Declare Argo CD Core v3.5.3 on railiance01 and its resource bounds

Pinned core-install.yaml (sha256 1a87025d...c448) with a kustomize
resources patch for the four workloads. The unpatched pin diffs clean
against live; the resources patch is declared only, and its apply waits
on the founder in RAIL-EN-WP-0002-T02. SCOPE.md no longer says ArgoCD is
absent from railiance01.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

.gitignore

@@ -0,0 +1,2 @@
+deploy/argocd/*/upstream/
+__pycache__/

Makefile

@@ -10,4 +10,18 @@ check: ## Verify workflow templates remain private and deployment-free
 test: ## Run enablement regression tests
 	python3 -m unittest discover -s tests -v
 
-.PHONY: help check test
+ARGOCD_DIR := deploy/argocd/railiance01
+include $(ARGOCD_DIR)/PIN
+
+argocd-fetch: ## Fetch the pinned Argo CD core manifest and verify its sha256
+	mkdir -p $(ARGOCD_DIR)/upstream
+	curl -fsSL -o $(ARGOCD_DIR)/upstream/core-install.yaml $(ARGOCD_MANIFEST_URL)
+	echo "$(ARGOCD_MANIFEST_SHA256)  $(ARGOCD_DIR)/upstream/core-install.yaml" | sha256sum -c -
+
+argocd-render: argocd-fetch ## Render the declared Argo CD state (no cluster contact)
+	kubectl kustomize $(ARGOCD_DIR)
+
+argocd-diff: argocd-fetch ## Read-only server-side diff of declared Argo CD state against railiance01
+	kubectl kustomize $(ARGOCD_DIR) | ssh railiance01 'kubectl diff --server-side -n argocd -f -'
+
+.PHONY: help check test argocd-fetch argocd-render argocd-diff

SCOPE.md

@@ -74,25 +74,26 @@ services. S5 applications consume S4 templates and conventions, while
 
 ## Current State
 
-- Status: emerging, with reusable Forgejo workflow templates and an active
+- Status: emerging, with reusable Forgejo workflow templates and the
-  private-by-default template workplan.
+  railiance01 ArgoCD declared state (RAIL-EN-WP-0002 active).
 - S4 owns the consumer-facing contract for runner labels, registries,
   credentials, and artifact evidence. `railiance-forge` continues to operate
   those capabilities; they are not duplicated here.
-- Implementation: ArgoCD is deployed in the `argocd` namespace on CoulombCore as
+- Implementation: Argo CD Core v3.5.3 (headless) is installed on
-  a cluster addon managed from S2 — verified still true 2026-08-12
+  `railiance01` in namespace `argocd` since 2026-09-21. ArchitectureBlueprint
-- **But GitOps does not reach the live cluster.** ArgoCD is not deployed on
+  §5.6 (railiance-platform) is settled as **adopt properly**. Its declared
-  `railiance01`, its Applications target CoulombCore in-cluster, and no
+  state is `deploy/argocd/railiance01/` (RAIL-EN-WP-0002). It has 0
-  `railiance01` namespace is ArgoCD-managed. The live workloads deploy by
+  Applications and 0 AppProjects, so no workload is under GitOps yet; the live
-  Makefile, outside GitOps. Whether to adopt, retire or relocate ArgoCD is
+  workloads still deploy by Makefile. Adoption (phase B) and retiring
-  reopened — see `railiance-platform/ArchitectureBlueprint.md` §5.6
+  CoulombCore's ArgoCD (phase C) each need a founder go-ahead
-- Stability: n/a for S4-owned content; ArgoCD itself runs, but two of its
+- Stability: the pinned install matches live (read-only server-side diff,
-  Applications are Degraded and one is OutOfSync/Missing
+  2026-09-21); resource requests/limits are declared but not yet applied, so
+  the pods are BestEffort until RAIL-EN-WP-0002-T02
 - Usage: formal S4 tooling work begins after S3 baseline and should consume
   runner/registry capabilities from `railiance-forge` until that migration
   completes
 - Honest gap: this layer's `INTENT.md` promises considerably more than the repo
-  contains (25 commits, no workplans). Read that as open debt, not description
+  contains. Read that as open debt, not description
 
