railiance-platform/docs/evidence/argocd-phase-b-adoption-diff-2026-09-21.json

{
  "record": "argocd-phase-b-adoption-diff",
  "date": "2026-09-21",
  "workplan": "RPF-WP-0044",
  "mode": "read-only",
  "evidence_boundary": "target-audited",
  "performed_by": "railiance-platform agent session (Claude Code), founder-authorised session",
  "cluster": {
    "node": "239.62.205.92.host.secureserver.net",
    "internal_ip": "92.205.62.239",
    "k3s": "v1.35.1+k3s1",
    "access": "ssh railiance01 'kubectl ...'; helm --kubeconfig /etc/rancher/k3s/k3s.yaml for get/history/list"
  },
  "commands_used": [
    "kubectl get / kubectl diff (client-side and --server-side dry run; nothing persisted)",
    "helm list -A -a, helm history, helm get values (user-supplied values only)",
    "local: helm template, kubectl kustomize, rapp-issue-core tools/render.py into a scratch directory"
  ],
  "argocd_live": {
    "version": "v3.5.3 core (headless)",
    "workloads": "application-controller sts 1/1, repo-server 1/1, redis 1/1, applicationset-controller 1/1",
    "applications": 0,
    "appprojects": 0,
    "repository_secrets": 0,
    "tracking_method": "default (annotation) - argocd-cm sets no application.resourceTrackingMethod",
    "argocd_cli_on_node": false
  },
  "apps": {
    "openbao-secretstore": {
      "source": "railiance-platform.git main argocd/platform-addons/openbao-secretstore (kustomize)",
      "rendered": ["ClusterSecretStore/openbao"],
      "diff_server_side": "empty (rc=0)",
      "diff_client_side": "empty (rc=0)",
      "live_managers": ["railiance-platform", "external-secrets"],
      "would_change_live": "no spec change; ArgoCD adds its tracking annotation only",
      "would_prune": "nothing - no live object carries an ArgoCD tracking annotation; the other 24 ClusterSecretStores are not in the kustomization and stay untracked",
      "repository_credential": "none needed - coulomb/railiance-platform is public (Forgejo API private=false, anonymous ls-remote works)",
      "blockers": []
    },
    "issue-core": {
      "source_declared": "issue-core.git main k8s/railiance",
      "source_status": "PATH DOES NOT EXIST - removed by issue-core 51440da (2026-08-19, ISSUE-WP-0007); runtime moved to coulomb/rapp-issue-core",
      "effective_source": "rapp-issue-core.git main manifests/ (a78f38c), image pinned in the file",
      "rendered": ["Namespace", "ConfigMap", "ExternalSecret", "ServiceAccount", "Service", "Deployment", "NetworkPolicy x2"],
      "diff_server_side": "empty for both the raw manifests/ directory and the tools/render.py output",
      "live_image": "forgejo.coulomb.social/coulomb/issue-core@sha256:a56c80ccbd1690bc0bcea384165b1967704f0fdbaf1c506ce1082f56190b92cf",
      "live_managers": ["rapp-issue-core (server-side apply)", "kubectl-rollout", "k3s"],
      "would_change_live": "as declared: nothing (ComparisonError, path missing). Repointed to rapp-issue-core: no spec change, tracking annotation only",
      "would_prune": "nothing",
      "repository_credential": "NEW: coulomb/rapp-issue-core is private (anonymous API returns nothing). Needs a template rapp-issue-core.repository.sops.yaml.template and OpenBao path platform/operators/argocd/repositories/rapp-issue-core. The existing issue-core template is obsolete (issue-core is public and no longer the source).",
      "blockers": ["Application must be repointed", "credential CCR", "rapp-issue-core make deploy must stop being a production path (would fight self-heal)"]
    },
    "target-revenue": {
      "source": "target-revenue.git main k8s/railiance (f1109d5, kustomize)",
      "rendered": ["Deployment", "Service", "Ingress", "ExternalSecret", "postgresql.cnpg.io/Cluster", "Job/target-revenue-migrate (Sync hook, wave 1)", "Job/target-revenue-bootstrap-binky (Sync hook, wave 2)"],
      "diff_server_side": "Deployment, Service, Ingress, ExternalSecret, Cluster: empty. Only the two Jobs differ: absent live (completed, TTL-deleted), would be created",
      "diff_client_side": "same result",
      "live_image": "forgejo.coulomb.social/coulomb/target-revenue:0.1.4 (tag, not digest)",
      "live_managers": ["kubectl-client-side-apply", "k3s"],
      "would_change_live": "yes: every sync with the default hook strategy runs the migrate Job against the production database and the binky bootstrap Job (commented idempotent)",
      "would_prune": "nothing",
      "project_whitelist": "BLOCKER: postgresql.cnpg.io/Cluster is not in railiance-tenants namespaceResourceWhitelist; the sync would be refused",
      "repository_credential": "none needed - coulomb/target-revenue is public; no template exists",
      "blockers": ["CNPG Cluster whitelist", "Sync-hook Jobs"]
    },
    "external-secrets": {
      "source": "https://charts.external-secrets.io external-secrets 0.16.1, values installCRDs=true, serviceAccount.create=true name=external-secrets",
      "rendered_kinds": {"CustomResourceDefinition": 20, "ClusterRole": 5, "ClusterRoleBinding": 2, "Deployment": 3, "ServiceAccount": 3, "ValidatingWebhookConfiguration": 2, "Role": 1, "RoleBinding": 1, "Secret": 1, "Service": 1},
      "diff_server_side": "empty (rc=0), rendered with --include-crds --kube-version 1.35.1",
      "live_helm_release": "external-secrets rev 7 status pending-upgrade since 2026-07-07 22:32; rev 6/7 user values identical to the Application values",
      "live_managers": ["helm", "kubectl-rollout", "k3s"],
      "would_change_live": "no spec change in the dry run; ArgoCD adds tracking annotations to 39 objects including 20 CRDs. Watch caBundle fields injected by cert-controller for drift",
      "would_prune": "nothing now. Later, pruning a CRD would delete every ExternalSecret and SecretStore cluster-wide",
      "repository_credential": "none needed - public Helm repository",
      "blockers": ["cluster-wide blast radius", "CRDs need Prune=false before prune is ever enabled", "stale helm release pending-upgrade"]
    }
  },
  "sync_policy_found": {
    "railiance-apps-root": "automated prune+selfHeal",
    "children": "all four: automated prune+selfHeal, no finalizers",
    "consequence": "applying the bootstrap as committed adopts all four at once"
  },
  "not_verified": [
    "repo-server egress to forgejo.coulomb.social and charts.external-secrets.io from inside railiance01",
    "state of coulombcore's ArgoCD, which still reads argocd/applications on main (outside this session's read-only railiance01 scope)"
  ]
}