RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding
was adopted upstream and its canonical form is the provider: block in
tenancy.yaml; adaptive-pricing declined the standing co-signature and
supplied typed tier minima instead, recorded in ADR-0002. Three corrections
against our own output are recorded in the documents rather than edited
away.
RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as
overflow, enforced by make apps-pg-verify-capacity). T01/T02 are
repository-complete: backup target, retention, per-consumer connection
limits, role timeouts and Burstable resources are declared in source and
published in s3-consumer-interfaces 1.1.0 before rollout. They stay in
progress because no live application, backup success or restore proof
exists, and declared configuration is not a section 13 artifact. T04 waits
on that window.
apps-pg R reason corrected to say the target is declared-not-applied rather
than absent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Placement policy 3.1 records that the P1 levels for vergabe and
coulomb_social are provisioning declarations without the SS13 isolation
probes - apps-pg has none. 3.2 records that apps-pg cannot produce the
noisy-neighbour artifact at all until per-consumer controls exist, per
SS13.4: with nothing to bind, a probe could only demonstrate degradation.
RPF-WP-0019 seeded for the three live defects the disclosure work found:
no backup, no per-consumer controls, no isolation probes. Kept separate
from RPF-WP-0018 so declaring is not confused with fixing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Self-audit after reading SS6, SS11, SS12 and SS13 in full rather than the
sections cited in review.
openbao A:2 -> A:0. The claim was incoherent (it invoked the absence of
tenant context to justify E:0 and ignored it to claim A2, which SS4.2
defines in terms of tenant context) and unevidenced at the moment of
claiming, which SS13.1 forbids and SS13.1a does not excuse above the floor.
The real authorization evidence, openbao-verify-token-grants.py, is
consumer-boundary and is now cited under the provider statement.
Floor claims carry reason: per SS13.1a; permanent-by-design lines are
marked so SS12 guard does not read them as stalled.
The provider-versus-consumer finding is narrowed: SS6 plus the flex-auth
I1-forever precedent already express a structurally permanent low level,
so that half is withdrawn. What survives is that a provider cannot state
the level it makes reachable for its consumers.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Replies sent to policy-nexus (F1 substrate boundary, F2 ADR surface, F5
frontmatter corpus), rapp-postgres and net-kingdom (F3 rule/number split,
F4 provider-versus-consumer ladders), tenant-engine (placement policy
answering its three asks), adaptive-pricing (co-signature requested) and
railiance-master (bao.coulomb.social still open, second public name
proposed). Routed inbox marked read.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T01 docs/tenancy-posture.md - vector set per service rather than one repo
vector, with the provider-versus-consumer finding routed to net-kingdom.
T02/T03/T06 docs/placement-policy.md - accepts placement ownership scoped
to rule-here/number-there, records a placement owner per workload, reports
the latency-critical + batch co-residency on platform-pg, marks the
connection-ceiling trigger unmonitored pending railiance-telemetry, and
answers the retention floor/ceiling question.
T04 s3-consumer-interfaces 1.1.0 - quota disclosure per SS10.2. Surfaces
that apps-pg has no backup, no resource limits and no tuned parameters.
T05 docs/adr/ created with a mandatory-frontmatter convention and the
first three ADRs. This repo previously held none.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routed by tenancy-posture_v0.1 §19.2/§20 (rapp-postgres, tenant-engine) and
by POLICY-NEXUS-WP-0001, which assigns this repo substrate ownership for
policy.coulomb.social and includes it in the ADR publication corpus.
Records four findings against the policy as drafted: the substrate
assignment crosses the S1/S2 boundary; this repo holds no ADRs and records
decisions in the hub, so its decisions are unpublishable; §19.8 asks S3 for
a number that lives in rapp-postgres; and the posture vector is
service-shaped while this repo is a layer.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Retires the shared prefix. Live plans move to the new prefix keeping their
running number; finished and archived files keep the old prefix as
historical record, per the ADR-007 option 2 migration ruling.
Hub UUIDs are unchanged, so reconciliation matches on
state_hub_workstream_id rather than filename and will update the slug in
place instead of registering duplicates.
Assigned in RMGR-WP-0004-T09.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read the resource-control open/restricted signal and refuse new orders
that would exceed a restricted entity's published allowance. Open and
missing signals stay unchanged. Safety paths admit with an exception.
Item 13 is the restore RESOURCE-WP-0002 already proved. Item 14 retires
the dead Bitnami postgresql-ha deploy path and gates Valkey until a
consumer exists. Item 17 publishes the versioned S3 consumer-interface
index.
Use IAM application resource-control and policy Scoped backup access.
OpenBao path is platform/workloads/railiance/backup/object-storage.
rapp-postgres keeps Secret platform-pg-backup-s3 as the first projection.
Publish capacity, recovery, labor, and allocation-driver evidence for
resource:railiance:apps-pg so resource-control can forecast and allocate
without reading application data or inventing booked cost.
Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.
Converge the S3 platform-service pattern onto ADR-0007, emit the
reef-railiance live deployable inventory for the family coverage
check, and mark T02 done. Declaration edits land in rapp-openbao
and rapp-postgres.
KV store for the sender registry only. Database leases stay on the
OpenBao database engine and are consumed via VaultDynamicSecret in
audit-core. Not added to the coulombcore ArgoCD kustomization.