 ---
 

deploy/argocd/railiance01/PIN

@@ -0,0 +1,4 @@
+# Pinned upstream manifest for Argo CD Core on railiance01.
+ARGOCD_VERSION := v3.5.3
+ARGOCD_MANIFEST_URL := https://raw.githubusercontent.com/argoproj/argo-cd/v3.5.3/manifests/core-install.yaml
+ARGOCD_MANIFEST_SHA256 := 1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448

deploy/argocd/railiance01/README.md

@@ -0,0 +1,82 @@
+# Argo CD Core on railiance01 — declared state
+
+Owner: `railiance-enablement` (S4). ArgoCD is an S4 concern per
+railiance-infra (RAIL-HO-WP-0004 service inventory). Settled as
+ArchitectureBlueprint §5.6 option 1, **adopt properly** (founder,
+`GOVERN @ estate`, 2026-09-21).
+
+| Item | Value |
+|---|---|
+| Distribution | upstream Argo CD **Core** (headless: no API server, UI or Dex) |
+| Version | `v3.5.3` |
+| Manifest | `core-install.yaml` at tag `v3.5.3` (URL in `PIN`) |
+| sha256 | `1a87025d8eb2eae621653fd312fb9ca51df1b4b3b6992a030e3a9ef38e45c448` |
+| Images | `quay.io/argoproj/argocd:v3.5.3`, `public.ecr.aws/docker/library/redis:8.2.3-alpine` |
+| Namespace | `argocd` (created 2026-09-21T13:55:29Z) |
+| Objects | 34, server-side applied, field manager `kubectl` |
+| Applications / AppProjects | none (nothing adopted) |
+| Listeners | no LoadBalancer or NodePort Service (ADR-0008) |
+
+The live install was a direct `ADMINISTER @ realm:kubernetes/railiance01`,
+`activation=APPROVED` by the founder, performed by the custodian session on
+2026-09-21 (record: `the-custodian/docs/kubernetes-change-gate-decision.md`).
+This directory is its declared state. Evidence: `target-audited` for the
+install itself; this repository adds `external-audited` evidence from here on.
+
+## Files
+
+- `PIN` — pinned manifest URL, version, sha256 (included by the Makefile).
+- `kustomization.yaml` — pinned upstream plus `resources.yaml`.
+- `resources.yaml` — requests and limits for the four workloads.
+  **Declared, not yet applied** (RAIL-EN-WP-0002-T02).
+- `upstream/` — fetched manifest, gitignored; `make argocd-fetch` verifies it.
+
+## Read-only commands
+
+```bash
+make argocd-fetch    # download + sha256 check
+make argocd-render   # render declared state locally
+make argocd-diff     # server-side diff against railiance01 (read-only)
+```
+
+## Install (as performed 2026-09-21, pinned upstream, no resources patch)
+
+```bash
+make argocd-fetch
+ssh railiance01 'kubectl create namespace argocd'
+ssh railiance01 'kubectl apply --server-side --dry-run=server -n argocd -f -' \
+  < deploy/argocd/railiance01/upstream/core-install.yaml
+ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
+  < deploy/argocd/railiance01/upstream/core-install.yaml
+```
+
+## Apply the declared state (includes resources) — needs founder go-ahead
+
+```bash
+make argocd-diff     # expect: only resources on the 4 workloads
+kubectl kustomize deploy/argocd/railiance01 \
+  | ssh railiance01 'kubectl apply --server-side -n argocd -f -'
+ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis'
+```
+
+## Rollback
+
+Resources only (return to upstream BestEffort):
+
+```bash
+ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
+  < deploy/argocd/railiance01/upstream/core-install.yaml
+```
+
+Whole install (nothing else depends on it while there are 0 Applications):
+
+```bash
+ssh railiance01 'kubectl delete namespace argocd'
+ssh railiance01 'kubectl delete crd applications.argoproj.io applicationsets.argoproj.io appprojects.argoproj.io'
+```
+
+The upstream core manifest also creates one ClusterRole and one
+ClusterRoleBinding (`argocd-application-controller`). For a clean cluster,
+delete everything it declares first:
+`ssh railiance01 'kubectl delete -n argocd -f -' < deploy/argocd/railiance01/upstream/core-install.yaml`,
+then the namespace.

deploy/argocd/railiance01/kustomization.yaml

@@ -0,0 +1,10 @@
+# Declared state of Argo CD Core on railiance01 (namespace argocd).
+# Upstream manifest is fetched and sha256-verified by `make argocd-fetch`
+# into upstream/ (gitignored); see PIN and README.md. Like upstream, the
+# render carries no namespace: apply it with `-n argocd`.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - upstream/core-install.yaml
+patches:
+  - path: resources.yaml

