From 54885ac1589074a68d9607d1be250c84c5c2307a Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 28 Sep 2026 14:51:55 +0200
Subject: [PATCH] chore(gitops): pin manual secret annotation guard application

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
---
 .../secret-annotation-guard.application.yaml  | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 argocd/railiance01/applications/secret-annotation-guard.application.yaml

diff --git a/argocd/railiance01/applications/secret-annotation-guard.application.yaml b/argocd/railiance01/applications/secret-annotation-guard.application.yaml
new file mode 100644
index 0000000..8db40c3
--- /dev/null
+++ b/argocd/railiance01/applications/secret-annotation-guard.application.yaml
@@ -0,0 +1,22 @@
+# CUST-WP-0073-T03; supervised manual sync, no automatic pruning.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: secret-annotation-guard
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: secret-custody
+spec:
+  project: railiance-platform-addons
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: 800cbfa870661d47bee34c747f04f6145875adf1
+    path: argocd/platform-addons/secret-annotation-guard
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    syncOptions:
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true