Implement S3 service assurance and admission checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

docs/placement-policy.md

@@ -75,7 +75,9 @@ triggers. It is not the same role as the operator of the cluster.
 | Workload | Substrate | Provided level | Placement owner | Co-signer | §13 evidence |
 | --- | --- | --- | --- | --- | --- |
 | `audit-core` | `platform-pg` | P1 | `audit-core` | this repo | probes exist |
-| `tenant-engine` | SQLite PVC current; `platform-pg` desired | off-ladder current; P1 desired | `tenant-engine` | this repo | source conformance; live cutover absent |
+| `tenant-engine` | `platform-pg` | P1 | `tenant-engine` | this repo | owner cutover evidence 2026-08-21 |
+| `core-hub` | `platform-pg` | P1 | `core-hub` | this repo | capacity admission 2026-08-20; private shadow 2026-08-21 |
+| `sbom-nexus` | `platform-pg-2` | P1 | `sbom-nexus` | this repo | package boundary/restore evidence 2026-08-22 |
 | `user-engine` | `user-engine-pg` | P2 | `net-kingdom` | this repo | not assessed here |
 | `target-revenue` | `target-revenue-pg` | P2 | `target-revenue` | this repo | not assessed here |
 | `forgejo` | `forgejo-db` | P2 | this repo | — | single consumer |
@@ -144,13 +146,16 @@ one". "Provision a second cluster" is an answer; "revisit at the time" is not.
 
 | Cluster | Ceiling declared | Overflow target | Standing |
 | --- | --- | --- | --- |
-| `platform-pg` | 4 declarations (estimated; ADR-0004) | `platform-pg-2`, named but absent | 3/4 including the isolation probe; measure before the next workload |
+| `platform-pg` | 4 declarations (package ADR-0004) | `platform-pg-2`, deployed | 4/4 including probe and Core Hub; fifth refused |
+| `platform-pg-2` | 4 declarations (same package validator) | No third cell approved | 1/4: sbom-nexus; owner admission and restore completed 2026-08-22 |
 | `apps-pg` | 3 consumers; 20 connections each, 1Gi memory binds first | `apps-pg-2` | 2/3; overflow must exist before a 4th |
 | `forgejo-db` | n/a — single consumer | n/a | — |
 
-Both live shared clusters are one consumer away from the trigger. This repo
-owes `apps-pg`'s ceiling under its own rule, which is the correct asymmetry: a
-policy whose author is exempt is not a policy.
+Source and live metadata reviewed 2026-09-05: platform-pg is full; apps-pg
+remains 2/3 and apps-pg-2 is still unapplied. The generated
+`assurance/admission-baseline.json` binds these disclosures to the actual owner
+validators/declarations. `make assurance-admission` refuses source drift.
+Package acceptance, rather than this table, authorizes consumer provisioning.
 
 ## 5. Triggers, and who is watching them
 
@@ -189,7 +194,8 @@ risk that nobody can see is strictly worse than one that is stated".
 
 | Cluster | Co-resident classes | Mismatch |
 | --- | --- | --- |
-| `platform-pg` | `latency-critical` (`tenant-engine`) + `batch` (`audit-core`) | **yes — reported** |
+| `platform-pg` | `latency-critical` (`tenant-engine`, `core-hub`) + `batch` (`audit-core`) | **yes — reported** |
+| `platform-pg-2` | `interactive` (`sbom-nexus`) | no |
 | `apps-pg` | `interactive` + `interactive` | no |
 | `forgejo-db` | single consumer | n/a |
 
@@ -256,3 +262,11 @@ onboarding enforce it.
 Six months, or on: a new shared-cluster consumer, a co-residency class change,
 `railiance-telemetry` going live, or the framework reaching `accepted`. Next
 review due **2027-02-17**.
+
+## Service assurance implementation — 2026-09-05
+
+`docs/service-assurance.md` supplies the bounded local producer and admission
+check. Capture proves database readiness/backup/controller status at a point in
+time, and currently exposes failed/stale ESO resources. It does not implement
+continuous capacity monitoring. Trigger 5 remains unmonitored until its native
+headroom adapter and Q2 recipient are accepted (RPF-WP-0036-T03/T04).