Close RPF-WP-0025, WP-0043 T01/T05, WP-0045 T05; retire bao.coulomb.social defaults

- WP-0025-T03 done: public listener retracted 2026-09-15; bao.coulomb.social
  is retired, tunnel is the operator path; DNS withdrawal handed to S1.
- WP-0043-T01 done: ArgoCD Core reconciles railiance01 at main (evidence).
- WP-0043-T05 done: direct-apply gap inventory and founder proposal.
- WP-0045-T05 cancelled (no rollback needed); T06 preconditions recorded.
- Operator scripts default BAO_ADDR to the openbao-ui-railiance01 tunnel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 150322@bnt-lap001
Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4

docs/direct-apply-gap-inventory.md

@@ -0,0 +1,40 @@
+# Direct-apply gap inventory (RPF-WP-0043-T05)
+
+Inventory date: 2026-09-22. Source: `Makefile` on `main` at `8a7ebce`.
+Nothing here changes a target's behaviour.
+
+## Declaration
+
+Under the Kubernetes change gate (`the-custodian/docs/kubernetes-change-gate-decision.md`),
+a platform object without a readiness state defaults to the production tier,
+and the production row is `CONSTRUCT` through git and ArgoCD. The targets
+below change railiance01 directly (`kubectl apply`, `helm upgrade`, or the
+OpenBao API). Their evidence is `target-audited` only. **They do not conform
+to the production row.** Until the founder rules on each group, every run is
+`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED`, and is
+recorded as a production-tier change.
+
+ArgoCD Core has run on railiance01 since 2026-09-21. The evidence is
+`docs/evidence/2026-09-22-argocd-railiance01-status.json`. A reconciled lane
+therefore exists for Kubernetes objects. It does not exist for OpenBao API
+state.
+
+## Inventory and proposal
+
+| Group | Targets | What they change | Proposal |
+| --- | --- | --- | --- |
+| A. CNPG clusters, backups, NetworkPolicies | `db-deploy`, `forgejo-db-deploy`, `apps-pg-deploy`, `apps-pg-backup-deploy`, `apps-pg-overflow-deploy`, `net-kingdom-pg-inter-hub-networkpolicy-deploy` | `helm/*.yaml` via `kubectl apply` | **Move to a reconciled lane.** Adopt one Application per database cell, one at a time, as in RPF-WP-0044. The first sync is manual with prune off, and CNPG `Cluster` needs an AppProject whitelist entry. `db-deploy` (gitea-db) may be retirement, not adoption: check first whether gitea-db still exists. |
+| B. ClusterSecretStores | the `openbao-secretstore` Application (already adopted) plus stores patched by hand during recoveries (RPF-WP-0037, RPF-WP-0045) | `ClusterSecretStore` specs | **Move to reconciled.** Store auth blocks belong in `argocd/`-tracked manifests. A hand patch now counts as drift to reconcile back into git. |
+| C. OpenBao package | `openbao-deploy`, `openbao-overlay-apply`, `openbao-public-listener-retract`, `openbao-public-listener-rollback` | Helm release and gateway overlay in `openbao` | **Move to reconciled, with rapp-openbao.** The package belongs to `rapp-openbao`, so its Application should come from there. The listener retract and rollback stay direct as attended break-glass under `APPROVED`. |
+| D. OpenBao configuration | `openbao-configure-initial`, `-ssh`, `-external-secrets-*`, `-workload-kv-lanes`, `-credential-change-appliers`, `-token-grants`, `credential-change-applier-apply` | policies, roles and mounts over the OpenBao API | **Stay direct under `APPROVED`.** ArgoCD cannot reconcile API state. The controls are compare-before-write scripts, attended login and per-run evidence. A declarative reconciler is a separate decision. |
+| E. ArgoCD bootstrap | `argocd-bootstrap-deploy`, `argocd-repo-apply` | AppProjects, root Application, repository Secret | **`argocd-bootstrap-deploy`: never against railiance01.** It renders the old root with automated prune and self-heal. Use `argocd/railiance01/bootstrap/` (RPF-WP-0044). Retire or guard the target when coulombcore is retired (RPF-WP-0044-T08). `argocd-repo-apply` stays direct under `APPROVED` because it carries SOPS-encrypted credentials. |
+| F. Not Kubernetes | `forgejo-package-prune`, `backup`, `forgejo-backup` | Forgejo API, backup uploads | Outside the Kubernetes gate. Stays direct. |
+| Fail-closed | `pg-deploy`, `valkey-deploy` | nothing (refuse) | No action. |
+
+Read-only targets (`*-status`, `*-logs`, `*-dry-run`, `*-verify*`,
+`assurance-*`) change nothing and are not in scope.
+
+## Founder decision requested
+
+Accept or amend the per-group proposal. Adopting groups A to C is later work.
+It is not started by this inventory.