Resolve repository owner requests

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

WORK-RECORDS.md

@@ -8,11 +8,15 @@
 
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
+| workplan | ADHOC-2026-08-22 | finished | — | workplans/ADHOC-2026-08-22.md |
 | workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
 | workplan | RAIL-HO-WP-0008 | finished | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
 | workplan | RAIL-HO-WP-0009 | finished | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
 | workplan | RAIL-HO-WP-0010 | finished | — | workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md |
+| task | ADHOC-2026-08-22-T01 | done | — | workplans/ADHOC-2026-08-22.md |
+| task | ADHOC-2026-08-22-T02 | done | — | workplans/ADHOC-2026-08-22.md |
+| task | ADHOC-2026-08-22-T03 | done | — | workplans/ADHOC-2026-08-22.md |
 | task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
 | task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |

docs/adr/ADR-002-repo-boundary-hosts-vs-bootstrap.md

@@ -1,3 +1,15 @@
+---
+id: RINFRA-ADR-0002
+type: adr
+title: "Repository Boundary: railiance-hosts vs railiance-bootstrap"
+status: superseded
+owner: railiance-infra
+revision: "superseded-1"
+last_reviewed: "2026-08-22"
+review_interval: 6m
+superseded_by: RINFRA-ADR-0003
+---
+
 # ADR-002 — Repository Boundary: railiance-hosts vs railiance-bootstrap
 
 **Status:** Superseded by ADR-003

docs/adr/ADR-003-railiance-5repo-stack-architecture.md

@@ -1,9 +1,21 @@
+---
+id: RINFRA-ADR-0003
+type: adr
+title: "Railiance 5-Repo Stack Architecture"
+status: accepted
+owner: railiance-infra
+revision: "accepted-1"
+last_reviewed: "2026-08-22"
+review_interval: 6m
+---
+
 # ADR-003 — Railiance 5-Repo Stack Architecture
 
 **Status:** Accepted
 **Date:** 2026-03-10
 **Deciders:** Bernd Worsch
 **Supersedes:** ADR-002 (repo-boundary-hosts-vs-bootstrap)
+**Canonical source:** `railiance-infra`; the former `railiance-hosts` copy is historical.
 
 ---
 

docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md

@@ -1,9 +1,21 @@
+---
+id: RINFRA-ADR-0004
+type: adr
+title: "Forgejo In-Cluster Actions Runner on railiance01"
+status: accepted
+owner: railiance-infra
+revision: "accepted-1"
+last_reviewed: "2026-08-22"
+review_interval: 6m
+---
+
 # ADR-004 — Forgejo In-Cluster Actions Runner on railiance01
 
 **Status:** Accepted  
 **Date:** 2026-07-03  
 **Deciders:** Bernd Worsch (operator), custodian agents  
 **Workplans:** `RAIL-HO-WP-0005-T02`, `CUST-WP-0054-T04`
+**Canonical source:** `railiance-infra`; the former `railiance-hosts` copy is historical.
 
 ---
 
@@ -101,4 +113,4 @@ healthy. Do not register new host runners without an explicit ADR amendment.
 - `railiance-apps/docs/forgejo-on-railiance01.md`
 - `railiance-forge/docs/forgejo-actions-runner-substrate.md`
 - `the-custodian/docs/forgejo-production-decisions.md`
-- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)
+- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)

docs/adr/ADR-005-k3s-api-tunnel-only.md

@@ -1,3 +1,14 @@
+---
+id: RINFRA-ADR-0005
+type: adr
+title: "k3s API is tunnel-only"
+status: accepted
+owner: railiance-infra
+revision: "accepted-1"
+last_reviewed: "2026-08-22"
+review_interval: 6m
+---
+
 # ADR-005 — k3s API is tunnel-only
 
 **Status:** Accepted

workplans/ADHOC-2026-08-22.md

@@ -0,0 +1,66 @@
+---
+id: ADHOC-2026-08-22
+type: workplan
+title: "Attend repository owner requests"
+domain: financials
+repo: railiance-infra
+status: finished
+owner: codex
+topic_slug: repository-owner-requests
+created: "2026-08-22"
+updated: "2026-08-22"
+---
+
+# Attend repository owner requests
+
+## Review the RAILIANCE-WP-0024 host recovery contract
+
+```task
+id: ADHOC-2026-08-22-T01
+status: done
+priority: high
+```
+
+Review the final hash-bound railiance-infra owner assertions, run the named
+read-only checks, and submit the procedure-only decision without authorizing a
+live reboot window.
+
+Result: approved contract digest
+`f86d418f951f829f075de04dd825c6e2e185e577019ee23d6da1fa9040302d62`.
+Focused unit tests and node-reboot preflight passed read-only; receipt message
+`9bbf986c-7385-42de-964f-9040eebdfee4` records that no secret values were
+observed. No live window or reboot was authorized.
+
+## Resolve the ADR publication cleanup packet
+
+```task
+id: ADHOC-2026-08-22-T02
+status: done
+priority: medium
+```
+
+Make status metadata honest, identify the canonical source for duplicated
+ADRs, and add complete publication front matter to current decisions.
+
+Result: `railiance-infra` is the canonical source for the shared ADR-003 and
+ADR-004 because `railiance-hosts` declares itself superseded by this repo.
+ADR-002 is explicitly superseded; ADR-003 through ADR-005 now have complete,
+globally unique `RINFRA-ADR-*` publication metadata. Policy Nexus and the
+historical repo were notified of the ruling.
+
+## Triage the proposed confidential custody transfer
+
+```task
+id: ADHOC-2026-08-22-T03
+status: done
+priority: high
+```
+
+Check the proposed destination and confidentiality policy, then accept or
+return a value-safe change request without copying restricted material into an
+inappropriate repository.
+
+Result: changes requested. Forgejo reports this repository as public, while
+the complete proposed tree is `client_confidential`. No engagement material
+was copied; kaizen-agentic was asked to use restricted custody or propose a
+separately reviewed, redacted public-safe subset.