Declare railiance01 ArgoCD bootstrap on its own path, automated sync off (RPF-WP-0044-T01).

Founder's Option A: argocd/railiance01/bootstrap (3 AppProjects, root with no
automated block, tenants whitelist + postgresql.cnpg.io/Cluster), root path
argocd/railiance01/applications (README placeholder, renders zero children),
pinned child drafts in argocd/railiance01/drafts (issue-core repointed to
rapp-issue-core manifests), rapp-issue-core repository template; issue-core
template marked obsolete. argocd/bootstrap and argocd/applications untouched
(coulombcore). Nothing applied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

argocd/railiance01/applications/README.md

@@ -0,0 +1,14 @@
+# railiance01 child Applications
+
+Synced by `railiance-apps-root` on railiance01 (declared in
+`argocd/railiance01/bootstrap/`), by hand only until RPF-WP-0044-T07.
+
+This file is a placeholder: git does not keep an empty directory, and a
+missing path is a `ComparisonError` in ArgoCD. ArgoCD's directory source reads
+only `*.yaml`, `*.yml` and `*.json`, so this README renders to zero children.
+
+Add a child Application here only as part of its RPF-WP-0044 adoption task,
+with the founder's go-ahead: no `automated` block, no finalizer, and a pinned
+`targetRevision`. A merge here plus a hand sync of the root is a live
+production change on railiance01. Drafts wait in `../drafts/`, which no root
+syncs.

argocd/railiance01/bootstrap/00-railiance-bootstrap-project.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: railiance-bootstrap
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  description: Platform-owned ArgoCD bootstrap project for Railiance app-of-apps.
+  sourceRepos:
+    - https://forgejo.coulomb.social/coulomb/railiance-platform.git
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: argocd
+  clusterResourceWhitelist: []
+  namespaceResourceWhitelist:
+    - group: argoproj.io
+      kind: Application
+  orphanedResources:
+    warn: true
+

argocd/railiance01/bootstrap/01-railiance-tenants-project.yaml

@@ -0,0 +1,56 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: railiance-tenants
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  description: Guardrails for Railiance tenant applications deployed by ArgoCD.
+  sourceRepos:
+    - https://forgejo.coulomb.social/coulomb/*.git
+    # Emergency rollback only (T12 Option A through 2026-08-07)
+    - https://gitea.coulomb.social/coulomb/*.git
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: "*"
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: PersistentVolumeClaim
+    - group: ""
+      kind: Secret
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: apps
+      kind: StatefulSet
+    - group: autoscaling
+      kind: HorizontalPodAutoscaler
+    - group: batch
+      kind: CronJob
+    - group: batch
+      kind: Job
+    - group: external-secrets.io
+      kind: ExternalSecret
+    - group: postgresql.cnpg.io
+      kind: Cluster
+    - group: networking.k8s.io
+      kind: Ingress
+    - group: networking.k8s.io
+      kind: NetworkPolicy
+    - group: traefik.io
+      kind: IngressRoute
+    - group: traefik.io
+      kind: Middleware
+  orphanedResources:
+    warn: true
+

argocd/railiance01/bootstrap/02-railiance-platform-addons-project.yaml

@@ -0,0 +1,48 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: railiance-platform-addons
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  description: Platform-owned cluster add-ons required by tenant workloads.
+  sourceRepos:
+    - https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    - https://charts.external-secrets.io
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: "*"
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace
+    - group: apiextensions.k8s.io
+      kind: CustomResourceDefinition
+    - group: admissionregistration.k8s.io
+      kind: MutatingWebhookConfiguration
+    - group: admissionregistration.k8s.io
+      kind: ValidatingWebhookConfiguration
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRole
+    - group: rbac.authorization.k8s.io
+      kind: ClusterRoleBinding
+    - group: external-secrets.io
+      kind: ClusterSecretStore
+  namespaceResourceWhitelist:
+    - group: ""
+      kind: ConfigMap
+    - group: ""
+      kind: Secret
+    - group: ""
+      kind: Service
+    - group: ""
+      kind: ServiceAccount
+    - group: apps
+      kind: Deployment
+    - group: rbac.authorization.k8s.io
+      kind: Role
+    - group: rbac.authorization.k8s.io
+      kind: RoleBinding
+  orphanedResources:
+    warn: true

argocd/railiance01/bootstrap/10-railiance-apps-root.application.yaml

@@ -0,0 +1,27 @@
+# railiance01 root app (RPF-WP-0044, founder's Option A, 2026-09-21).
+# No `automated` block: the root syncs only when synced by hand, with the
+# revision pinned in the sync operation. T07 restores automated sync after
+# T03-T06 are proven. coulombcore keeps argocd/bootstrap -> argocd/applications
+# until phase C; nothing here is read by coulombcore.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: railiance-apps-root
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+spec:
+  project: railiance-bootstrap
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: main
+    path: argocd/railiance01/applications
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