deploy/argocd/railiance01/resources.yaml

@@ -0,0 +1,68 @@
+# Requests and limits for the four Argo CD Core workloads. Upstream core sets
+# none, so the live pods are BestEffort. Idle use on 2026-09-21 (kubectl top,
+# 0 Applications): controller 2m/23Mi, applicationset 1m/19Mi,
+# repo-server 1m/19Mi, redis 5m/4Mi. Requests sit above idle to leave room for
+# phase B adoption; memory limits bound the pods; CPU limits are generous.
+# Total added requests: 95m CPU, 480Mi memory (init containers do not add).
+# NOT YET APPLIED: see RAIL-EN-WP-0002-T02.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: argocd-application-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-application-controller
+          resources:
+            requests: {cpu: 50m, memory: 256Mi}
+            limits: {cpu: 1000m, memory: 1Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-repo-server
+spec:
+  template:
+    spec:
+      initContainers:
+        - name: copyutil
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 64Mi}
+      containers:
+        - name: argocd-repo-server
+          resources:
+            requests: {cpu: 25m, memory: 128Mi}
+            limits: {cpu: 1000m, memory: 1Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-applicationset-controller
+spec:
+  template:
+    spec:
+      containers:
+        - name: argocd-applicationset-controller
+          resources:
+            requests: {cpu: 10m, memory: 64Mi}
+            limits: {cpu: 250m, memory: 256Mi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: argocd-redis
+spec:
+  template:
+    spec:
+      initContainers:
+        - name: secret-init
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 100m, memory: 64Mi}
+      containers:
+        - name: redis
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 200m, memory: 128Mi}

workplans/RAIL-EN-WP-0002-argocd-railiance01-declared-state.md

@@ -0,0 +1,90 @@
+---
+id: RAIL-EN-WP-0002
+type: workplan
+title: "Declare Argo CD Core on railiance01 and bound its resources"
+domain: financials
+repo: railiance-enablement
+status: active
+flavor: implementation
+owner: codex
+topic_slug: railiance
+created: "2026-09-21"
+updated: "2026-09-21"
+related:
+  - ArchitectureBlueprint-5.6
+  - RPF-WP-0043
+---
+
+# RAIL-EN-WP-0002 — Argo CD Core on railiance01: declared state
+
+Argo CD Core v3.5.3 was installed on railiance01 on 2026-09-21 as a direct
+`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED` by the
+founder, performed by the custodian session
+(`the-custodian/docs/kubernetes-change-gate-decision.md`). ArgoCD is an S4
+concern (railiance-infra RAIL-HO-WP-0004 inventory), so its declared state
+lives here: `deploy/argocd/railiance01/`.
+
+## T01 — Declare the install
+
+```task
+id: RAIL-EN-WP-0002-T01
+status: done
+priority: high
+```
+
+Pin manifest URL and sha256 (`PIN`), kustomization, install and rollback
+commands (`README.md`), read-only `make argocd-fetch|render|diff`.
+
+**Outcome (2026-09-21):** fetched manifest sha256 matches the pin
+(`1a87025d…c448`, 34 objects). Read-only `kubectl diff --server-side -n argocd`
+of the unpatched pinned manifest against railiance01: **no diff**. So the
+declared base matches live exactly.
+
+## T02 — Apply resource requests and limits (live change, awaits founder)
+
+```task
+id: RAIL-EN-WP-0002-T02
+status: wait
+priority: high
+```
+
+Upstream core sets no resources, so all four pods are BestEffort (verified
+2026-09-21). `resources.yaml` declares:
+
+| Workload | Request cpu/mem | Limit cpu/mem | Idle use 2026-09-21 |
+|---|---|---|---|
+| application-controller (sts) | 50m / 256Mi | 1 / 1Gi | 2m / 23Mi |
+| repo-server (+ copyutil init 10m/32Mi, 100m/64Mi) | 25m / 128Mi | 1 / 1Gi | 1m / 19Mi |
+| applicationset-controller | 10m / 64Mi | 250m / 256Mi | 1m / 19Mi |
+| redis (+ secret-init init 10m/32Mi, 100m/64Mi) | 10m / 32Mi | 200m / 128Mi | 5m / 4Mi |
+
+Added requests: 95m CPU, 480Mi memory. Node requests before: 3320m (83%) CPU,
+8856Mi (55%) memory, so this fits. Pods become Burstable. Idle use is with 0
+Applications; revisit after phase B adoption.
+
+This is a **live change** (rolls all four pods). It is not taken in this
+session. On the founder's go-ahead, mode `ADMINISTER @ realm:kubernetes/railiance01`,
+`activation=APPROVED`:
+
+```bash
+make argocd-diff   # expect only resources on the 4 workloads
+kubectl kustomize deploy/argocd/railiance01 \
+  | ssh railiance01 'kubectl apply --server-side -n argocd -f -'
+ssh railiance01 'kubectl -n argocd rollout status sts/argocd-application-controller deploy/argocd-repo-server deploy/argocd-applicationset-controller deploy/argocd-redis'
+```
+
+Rollback (back to upstream BestEffort):
+
+```bash
+ssh railiance01 'kubectl apply --server-side -n argocd -f -' \
+  < deploy/argocd/railiance01/upstream/core-install.yaml
+```
+
+**Done when:** all four pods Ready with qosClass Burstable and `make argocd-diff`
+is empty.
+
+## Not in this workplan
+
+Phase B (AppProjects, root app, per-application adoption) and phase C
+(retire coulombcore's ArgoCD) each need their own founder go-ahead.
+Once phase B exists, ArgoCD's own manifest should move under GitOps too.