RPF-WP-0063: wave-2 resource right-sizing receiving workplan

Receiving workplan for the 2026-10-21 node allocation review
(RESOURCE-WP-0008-T03 / CUST-WP-0071-T03). Wave-2 apply is human-gated;
no manifest changes. WORK-RECORDS.md regenerated from staged sources.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c

WORK-RECORDS.md

@@ -42,6 +42,7 @@
 | workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
 | workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md |
 | workplan | RPF-WP-0062 | finished | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
+| workplan | RPF-WP-0063 | ready | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md |
 | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
 | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
 | task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
@@ -190,6 +191,7 @@
 | task | RPF-WP-0062-T01 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
 | task | RPF-WP-0062-T02 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
 | task | RPF-WP-0062-T03 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
+| task | RPF-WP-0063-T01 | wait | — | workplans/RPF-WP-0063-wave2-resource-right-sizing.md |
 | intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
 | intake | RPF-IN-0002 | open | — | intakes/intakes.md |
 | intake | RPF-IN-0003 | open | — | intakes/intakes.md |

workplans/RPF-WP-0063-wave2-resource-right-sizing.md

@@ -0,0 +1,61 @@
+---
+id: RPF-WP-0063
+type: workplan
+title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
+domain: financials
+repo: railiance-platform
+status: ready
+flavor: implementation
+owner: claude
+created: "2026-10-21"
+updated: "2026-10-21"
+related:
+  - CUST-WP-0071
+  - RESOURCE-WP-0008
+---
+
+# RPF-WP-0063 — Wave-2 resource right-sizing from the 2026-10-21 allocation review
+
+Receiving workplan in `railiance-platform` for the wave-2 request changes below. The external-secrets workloads currently run with no requests at all (BestEffort).
+
+Origin: the 2026-10-21 node allocation review (`RESOURCE-WP-0008-T03`, feeding `CUST-WP-0071-T03`). Per the founder's 2026-10-21 delivery interview (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`) the small adjustments form wave 2: one receiving task per owner repo, applied later in a batch. Applying wave 2 needs a separate founder approval, so every cluster-write task here is a human-gated `wait`. This file changes no manifest.
+
+## Apply the reviewed request changes
+
+```task
+id: RPF-WP-0063-T01
+status: wait
+priority: medium
+needs_human: true
+blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
+```
+
+Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.
+
+| Workload (ns/name) | Pods | CPU request | CPU limit | CPU p95/peak 7d (m) | Memory request | Memory limit | Mem p95/peak (Mi) | Throttle | Action |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---|
+| `external-secrets/external-secrets` | 1 | 0m → **10m** | 0m (1 container(s) without CPU limit) | 4.1/5.5 | 0Mi → **64Mi** | 0Mi | 51.2/53.3 | None | increase + memory up |
+| `external-secrets/external-secrets-cert-controller` | 1 | 0m → **10m** | 0m (1 container(s) without CPU limit) | 1.0/1.5 | 0Mi → **64Mi** | 0Mi | 42.2/51.4 | None | increase + memory up |
+| `external-secrets/external-secrets-webhook` | 1 | 0m → **10m** | 0m (1 container(s) without CPU limit) | 0.5/0.6 | 0Mi → **80Mi** | 0Mi | 63.2/111.9 | None | increase + memory up |
+| `openbao/railiance-platform` | 1 | 25m → **10m** | 200m | 0.2/0.5 | 32Mi → **32Mi** | 128Mi | 4.8/4.8 | 0.0 | decrease |
+| `playwright/rapp-playwright` | 1 | 100m → **65m** | 1000m | 41.5/62.7 | 256Mi → **336Mi** | 1024Mi | 285.1/437.2 | 0.238 | decrease + review CPU limit (throttled) + memory up |
+
+Source and container detail:
+
+- `external-secrets/external-secrets`: external-secrets controller Deployment (helm chart, Application draft `argocd/railiance01/drafts/external-secrets.application.yaml`); add `resources.requests` in the chart values — no requests are set today.
+- `external-secrets/external-secrets-cert-controller`: same chart, `certController.resources.requests`.
+- `external-secrets/external-secrets-webhook`: same chart, `webhook.resources.requests` (memory peak 112Mi).
+- `openbao/railiance-platform`: Deployment `railiance-platform` in namespace `openbao`; source not located by a quick search — identify it before changing.
+- `playwright/rapp-playwright`: Deployment `playwright`, container `service`, `rapp-playwright/manifests/workload.yaml` (deployed by rapp-playwright). 23.8% of CFS periods throttled at the 1000m limit: review the CPU limit too (RPF-WP-0056 covers admission, not sizing).
+
+Evidence: resource-control `docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md` (+ `.json`, commit `3d9b1bd`). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).
+
+Steps:
+
+1. Map the pod-aggregate proposal onto the named container(s) in the source file; where a workload has several containers or pods, split by the per-pod figures in `2026-10-21-workload-usage.json` and keep the sum at the proposed value.
+2. Prepare the source change as a reviewed commit (no push, no sync) and record the before values here.
+3. Apply only inside the batched wave-2 rollout, after founder approval, through the owner's normal deploy path (ArgoCD sync or documented helm/kubectl apply).
+
+Verification: `kubectl -n <ns> get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
+
+Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.