RPF-WP-0044-T04: issue-core child placed, zero client diff; sync awaits permission

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292

docs/evidence/2026-10-20-issue-core-argocd-adoption.json

@@ -0,0 +1,59 @@
+{
+ "schema": "railiance-platform.argocd-adoption.v1",
+ "task": "RPF-WP-0044-T04",
+ "application": "issue-core",
+ "cluster": "railiance01 (92.205.62.239)",
+ "authority": [
+  "D2 89f1058f-33bc-47a8-8a49-0b44d426c67e",
+  "founder explicit go 2026-10-20"
+ ],
+ "credential_journal": "docs/evidence/2026-10-11-issue-core-credential/execution-journal-r1.json (delivered_not_adopted, provider_key_id 3)",
+ "contract_hash_relation": {
+  "file_sha256": "1ce9d2fdc39395407a01e358bfd0179f83f35c0a448e6658eb8f5aab351d3d3a",
+  "journal_contract_sha256": "0fd6d6fa0aeeffbdbfb7216b05be2c1aeae8719c606c18c70bc8d17a552b0970",
+  "explanation": "journal hashes json.dumps(contract,sort_keys=True); recomputed from the sealed file it equals the journal value; main() enforced the raw file hash before execution"
+ },
+ "source": {
+  "repo": "coulomb/rapp-issue-core",
+  "repoURL": "ssh://git@forgejo.coulomb.social:30022/coulomb/rapp-issue-core.git",
+  "path": "manifests",
+  "revision": "186c817b67d3919a64acdddbd3889e539841f946"
+ },
+ "adoption_commit": "d70422c",
+ "child_applied_directly": true,
+ "reason_child_only": "railiance-apps-root also OutOfSync on activity-core, informed-decision-requester, state-hub-memo-dispatch; argocd-pin-drift all ok",
+ "argo_comparison": {
+  "ssh_source_fetched": true,
+  "comparison_error": false,
+  "sync": "OutOfSync (8 objects untracked, pre-adoption)",
+  "health": "Healthy"
+ },
+ "pre_sync_diff": {
+  "method": "kubectl diff -f - (client-side) of pinned render, as T05",
+  "client_side_rc": 0,
+  "objects": [
+   "Namespace/issue-core",
+   "ConfigMap/issue-core-backends",
+   "ExternalSecret/issue-core-runtime",
+   "ServiceAccount/issue-core",
+   "Deployment/issue-core",
+   "Service/issue-core",
+   "NetworkPolicy/issue-core-default-deny",
+   "NetworkPolicy/issue-core-runtime"
+  ],
+  "secret_kinds_rendered": 0
+ },
+ "sync": {
+  "performed": false,
+  "blocked_by": "agent harness auto-mode classifier denied kubectl patch of Application operation (Production Deploy) 2026-10-20",
+  "intended": {
+   "strategy": "apply",
+   "prune": false,
+   "force": false
+  }
+ },
+ "verifier": {
+  "performed": false
+ },
+ "secret_values_observed_by_agent": false
+}

workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md

@@ -271,7 +271,7 @@ id: RPF-WP-0044-T04
 status: wait
 needs_human: true
 intervention_note: "Orange attended Platform OpenBao OIDC/MFA login for the already D2-approved exact repository reader; no second source-scope approval."
-blocking_reason: "Only the founder attended Platform OpenBao OIDC/MFA login running the fixed executor remains; runbook docs/runbooks/rpf-wp-0044-t04-attended.md."
+blocking_reason: "Credential delivered and child Application placed with zero client-side diff; manual apply-strategy sync (prune/force off) was denied to the agent by harness auto-mode and needs a founder run or permission; then verify-live."
 decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
 priority: high
 state_hub_task_id: "0e619658-0453-51ed-b9a0-bed28b5544fd"
@@ -285,6 +285,8 @@ Public host trust and exact project admission are prepared in owner source and t
 
 2026-10-20 (CUST-WP-0079-T06 attended-window prep, agent): prerequisites done. Host trust and exact project admission were executed 2026-10-11 (the-custodian `docs/evidence/2026-10-11-issue-core-public-transport/execution.json`); a fresh dry-run refused with `target_preimage_changed` (already applied, kept as `docs/evidence/2026-10-11-issue-core-transport/2026-10-20-dry-run-r1.json`) and `--action verify` passed (`2026-10-20-verify-r1.json`). ssh-keyscan from railiance01 matches the pinned provider key. Sealed contract `docs/evidence/2026-10-11-issue-core-credential/contract-sealed-2026-10-20.json` (sha256 `1ce9d2fdc39395407a01e358bfd0179f83f35c0a448e6658eb8f5aab351d3d3a`, expires 2026-10-27) passes the executor's `validate_contract`; 17 executor/transport tests pass. Wrapper pin target is rapp-issue-core `186c817b67d3919a64acdddbd3889e539841f946`. The only remaining step is the founder's attended login running the executor; exact commands and the agent follow-on (pin, diff, manual sync, verifier) are in `docs/runbooks/rpf-wp-0044-t04-attended.md`. No secret, credential or OpenBao call was made.
 
+2026-10-20 (adoption, agent, founder explicit go + D2): the journal `contract_sha256` 0fd6d6fa... is `sha256(json.dumps(contract, sort_keys=True))` of the sealed contract (recomputed, exact match; the raw file hash 1ce9d2fd... was enforced at launch). Child placed in `argocd/railiance01/applications/issue-core.application.yaml` (SSH repoURL, 186c817) in `d70422c` and applied directly, because `railiance-apps-root` is also OutOfSync on activity-core, informed-decision-requester and state-hub-memo-dispatch (`make argocd-pin-drift`: all ok). Argo fetched the SSH source at 186c817 without ComparisonError; Healthy, OutOfSync (8 untracked objects). Client-side diff of the pinned render (T05 method): rc=0; the render holds no credential objects. **Manual sync not performed**: the agent harness auto-mode classifier denied the Application sync-operation patch. Nothing was rolled back because no workload changed; the new Application has no automated sync. Remaining: the founder runs (or permits) runbook step 4 sync, then the step 5 verifier. Receipt: `docs/evidence/2026-10-20-issue-core-argocd-adoption.json`.
+
 2026-10-20 (attended window, CUST-WP-0079-T06): founder completed the Platform OpenBao OIDC/MFA login and the fixed executor at 10:37Z. Journal `docs/evidence/2026-10-11-issue-core-credential/execution-journal-r1.json`: state `delivered_not_adopted`, consumed-wrap replay denied (400), no secret values observed by the agent, custody version 1, destination `argocd/rapp-issue-core-repository`. The human gate is cleared. Remaining agent steps per `docs/runbooks/rpf-wp-0044-t04-attended.md`: pin the Application, client-side diff, manual sync (prune/force off), bounded verifier. The journal's `contract_sha256` (`0fd6d6fa…`) differs from the sealed file's sha256 (`1ce9d2fd…`). Reconcile this before the adoption sync.
 
 ## Adopt target-revenue