Implement S3 service assurance and admission checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/adr/ADR-0005-demand-gated-stateful-services.md

@@ -0,0 +1,55 @@
+---
+id: RPLAT-ADR-0005
+title: "ADR-0005 — Reuse existing storage and defer unrequested stateful services"
+status: accepted
+revision: "1.0"
+owner: railiance-platform
+date: "2026-09-05"
+last_reviewed: "2026-09-05"
+review_interval: 6m
+---
+
+# ADR-0005 — Demand-gated stateful services
+
+## Context
+
+INTENT includes cache, object storage and messaging. Valkey is gated in the
+Makefile. CNPG already consumes an external governed S3 backup destination.
+`artifact-store` has local/S3 backend code, retention/hold semantics and a
+MinIO/STS assessment; its older SCOPE understates the code. The reviewed
+platform queue has no accepted general cache or messaging consumer request.
+Absence from this queue is not a claim that no future consumer could need one.
+
+## Decision
+
+- Cache: defer shared Valkey deployment. Reopen on a named consumer specifying
+  latency, eviction/durability, isolation, capacity and an operating owner.
+- General object storage: reuse the existing backup destination only for its
+  approved backup scope. Evaluate artifact-store's existing S3 interface for
+  artifact-preservation demand before proposing another gateway or engine.
+  Defer a general platform S3/MinIO service until accepted demand specifies
+  retention, residency, capacity, recovery, credential scope and package owner.
+- Messaging: defer shared broker deployment until a named consumer defines
+  delivery/replay/order guarantees, retention, throughput and recovery needs.
+  Do not replace application-specific queues by assumption.
+
+Review on a new accepted consumer request, a change in existing provider
+capability, or 2027-03-05, whichever comes first. This is an S3 deployment
+posture decision; it assigns no new obligation to potential consumers and
+chooses no vendor or engine. The Q3 fleet-owner question stays with
+railiance-master; local recovery work continues independently.
+
+## Consequences
+
+Keep deploy gates. Any accepted new demand creates a bounded delivery plan
+covering service contract, custody, tenancy, capacity, backup/restore, telemetry,
+package owner, costs and acceptance before provisioning. Existing backup
+credentials are not general artifact credentials. Platform does not take over
+artifact metadata lifecycle or application publication logic.
+
+## Alternatives considered
+
+Deploy Valkey/MinIO/RabbitMQ to satisfy the nouns in INTENT: rejected because
+it adds unsupported operations without an accepted workload. Declare external
+backup S3 a general object service: rejected because its scope and consumer
+contract are narrower.