Accept the policy-nexus multi-source shape and draft the Application.

T02 records the tenant's answer. The draft stays under docs and is not applied.

Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6dcb564b159

docs/drafts/policy-nexus-application.yaml

@@ -0,0 +1,38 @@
+# DRAFT for RPF-WP-0043-T03. Not applied. Not synced.
+# Do not copy this file under argocd/applications/ or
+# argocd/railiance01/applications/. No root reads docs/drafts/.
+# Accepts rapp-policy-nexus reply 41678d1f (2026-10-03). Not a new placement.
+# No automated sync. No finalizers.
+# Both targetRevision values are placeholders. They must be filled from the
+# attended read-only helm history / kubectl diff. This session did not read
+# or change the cluster.
+# The railiance-apps values path is still owed by that repo. Do not invent it.
+# The private-repository ArgoCD credential is a separate CCR and is not here.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: policy-nexus
+  namespace: argocd
+  labels:
+    app.kubernetes.io/part-of: railiance-gitops
+spec:
+  project: railiance-tenants
+  sources:
+    - repoURL: https://forgejo.coulomb.social/coulomb/rapp-policy-nexus.git
+      targetRevision: "<pinned-revision>" # must be filled from the attended read
+      path: helm/policy-nexus
+      helm:
+        releaseName: policy-nexus
+        valueFiles:
+          - $values/<railiance-apps-values-path>
+    - repoURL: https://forgejo.coulomb.social/coulomb/railiance-apps.git
+      targetRevision: "<pinned-revision>" # must be filled from the attended read
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: policy-nexus
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=false
+      - ApplyOutOfSyncOnly=true
+      - PruneLast=true