32 assertions, 31 pass on Railiance01. The one failure is a real defect the old
loose assertion could never have seen: Flannel VXLAN declared open to Anywhere
with no source restriction, currently absent from the host, so converging would
introduce the exposure rather than correct drift.
Also records the sharper finding from wiring it up: verify.yaml was missing the
vars_files the bootstrap play had, so the firewall assertions rendered empty and
silently asserted nothing - worse than having no check at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T04 done, and the answer changes the order. Item 10 was scored size 5 as a
greenfield build. It is not. railiance-infra already has a Goss baseline suite,
an ansible runner, a make verify target that runs it against all hosts and
commits TAP reports to git, and an evidence trail in reports/. The mechanism is
built and wired.
Two things are wrong with it and neither is a build. Nothing runs it - the last
TAP report is dated 2026-03-09, five months ago. And its firewall assertion
matches /6443\/tcp.*ALLOW/, which asserts the port is allowed but not from
whom - it passes identically whether 6443 is restricted to one operator address
or open to the internet, which is exactly the drift that went undetected. It
would however have caught the other finding, since it asserts Status: active and
UFW is inactive on CoulombCore.
Rescoped into slices: 10a (run it, tighten the assertion) is size 1-2 and rises
to WSJF 12.0, fourth overall and the highest-value item after the ratifications.
10b (schedule + alert path) is 7.0. Names the shared dependency - 10b and 9b are
the same plumbing, and building either of 9 or 10 without it produces logs
nobody reads.
The lesson recorded: the gap analysis correctly identified no-conformance-loop
as a capability gap, but the capability was two-thirds built and abandoned.
Before sizing a gap as a build, check whether it is actually an abandonment.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
T03 done: sent as ac73b172 with the recommendation that master takes the eight
ratification and taxonomy items, and including the correction that our earlier
ArgoCD report to them was wrong.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Compares INTENT (declared aspiration) against SCOPE (declared state) against
verified reality for every railiance-* repo. This was only possible now: a gap
could not be distinguished from a stale document until the architecture was
coherently defined, the SCOPE files described verified rather than assumed
reality, and the INTENT files stated current rather than copied intent.
Names the pattern that organizes the work: every gap is declared-but-unbuilt
(telemetry, S4, conformance loop), built-but-undeclared (the firewall
restriction, Q1 custody, the Plane dimension), or decided-but-unmoved (forge
placement, hosts retirement, rapp schema). The third kind is cheapest to clear
and blocks the most; the second is most dangerous, because it stays invisible
until something breaks - the firewall case was found by accident.
RAILIANCE-WP-0016 orders 19 items by WSJF with owner and reasoning per item.
Top three are nearly free and all decided-but-unmoved. Item 1, converging the
firewall allowlist, is a live exposure: two standing grants point at addresses
the ISP has reassigned. Item 2, five pending ratifications in railiance-master,
blocks a quarter of the backlog for a day of decisions.
Flags honestly that the size scores for telemetry and the conformance loop are
guesses, that item 13 is blocked rather than deprioritized, and that this
backlog belongs to railiance-master rather than S3 - it lives here only because
the analysis was done here.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 2026-08-11 decision to keep ArgoCD rested on a claim that turned out to be
wrong. Verified against both clusters once API access was restored: ArgoCD is
not on railiance01, it runs on CoulombCore, its Applications target CoulombCore
in-cluster, nothing on railiance01 is ArgoCD-managed, and the live S3 workloads
- target-revenue, openbao, external-secrets - deploy outside GitOps. Two
Applications are Degraded and one is OutOfSync/Missing.
The earlier claim that removing ArgoCD documentation would describe a system
that does not exist was backwards: the documentation already describes a
deployment path that is largely not in effect. Restates the question with three
real options - adopt properly on railiance01, retire, or relocate to Helix Forge
- and notes that doing nothing is the option with a cost.
Same defect class as RAIL-HO-WP-0009: declared and live state diverged, and
nothing detected it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
S3 has carried Q1 Security and Compliance for months - approval gates,
delegated apply, revocation semantics, front-door readiness - without the
dimension ever being named. Naming it does not change what this layer does; it
makes the responsibility legible to the rest of the fleet.
Also draws the line the other way: observability is Q2 and belongs to
railiance-telemetry, so S3's obligation is to emit through the standard contract
rather than build its own monitoring. The recoverability half is Q3 and remains
unowned.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Populates each canonical dimension with Railiance's actual position, canon's
sub-levels, owners where they exist, and honest status.
Findings from doing it:
- Q1 Security and Compliance is already implemented in S3 to a mature standard
(approval gates, delegated apply, revocation, front-door readiness) and was
never named as a dimension. Evidence the dimensions describe real structure
rather than impose vocabulary.
- Plane is operated in full and declared nowhere. P1 workload, P2 control
(ArgoCD, CNPG, ESO, cert-manager), P3 management (State Hub, master,
workplans). Likely to clarify the rail/rapp relationship, since a rail is
essentially a P1 contract.
- Intelligence is already referenced in practice - qonto-assistant cites an I1
isolation profile - and the whole agent operating model is I4-I5. Leaving it
unmodelled understates what this fleet actually is.
- Q3 Operability and Q7 Governance remain unowned; Q5 unaddressed.
Adds a recommended establishing order for railiance-master to ratify: Quality
first (most unowned concerns), Plane second (cheap, descriptive), Capability
third (blocked on the C1 attribution drift), Intelligence fourth, Logic last or
never if Helix Forge owns functional decomposition.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
