Replies sent to policy-nexus (F1 substrate boundary, F2 ADR surface, F5
frontmatter corpus), rapp-postgres and net-kingdom (F3 rule/number split,
F4 provider-versus-consumer ladders), tenant-engine (placement policy
answering its three asks), adaptive-pricing (co-signature requested) and
railiance-master (bao.coulomb.social still open, second public name
proposed). Routed inbox marked read.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01 docs/tenancy-posture.md - vector set per service rather than one repo
vector, with the provider-versus-consumer finding routed to net-kingdom.
T02/T03/T06 docs/placement-policy.md - accepts placement ownership scoped
to rule-here/number-there, records a placement owner per workload, reports
the latency-critical + batch co-residency on platform-pg, marks the
connection-ceiling trigger unmonitored pending railiance-telemetry, and
answers the retention floor/ceiling question.
T04 s3-consumer-interfaces 1.1.0 - quota disclosure per SS10.2. Surfaces
that apps-pg has no backup, no resource limits and no tuned parameters.
T05 docs/adr/ created with a mandatory-frontmatter convention and the
first three ADRs. This repo previously held none.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routed by tenancy-posture_v0.1 §19.2/§20 (rapp-postgres, tenant-engine) and
by POLICY-NEXUS-WP-0001, which assigns this repo substrate ownership for
policy.coulomb.social and includes it in the ADR publication corpus.
Records four findings against the policy as drafted: the substrate
assignment crosses the S1/S2 boundary; this repo holds no ADRs and records
decisions in the hub, so its decisions are unpublishable; §19.8 asks S3 for
a number that lives in rapp-postgres; and the posture vector is
service-shaped while this repo is a layer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Retires the shared prefix. Live plans move to the new prefix keeping their
running number; finished and archived files keep the old prefix as
historical record, per the ADR-007 option 2 migration ruling.
Hub UUIDs are unchanged, so reconciliation matches on
state_hub_workstream_id rather than filename and will update the slug in
place instead of registering duplicates.
Assigned in RMGR-WP-0004-T09.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read the resource-control open/restricted signal and refuse new orders
that would exceed a restricted entity's published allowance. Open and
missing signals stay unchanged. Safety paths admit with an exception.
Item 13 is the restore RESOURCE-WP-0002 already proved. Item 14 retires
the dead Bitnami postgresql-ha deploy path and gates Valkey until a
consumer exists. Item 17 publishes the versioned S3 consumer-interface
index.
Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
Publish capacity, recovery, labor, and allocation-driver evidence for
resource:railiance:apps-pg so resource-control can forecast and allocate
without reading application data or inventing booked cost.
Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.
Converge the S3 platform-service pattern onto ADR-0007, emit the
reef-railiance live deployable inventory for the family coverage
check, and mark T02 done. Declaration edits land in rapp-openbao
and rapp-postgres.
KV store for the sender registry only. Database leases stay on the
OpenBao database engine and are consumed via VaultDynamicSecret in
audit-core. Not added to the coulombcore ArgoCD kustomization.
32 assertions, 31 pass on Railiance01. The one failure is a real defect the old
loose assertion could never have seen: Flannel VXLAN declared open to Anywhere
with no source restriction, currently absent from the host, so converging would
introduce the exposure rather than correct drift.
Also records the sharper finding from wiring it up: verify.yaml was missing the
vars_files the bootstrap play had, so the firewall assertions rendered empty and
silently asserted nothing - worse than having no check at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T04 done, and the answer changes the order. Item 10 was scored size 5 as a
greenfield build. It is not. railiance-infra already has a Goss baseline suite,
an ansible runner, a make verify target that runs it against all hosts and
commits TAP reports to git, and an evidence trail in reports/. The mechanism is
built and wired.
Two things are wrong with it and neither is a build. Nothing runs it - the last
TAP report is dated 2026-03-09, five months ago. And its firewall assertion
matches /6443\/tcp.*ALLOW/, which asserts the port is allowed but not from
whom - it passes identically whether 6443 is restricted to one operator address
or open to the internet, which is exactly the drift that went undetected. It
would however have caught the other finding, since it asserts Status: active and
UFW is inactive on CoulombCore.