argocd/railiance01/bootstrap/kustomization.yaml

@@ -0,0 +1,11 @@
+# railiance01 ArgoCD bootstrap, applied by hand (RPF-WP-0044-T02).
+# Separate from argocd/bootstrap/, which is coulombcore's and stays unchanged
+# until phase C. Do not point `make argocd-bootstrap-deploy` at the old path on
+# railiance01: its root declares automated prune + self-heal.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - 00-railiance-bootstrap-project.yaml
+  - 01-railiance-tenants-project.yaml
+  - 02-railiance-platform-addons-project.yaml
+  - 10-railiance-apps-root.application.yaml

argocd/railiance01/drafts/external-secrets.application.yaml

@@ -0,0 +1,35 @@
+# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
+# ../applications/ only in this app's adoption task, with the founder's go-ahead.
+# No automated sync, no finalizer. targetRevision: chart version; T06 adds CRD Prune=false,Delete=false before merge.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: external-secrets
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: railiance-platform-addons
+  source:
+    repoURL: https://charts.external-secrets.io
+    chart: external-secrets
+    targetRevision: 0.16.1
+    helm:
+      releaseName: external-secrets
+      values: |
+        installCRDs: true
+        serviceAccount:
+          create: true
+          name: external-secrets
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

argocd/railiance01/drafts/issue-core.application.yaml

@@ -0,0 +1,27 @@
+# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
+# ../applications/ only in this app's adoption task, with the founder's go-ahead.
+# No automated sync, no finalizer. targetRevision: rapp-issue-core commit diffed 2026-09-21.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: issue-core
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance.io/domain: issue-core
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: railiance-tenants
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git
+    targetRevision: a78f38cfd8afb29ed23d150a4ea3e3dcd1f35381
+    path: manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: issue-core
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

argocd/railiance01/drafts/openbao-secretstore.application.yaml

@@ -0,0 +1,27 @@
+# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
+# ../applications/ only in this app's adoption task, with the founder's go-ahead.
+# No automated sync, no finalizer. targetRevision: railiance-platform commit, last to touch argocd/platform-addons/openbao-secretstore.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: openbao-secretstore
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: external-secrets
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: railiance-platform-addons
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git
+    targetRevision: d2dbc19c254247652c49fda8721c80d53bca206a
+    path: argocd/platform-addons/openbao-secretstore
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: external-secrets
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

argocd/railiance01/drafts/target-revenue.application.yaml

@@ -0,0 +1,29 @@
+# DRAFT for railiance01 (RPF-WP-0044). Not synced by any root: move to
+# ../applications/ only in this app's adoption task, with the founder's go-ahead.
+# No automated sync, no finalizer. targetRevision: target-revenue commit diffed 2026-09-21.
+# Target Revenue Trust Service + Control Plane (WP-0011).
+# Source of truth: coulomb/target-revenue k8s/railiance (issue-core pattern).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: target-revenue
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance.io/domain: target-revenue
+  annotations:
+    argocd.argoproj.io/sync-wave: "10"
+spec:
+  project: railiance-tenants
+  source:
+    repoURL: https://forgejo.coulomb.social/coulomb/target-revenue.git
+    targetRevision: f1109d54eeda9f187daa215cf1c7163610d35d0a
+    path: k8s/railiance
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: target-revenue
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

argocd/repositories/issue-core.repository.sops.yaml.template

@@ -1,3 +1,7 @@
+# OBSOLETE (RPF-WP-0044, 2026-09-21): issue-core.git is public and no longer
+# the deploy source (runtime moved to rapp-issue-core, issue-core 51440da).
+# Use rapp-issue-core.repository.sops.yaml.template. Do not instantiate.
+#
 # Copy to issue-core.repository.sops.yaml, fill from the approved
 # operator/OpenBao path, then encrypt with:
 #   sops -e -i argocd/repositories/issue-core.repository.sops.yaml

argocd/repositories/rapp-issue-core.repository.sops.yaml.template

@@ -0,0 +1,22 @@
+# Copy to rapp-issue-core.repository.sops.yaml, fill from the approved
+# OpenBao path platform/operators/argocd/repositories/rapp-issue-core
+# (read-only deploy token, via its CCR; RPF-WP-0044-T04), then encrypt with:
+#   sops -e -i argocd/repositories/rapp-issue-core.repository.sops.yaml
+#
+# Do not commit plaintext credentials.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rapp-issue-core-repository
+  namespace: argocd
+  labels:
+    argocd.argoproj.io/secret-type: repository
+    app.kubernetes.io/part-of: railiance-gitops
+    railiance-platform/component: gitops
+stringData:
+  type: git
+  project: railiance-tenants
+  url: https://forgejo.coulomb.social/coulomb/rapp-issue-core.git
+  username: CHANGE_ME
+  password: CHANGE_ME
+