RPF-WP-0044-T06: ESO adoption prep, readiness receipts and founder runbook

Source gate passes; predecessor proofs stale/missing smoke; live diff and
store baseline blocked on agent cluster read access after CUST-WP-0073.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292

docs/evidence/2026-10-21-eso-adoption-prep/prep-receipt.json

@@ -0,0 +1,67 @@
+{
+ "schema": "railiance-platform.eso-adoption-prep/v1",
+ "task": "RPF-WP-0044-T06",
+ "captured_at": "2026-10-21",
+ "approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
+ "readiness_gate": {
+  "receipt": "readiness-r1.json",
+  "source_ready": true,
+  "missing_or_invalid": [
+   "RPF-WP-0044-T04",
+   "RPF-WP-0044-T05"
+  ],
+  "T04_reason": "docs/evidence/2026-10-20-issue-core-verify-live.json lacks authenticated_ingest_status=201 and authenticated_close_status=200 (verify-live ran without --smoke) and is older than the 300 s freshness window",
+  "T05_reason": "gate requires a fresh (<=300 s) argocd-workload-adoption-proof/v1 receipt; the 2026-10-11 receipt is stale. A fresh read-only run (scripts/workload_adoption_proof.py --live) failed because ssh railiance01 (user tegwick) can no longer read /etc/rancher/k3s/k3s.yaml after the CUST-WP-0073 cutover",
+  "smoke_not_run": "verify-live --smoke creates and closes a Forgejo issue; not read-only, so not run under the preparation-only boundary"
+ },
+ "offline_render": {
+  "chart": "external-secrets 0.16.1",
+  "values_source": "argocd/railiance01/drafts/external-secrets.application.yaml",
+  "render_sha256": "55236645afc9f2d9d376c28e73aed70bd31727d0e6f166664b3ebd568d5f136f",
+  "objects": 39,
+  "kinds": {
+   "ServiceAccount": 3,
+   "Secret": 1,
+   "CustomResourceDefinition": 20,
+   "ClusterRole": 5,
+   "ClusterRoleBinding": 2,
+   "Role": 1,
+   "RoleBinding": 1,
+   "Service": 1,
+   "Deployment": 3,
+   "ValidatingWebhookConfiguration": 2
+  },
+  "crds": 20,
+  "crds_prune_delete_protected": 20,
+  "store_or_externalsecret_objects_rendered": [],
+  "kinds_with_cabundle": [
+   "CustomResourceDefinition/clustergenerators.generators.external-secrets.io",
+   "CustomResourceDefinition/clustersecretstores.external-secrets.io",
+   "CustomResourceDefinition/secretstores.external-secrets.io",
+   "CustomResourceDefinition/vaultdynamicsecrets.generators.external-secrets.io",
+   "CustomResourceDefinition/webhooks.generators.external-secrets.io"
+  ],
+  "credential_kind_objects_rendered": [
+   "external-secrets-webhook"
+  ],
+  "notes": [
+   "20/20 CRDs carry argocd.argoproj.io/sync-options Prune=false,Delete=false",
+   "no ClusterSecretStore/SecretStore/ExternalSecret objects rendered, so adoption cannot delete or replace any store or ExternalSecret",
+   "the one rendered credential-kind object is the empty webhook certificate holder (metadata only, no data key); server-side apply does not take ownership of the cert-controller-injected data",
+   "ValidatingWebhookConfigurations declare no caBundle and no CRD declares a conversion webhook (caBundle hits are schema text); no ignoreDifferences added because no diff has shown drift yet"
+  ]
+ },
+ "draft_policy": {
+  "automated": false,
+  "finalizers": false,
+  "ServerSideApply": true,
+  "Force_or_Replace": false,
+  "prune_in_sync_command": false
+ },
+ "not_done_live": {
+  "fresh_native_client_side_diff": "blocked: no agent kube read path on railiance01 (tegwick kubeconfig removed; custodian-agent observer role has no CRD/RBAC/webhook/ESO read)",
+  "store_baseline": "blocked: same reason; expected ValidationFailed: openbao-activity-core, openbao-email-connect"
+ },
+ "native_mutation": false,
+ "secret_values_observed_by_agent": false
+}

docs/evidence/2026-10-21-eso-adoption-prep/readiness-r1.json

@@ -0,0 +1 @@
+{"approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e", "checks": {"source": {"chart_pin": "0.16.1", "crd_prune_delete_protected": true, "manual_sync_only": true, "server_side_apply": true}}, "founder_approval_required": false, "live_or_credential_calls": false, "missing_or_invalid": ["RPF-WP-0044-T04", "RPF-WP-0044-T05"], "native_mutation": false, "next_action": "wait_for_predecessor_automated_proof", "ready_for_fresh_native_render_diff": false, "schema": "eso-adoption-readiness/v1", "source_ready": true, "task": "RPF-WP-0044-T06"}