RPF-WP-0043-T03: record read-only policy-nexus adoption precheck (steps 1 and 3)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87

docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json

@@ -0,0 +1,27 @@
+{
+  "task": "RPF-WP-0043-T03",
+  "collected_at": "2026-10-11T19:05Z",
+  "collected_by": "claude-code (agt-claude-railiance01 via k3s-api-railiance01 tunnel), read-only",
+  "cluster_node": "239.62.205.92.host.secureserver.net (railiance01)",
+  "step1_helm": {
+    "release": "policy-nexus", "namespace": "policy-nexus", "chart": "policy-nexus-0.2.0",
+    "deployed_revision": 9, "deployed_at": "2026-10-11T01:23:33",
+    "rollback_target_revision": 9,
+    "image_repository": "forgejo.coulomb.social/coulomb/policy-nexus",
+    "image_digest": "sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
+    "publicationManifestDigest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
+    "sourceInventoryDigest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
+    "sourceSetDigest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256"
+  },
+  "step2_render_diff": {
+    "status": "not-run",
+    "reason": "railiance-apps values path/revision not yet supplied (RAPP-POLICY-NEXUS-WP-0002-T02)"
+  },
+  "step3_objects": {
+    "listed_kinds": ["Deployment", "Service", "ConfigMap", "Ingress", "NetworkPolicy", "ServiceAccount", "PersistentVolumeClaim"],
+    "objects": ["Deployment/policy-nexus", "Service/policy-nexus", "ConfigMap/kube-root-ca.crt", "Ingress/policy-nexus-http", "Ingress/policy-nexus-https", "NetworkPolicy/policy-nexus-acme-solver", "NetworkPolicy/policy-nexus-default-deny", "NetworkPolicy/policy-nexus-traefik", "ServiceAccount/default", "ServiceAccount/policy-nexus"],
+    "argocd_tracking_label_or_annotation_present": false,
+    "secrets": "not listed (agent guard forbids Secret reads); Helm release Secrets carry no ArgoCD tracking label by construction",
+    "stop_conditions_hit": false
+  }
+}