Rescoped into slices: 10a (run it, tighten the assertion) is size 1-2 and rises
to WSJF 12.0, fourth overall and the highest-value item after the ratifications.
10b (schedule + alert path) is 7.0. Names the shared dependency - 10b and 9b are
the same plumbing, and building either of 9 or 10 without it produces logs
nobody reads.
The lesson recorded: the gap analysis correctly identified no-conformance-loop
as a capability gap, but the capability was two-thirds built and abandoned.
Before sizing a gap as a build, check whether it is actually an abandonment.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T03 done: sent as ac73b172 with the recommendation that master takes the eight
ratification and taxonomy items, and including the correction that our earlier
ArgoCD report to them was wrong.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Compares INTENT (declared aspiration) against SCOPE (declared state) against
verified reality for every railiance-* repo. This was only possible now: a gap
could not be distinguished from a stale document until the architecture was
coherently defined, the SCOPE files described verified rather than assumed
reality, and the INTENT files stated current rather than copied intent.
Names the pattern that organizes the work: every gap is declared-but-unbuilt
(telemetry, S4, conformance loop), built-but-undeclared (the firewall
restriction, Q1 custody, the Plane dimension), or decided-but-unmoved (forge
placement, hosts retirement, rapp schema). The third kind is cheapest to clear
and blocks the most; the second is most dangerous, because it stays invisible
until something breaks - the firewall case was found by accident.
RAILIANCE-WP-0016 orders 19 items by WSJF with owner and reasoning per item.
Top three are nearly free and all decided-but-unmoved. Item 1, converging the
firewall allowlist, is a live exposure: two standing grants point at addresses
the ISP has reassigned. Item 2, five pending ratifications in railiance-master,
blocks a quarter of the backlog for a day of decisions.
Flags honestly that the size scores for telemetry and the conformance loop are
guesses, that item 13 is blocked rather than deprioritized, and that this
backlog belongs to railiance-master rather than S3 - it lives here only because
the analysis was done here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 2026-08-11 decision to keep ArgoCD rested on a claim that turned out to be
wrong. Verified against both clusters once API access was restored: ArgoCD is
not on railiance01, it runs on CoulombCore, its Applications target CoulombCore
in-cluster, nothing on railiance01 is ArgoCD-managed, and the live S3 workloads
- target-revenue, openbao, external-secrets - deploy outside GitOps. Two
Applications are Degraded and one is OutOfSync/Missing.
The earlier claim that removing ArgoCD documentation would describe a system
that does not exist was backwards: the documentation already describes a
deployment path that is largely not in effect. Restates the question with three
real options - adopt properly on railiance01, retire, or relocate to Helix Forge
- and notes that doing nothing is the option with a cost.
Same defect class as RAIL-HO-WP-0009: declared and live state diverged, and
nothing detected it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
S3 has carried Q1 Security and Compliance for months - approval gates,
delegated apply, revocation semantics, front-door readiness - without the
dimension ever being named. Naming it does not change what this layer does; it
makes the responsibility legible to the rest of the fleet.
Also draws the line the other way: observability is Q2 and belongs to
railiance-telemetry, so S3's obligation is to emit through the standard contract
rather than build its own monitoring. The recoverability half is Q3 and remains
unowned.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Populates each canonical dimension with Railiance's actual position, canon's
sub-levels, owners where they exist, and honest status.
Findings from doing it:
- Q1 Security and Compliance is already implemented in S3 to a mature standard
(approval gates, delegated apply, revocation, front-door readiness) and was
never named as a dimension. Evidence the dimensions describe real structure
rather than impose vocabulary.
- Plane is operated in full and declared nowhere. P1 workload, P2 control
(ArgoCD, CNPG, ESO, cert-manager), P3 management (State Hub, master,
workplans). Likely to clarify the rail/rapp relationship, since a rail is
essentially a P1 contract.
- Intelligence is already referenced in practice - qonto-assistant cites an I1
isolation profile - and the whole agent operating model is I4-I5. Leaving it
unmodelled understates what this fleet actually is.
- Q3 Operability and Q7 Governance remain unowned; Q5 unaddressed.
