railiance-cluster/workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	related	state_hub_workstream_id
RCLUSTER-WP-0017	workplan	Review NetKingdom signer runtime and node-local storage readiness	financials	railiance-cluster	active	codex	railiance	2026-10-16	2026-10-16	implementation	CUST-WP-0080 FLEX-WP-0024 RPF-WP-0035 RCLUSTER-WP-0014 RAIL-BS-WP-0014	f383557d-c8a8-553e-adcd-9f82ff9c2929

RCLUSTER-WP-0017 — NetKingdom runtime/storage review

This source-review work record is limited to railiance-cluster INTENT: verified healthy runtime, scheduling headroom, admission/storage constraints and node-local failure-domain facts for the retained flex-auth signer successor. It does not own the Access workload, chart, Helm values or release; Platform OpenBao/ESO or ArgoCD Applications; Enablement ArgoCD installation; Secrets public trust; or founder approval. It neither reopens completed capacity work nor duplicates Access implementation. Current single-node storage remains a single failure domain; ThreePhoenix/Longhorn is not a prerequisite or current capability.

Origin: CUST-WP-0080 request for independent runtime/storage review of CCR-2026-0050 and the Access signer rollout. Custodian-side read-only preparation is historical input, not a prior formal owner disposition. The conflated legacy cluster-gitops-owner role cannot be accepted by this repo; review the precise successor source role independently. Founder human approval and distinct owner reviews remain necessary before every live action.

Review exact runtime and storage source boundary

id: RCLUSTER-WP-0017-T01
status: done
priority: high
state_hub_task_id: "6ee408cd-c055-532d-bc80-f64c9bdf143b"

Read exact successor source/CCR/rollout/custody revisions against this repo's INTENT; record a formal runtime/storage-only review under delegated-owner-review canon once this work record exists in the ownrepo checkout. Authenticate the actual Platform Applications and Access release responsibilities. Retain source hashes and current metadata evidence, and keep changes requested visible. A role rename alone does not supply native acceptance or another owner's assent.

Preparation evidence: Custodian docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/. Those observations are dated and must be refreshed at the actual native window. No formal review or native result is backfilled from this preparation.

2026-10-16 formal source review completed from this ownrepo checkout under RCLUSTER-WP-0017-T01 after canonical record creation. Reviewer for each entry: railiance-cluster-owner (agent railiance-cluster, codex), decision approved for the exact bounded source scope only, based on INTENT Runtime Not Workloads and Healthy by Verification:

• Platform R5 owner-boundary correction, Platform Git revision 84c529f239c81e6d3ca337015700b03e3a862f53, manifest sha256:78003b1b4da481ce20b194062ddde10fa94147dbffc4c8e74a42850bf1dacfe0. Precise cluster-runtime-storage-owner replaces the conflated role; six source hashes match. R5 typed public metadata preserves R4 executor/tests independently checked by54 focused tests. Platform Applications/freeze and Access workload/ Helm remain independently owned; cluster does not review for either role.
• Access rollout R2 runtime/storage and maintenance source proposal, manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59. Chart Git revision dc042022f7c30671cf0a7605cf43ef6d96d04242; image source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0. Exact archived retained/stopped/ready Helm renders independently reproduced; full Deployment differs only replicas0/1 and encoded source projection matches. Source hooks absent; unsafe replica inputs refused. Stop uses reset-values/ no-hooks, wait=false/no atomic: WaitForFirstConsumer may leave the claim Pending and automatic rollback to the running predecessor would break the intended fence. Ready atomic requires the exact newly established stopped revision be authenticated as rollback target. Command success and source projection are insufficient to prove actual generation/pod exclusion or admitted projection.
• Platform custody packet P4 source-selection/ownership join, manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3. All packet hashes, exact Git source bundle/plan, execution-bundle digest and rollout R2 projection join verified. Eight disposable assembler tests passed. P4 corrects frozen P3 controller-ownership prose; no predecessor is rewritten. Workload/Helm rollback remains Access-owned, Application freeze/restoration Platform-owned, consumer/trust Secrets-owned and runtime/storage/PV retention cluster-owned. Actual held window/fence, founder entity, absolute expiry, approved/binding-confirmed CCR and native dispositions remain absent.

