Accept the policy-nexus multi-source shape and draft the Application.

T02 records the tenant's answer. The draft stays under docs and is not applied.

Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6dcb564b159

docs/drafts/policy-nexus-application.yaml

@@ -0,0 +1,38 @@
+# DRAFT for RPF-WP-0043-T03. Not applied. Not synced.
+# Do not copy this file under argocd/applications/ or
+# argocd/railiance01/applications/. No root reads docs/drafts/.
+# Accepts rapp-policy-nexus reply 41678d1f (2026-10-03). Not a new placement.
+# No automated sync. No finalizers.
+# Both targetRevision values are placeholders. They must be filled from the
+# attended read-only helm history / kubectl diff. This session did not read
+# or change the cluster.
+# The railiance-apps values path is still owed by that repo. Do not invent it.
+# The private-repository ArgoCD credential is a separate CCR and is not here.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: policy-nexus
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+spec:
+  project: railiance-tenants
+  sources:
+    - repoURL: https://forgejo.coulomb.social/coulomb/rapp-policy-nexus.git
+      targetRevision: "<pinned-revision>" # must be filled from the attended read
+      path: helm/policy-nexus
+      helm:
+        releaseName: policy-nexus
+        valueFiles:
+          - $values/<railiance-apps-values-path>
+    - repoURL: https://forgejo.coulomb.social/coulomb/railiance-apps.git
+      targetRevision: "<pinned-revision>" # must be filled from the attended read
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: policy-nexus
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true

workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md

@@ -9,7 +9,7 @@ flavor: planning
 owner: railiance-platform
 topic_slug: railiance
 created: "2026-09-21"
-updated: "2026-10-03"
+updated: "2026-10-05"
 due: "2026-12-21"
 related: [RPF-WP-0022]
 state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c"
@@ -71,7 +71,7 @@ ArgoCD install belongs to the cluster layer and needs its own go-ahead.
 
 ```task
 id: RPF-WP-0043-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "49143c5e-a455-526e-a26f-403dc2fb075a"
 ```
@@ -116,46 +116,40 @@ credential through its own CCR; `make deploy`/`make rollback` stop being
 production paths after adoption. The whole-workplan `depends_on` was removed
 because it made the wait circular. Next act is railiance-platform's: confirm
 the shape back to rapp-policy-nexus and draft the Application.
+
+2026-10-05: railiance-platform confirms that shape. This is acceptance of the
+tenant's answer, not a new placement decision.
+
+- Chart `helm/policy-nexus`, pinned to a tag or commit. No `k8s/railiance/` copy.
+- Values stay owned by railiance-apps. The Application is multi-source and
+  named `policy-nexus`.
+- The repository is private. The ArgoCD repository credential is a separate CCR.
+- After adoption, `make deploy` and `make rollback` stop being production paths.
+
+The draft is `docs/drafts/policy-nexus-application.yaml`. Its pinned revisions
+are placeholders and must be filled from the attended read.
+
 ## Prepare the Application and the dry-run evidence
 
 ```task
 id: RPF-WP-0043-T03
 status: wait
-depends_on: [RPF-WP-0043-T02]
-blocking_reason: "Draft the Application only after the tenant decision in T02."
+needs_human: true
+decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
+blocking_reason: "Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster."
 priority: high
 state_hub_task_id: "2afb1aac-66dd-5e1e-92e1-fc020a59a927"
 ```
 
-Draft the Application in this workplan or in a review branch, **not** under
-`argocd/applications/` on `main`. Draft shape for adoption:
-
-```yaml
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: policy-nexus            # no finalizers: deletion must not cascade
-  namespace: argocd
-  labels:
-    app.kubernetes.io/part-of: railiance-gitops
-spec:
-  project: railiance-tenants
-  source:
-    repoURL: https://forgejo.coulomb.social/coulomb/rapp-policy-nexus.git
-    targetRevision: <pinned commit>
-    path: helm/policy-nexus
-    helm:
-      releaseName: policy-nexus
-      valueFiles: [<agreed values file>]
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: policy-nexus
-  syncPolicy:                   # adoption stage: no `automated` block
-    syncOptions:
-      - CreateNamespace=false
-      - ApplyOutOfSyncOnly=true
-      - PruneLast=true
-```
+Draft the Application under `docs/`, **not** under `argocd/applications/` on
+`main`. The single-source sketch is superseded by the tenant's multi-source
+shape. The draft is `docs/drafts/policy-nexus-application.yaml`: chart
+`helm/policy-nexus` from rapp-policy-nexus, railiance-apps values as the second
+source, `helm.releaseName: policy-nexus`, no `automated` block, no finalizers.
+Pinned revisions are placeholders. They must be filled from the attended read.
+The railiance-apps values path is still that owner's; the draft does not invent
+it. Decision 89f1058f-33bc-47a8-8a49-0b44d426c67e is still open and is not
+resolved here.
 
 Read-only evidence to collect before T04, in an attended session:
 
@@ -254,3 +248,7 @@ the inventory.
 ## Loose-end review — 2026-09-27
 
 The workplan is blocked on the source-owner agreement and its downstream adoption gates. RAPP-POLICY-NEXUS-WP-0002 proposes a multi-source Application: chart in rapp-policy-nexus and release values in railiance-apps. This supersedes the earlier platform-only suggestion to put production values in the package repository. The platform accepts that shape and the helm/policy-nexus path exception in principle; it still needs railiance-apps acceptance, an actual committed values path/revision, source access and a zero-diff render before T02/T03 can close. No owner acceptance or cross-repository change is inferred. T01 remains proven by current railiance01 Synced/Healthy evidence.
+
+## Confirmation — 2026-10-05
+
+T02 is done. Platform accepts rapp-policy-nexus reply `41678d1f`. That is not a new placement decision. T03 stays `wait`: the draft is prepared at `docs/drafts/policy-nexus-application.yaml`, and the attended read-only helm history / kubectl diff remains. This session did not touch the cluster. T04 stays `wait`. The workplan stays blocked. Decision `89f1058f-33bc-47a8-8a49-0b44d426c67e` is still open and was not resolved.