Adds a recommended establishing order for railiance-master to ratify: Quality
first (most unowned concerns), Plane second (cheap, descriptive), Capability
third (blocked on the C1 attribution drift), Intelligence fourth, Logic last or
never if Helix Forge owns functional decomposition.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The central finding. OAS defines six canonical dimensions and states that each
architecture description MUST use them. Railiance has modelled itself almost
entirely on Stack. Everything that did not fit a stack level was treated as an
anomaly - "unplaced", "beside the stack" - and accumulated as exceptions.
They were never anomalies. They are concerns on dimensions Railiance was not
using, and the Quality dimension's sub-levels map almost one-to-one onto the
capability gaps this review found independently: Q2 Observability is
railiance-telemetry, named in canon in exactly those words; Q7 Governance is
the conformance loop; Q3 is restore proof; Q6 is cost attribution. The
self-evidencing thread across five stack layers is five Stack repos each
independently asking for Q2 and Q7 - what a missing dimension looks like from
inside the one you are using.
Also records four contradictions (C1-C4), of which C1 is actionable here: the
hub attributes ~11 capabilities to this repo including Terraform, Ansible, k3s,
CI/CD and app deployment, which S3 does not own. SCOPE.md declares four, all
correctly S3, and is authoritative.
ArgoCD decision closed: keep it, documentation stays accurate; relocating GitOps
to Helix Forge noted as possible future cleanup.
SCOPE.md: corrects the "five independent repos per OAS Stack layer" claim,
records the ArgoCD deployment path, the telemetry emission relationship, and the
hub capability drift.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Gitea has been replaced by Forgejo. Updates prose mentions in docs/ while
deliberately preserving live names that a blind sweep would have broken:
GITEA_BACKEND_TOKEN is a provisioned OpenBao field in CCR-2026-0002, GITEA_URL
is a Makefile variable, and gitea-db is a running cnpg cluster. Capitalisation
discriminates prose from identifiers. Archived workplans are left as historical
record.
Blueprint 5.2: forge placement decided - workload to rapp-forgejo, layer
responsibility to S4 railiance-enablement, which already declares the handoff
contract and gains its first concrete owned responsibility.
Blueprint 5.6: whether Railiance should use ArgoCD at all is recorded as an open
decision rather than acted on by removing mentions. S3 runs four live ArgoCD
Applications plus AppProjects, and the two most recent commits here add more, so
deleting the documentation would describe a system that does not exist. The
question is real; it needs a decision and a migration, not a docs edit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Consolidates what this session established: the four orthogonal repo-family
axes and the separation rule that keeps Forgejo orgs, State Hub domains and
rapp contexts from being derived from each other; the stack levels plus the
concerns that sit beside the stack; the self-evidencing thread and its two
halves (evidence plane, now owned by railiance-telemetry, and the conformance
loop, still unowned); verified repository status including the two superseded
lineages; and the open placement decisions, each naming railiance-master as
the decider rather than settling them here.
Records that the railiance-forge retirement hypothesis was tested and rejected
- it and helix-forge are different lineages, one operational and one
methodological - so forge should be placed, not retired.
Also notes for tooling that the bootstrap/cluster/hosts/infra repos have
unrelated histories but near-identical content, so fleet inventories must
deduplicate by origin URL rather than by directory.
SCOPE.md gains the telemetry emission relationship and a pointer to the
blueprint.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reads all ten local railiance-* INTENT.md files as a statement of intended
architecture, cross-checked against git history, remotes and the live cluster.
Ten repos declare eight distinct intents. The aspiration is coherent and the
handoffs are stated from both sides. Findings: railiance-bootstrap is a second
local clone of railiance-cluster rather than a repo (which means fleet counts
built by scanning ~ overcount, including the 112 figure in the org refactor);
railiance-hosts and railiance-infra are distinct remotes with unrelated
histories and byte-identical INTENT, both claiming S1; railiance-forge is
unplaced in the OAS stack dimension; S4 is aspiration-only at 25 commits and
zero workplans.
The strongest finding is a shared thread nobody named: five layers
independently aspire to be "self-evidencing" or "auditable", and no repo owns
the verification substrate that would evaluate those claims. That is the same
gap as the enforcement control loop, arrived at from the opposite direction.
Also notes missing homes for observability, end-to-end restore proof, and the
cost-attribution interface.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