Full bounded reviews and verification: the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/ formal-platform-r5-source-review.json, formal-rollout-r2-source-review.json, formal-packet-p4-source-review.json and rollout-r2-independent-verification.json. These source entries cannot fill the completed native-scope review slot or be recorded as CCR/read-lane/custody approval, founder decision or another owner's assent. T01 is done for exact source review only; the active plan retains T02/T03 for fresh native preflight/held window/exclusion and approved actual binding/PV Retain verification. Dated18:02UTC observations remain historical. No live action occurred and no source review promotes native readiness or spend/risk authority.

Review the bounded native preflight and storage action

id: RCLUSTER-WP-0017-T02
status: progress
priority: high
state_hub_task_id: "7f4320c6-8bb5-598e-9b9a-65565091276f"

Given actual exact successor owner dispositions and window, independently review cluster identity, node health/requested/observed headroom, quota/LimitRange, local-path behavior, admission-defaulted stopped projection and exclusion checks. Access owns workload stop/start and release rollback; Platform owns any Application writer freeze. Require exact caller/source/image/fence/expiry pins, Ready120seconds, recovery decision600seconds, founder abort ownership and explicit local-storage/outage/loss disposition. This task prepares review and records unresolved gates; it does not grant execute authority.

2026-10-16 T02 advanced on actual sanitized read-only runtime observations and seven exact server-side dry-runs at18:53:06–18:53:12UTC, receipt sha256 7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b. The node and cluster identities match the intended estate; node Ready is True, Memory/Disk/PIDPressure False. All seven R2 resources were admitted and the server-defaulted stopped Deployment returned replicas0 and canonical Platform projection8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c. This is real admission proof without persistent change; the actual generation4 Deployment still has one running old05a replica at deployed Helm revision4. Actual stopped state, held window, custody and native signed acceptance are absent.

Owner runtime/storage execution-plan review is approved for exact frozen R2 manifest5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59, P4 manifest9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3, chartdc042022f7c30671cf0a7605cf43ef6d96d04242, Platform84c529f239c81e6d3ca337015700b03e3a862f53 and image09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f, strictly subject to the mandatory observed execution gates in the review artifact. This owner plan review does not fill the five-role completed native scope slot, grant founder ADMINISTER authority or review Access Helm/Platform Applications. Reviewer: railiance-cluster-owner (agent railiance-cluster, codex), precise role cluster-runtime-storage-owner. INTENT basis: Runtime Not Workloads, Healthy by Verification, Consistent Baseline and Managed Access.

Observed CPU usage1539m/38%, memory8989Mi/56%; no namespace ResourceQuota, LimitRange or PVC. Free node-local filesystem125704314880bytes exceeds proposed 1Gi by124630573056bytes, without a reservation or hard quota. StorageClass local-path remains WaitForFirstConsumer/Delete. Thus stop must tolerate Pending PVC; ready requires the actual stopped rollback revision, controlled WFFC binding and exact actual PV/claim identity plus separately authorized Retain readback before durable acceptance. No guessed PV may be changed. Ready120seconds and recovery decision600seconds remain required; founder must disposition outage, node-local evidence loss and EUR spend/risk ceilings. Preserve every outbox, cursor and receipt under abort; no delete/reset/remint/unsigned fallback. Scheduling allocation parsing and immediate-window refresh remain explicit gates; source reviews and this dated preflight do not reserve node capacity.

Evidence and complete bounded review: the-custodian/docs/changes/netkingdom-target-2026-10-16/native-preflight-r1/ live-preflight.json, coordinator-review.json, cluster-native-plan-review.json. T02 remains progress until authenticated exclusive-window/exclusion and exact native-scope disposition exist. T03 remains todo for actual binding/PV Retain and approved runtime result; no successful live result is backfilled here.

Verify the approved runtime and storage result

id: RCLUSTER-WP-0017-T03
status: todo
priority: high
state_hub_task_id: "747a8d77-5c02-5b26-ba9c-385f75f3ac1c"

Only after separately approved native action, verify the actual bound1Gi PVC UID, PV UID/name/claimRef/capacity/node affinity and exact Retain readback; refresh node health/headroom and non-overlap observations. Any runtime/storage mutation must have its own exact founder approval and scoped executor. The future bound PV cannot be selected or mutated in advance. Retain is not backup, node-loss protection or a filesystem quota. Preserve unknown outcomes and the original evidence; do not reset cursor/outbox, delete PVC/PV or remint custody.

If native action is not approved, keep this task open with its concrete unresolved gates. Do not imply rollout/custody/trust acceptance. Complete this workplan only after source review, bounded preflight disposition and actual approved runtime/storage result are evidenced, or explicit scope cancellation.