving workplan in audit-core for the wave-2 request changes below.

Origin: the 2026-10-21 node allocation review (RESOURCE-WP-0008-T03, feeding CUST-WP-0071-T03). Per the founder's 2026-10-21 delivery interview (the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md) the small adjustments form wave 2: one receiving task per owner repo, applied later in a batch. Applying wave 2 needs a separate founder approval, so every cluster-write task here is a human-gated wait. This file changes no manifest.

Apply the reviewed request changes

id: AUDIT-WP-0016-T01
status: wait
priority: medium
needs_human: true
blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
state_hub_task_id: "2b155f40-6736-5322-91dc-1d89f37b6fd6"

Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.

Workload (ns/name)	Pods	CPU request	CPU limit	CPU p95/peak 7d (m)	Memory request	Memory limit	Mem p95/peak (Mi)	Throttle	Action
audit-core/audit-core	1	50m → 10m	500m	1.5/12.2	64Mi → 64Mi	256Mi	26.4/26.6	0.001	decrease

Source and container detail:

• audit-core/audit-core: Deployment audit-core, container audit-core, deploy/audit-core.yaml (50m/64Mi, limits 500m/256Mi).

Evidence: resource-control docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md (+ .json, commit 3d9b1bd). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).

Steps:

1. Map the pod-aggregate proposal onto the named container(s) in the source file; where a workload has several containers or pods, split by the per-pod figures in 2026-10-21-workload-usage.json and keep the sum at the proposed value.
2. Prepare the source change as a reviewed commit (no push, no sync) and record the before values here.
3. Apply only inside the batched wave-2 rollout, after founder approval, through the owner's normal deploy path (ArgoCD sync or documented helm/kubectl apply).

Verification: kubectl -n <ns> get pod -o jsonpath='{..resources}' shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.

Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after kubectl get -o yaml captures as the receipt.

Prepared 2026-10-22 (wave-2 worker W1b)

Status stays wait / needs_human. Local commit only: not pushed, not applied. Diff = full owner render vs live (kubectl diff, object names and changed key paths only, Secret objects skipped).

• Live source: deploy/audit-core.yaml, applied client-side.
• Change: audit-core 21b7d7c: CPU request 50m -> 10m.
• Diff: deploy/audit-core.yaml alone changes resource fields only. The full deploy-dry-run set also shows two drifts: (a) ConfigMap audit-core-senders-scope would gain the heartbeat_classes entry for informed-decision from unapplied commit 70e4044, and (b) the one-shot audit-core-migrate Job would be recreated. Apply only the Deployment file.
• Apply: kubectl apply -f deploy/audit-core.yaml.