sbom-nexus/workplans/SBOM-WP-0005-wave2-resource-right-sizing.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	related	state_hub_workstream_id
SBOM-WP-0005	workplan	Wave-2 resource right-sizing from the 2026-10-21 allocation review	infotech	sbom-nexus	finished	implementation	claude	infotech	2026-10-21	2026-10-21	CUST-WP-0071 RESOURCE-WP-0008	f7c4b03d-5b88-5652-a2a0-73975ba9c5aa

SBOM-WP-0005 — Wave-2 resource right-sizing from the 2026-10-21 allocation review

Receiving workplan in sbom-nexus for the wave-2 request changes below.

Origin: the 2026-10-21 node allocation review (RESOURCE-WP-0008-T03, feeding CUST-WP-0071-T03). Per the founder's 2026-10-21 delivery interview (the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md) the small adjustments form wave 2: one receiving task per owner repo, applied later in a batch. Applying wave 2 needs a separate founder approval, so every cluster-write task here is a human-gated wait. This file changes no manifest.

Apply the reviewed request changes

id: SBOM-WP-0005-T01
status: done
priority: medium
state_hub_task_id: "faca1819-493d-54dc-8bd7-ef0db95223d1"

Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.

Workload (ns/name)	Pods	CPU request	CPU limit	CPU p95/peak 7d (m)	Memory request	Memory limit	Mem p95/peak (Mi)	Throttle	Action
sbom-nexus/sbom-nexus	1	25m → 10m	500m	3.8/5.8	64Mi → 64Mi	256Mi	80.0/80.0	0.0	decrease

Source and container detail:

• sbom-nexus/sbom-nexus: Deployment sbom-nexus, container sbom-nexus, rapp-sbom-nexus/manifests/runtime.yaml (25m/64Mi) — the deploy source lives in rapp-sbom-nexus. Memory p95 80Mi is above the 64Mi request but below the 64Mi change threshold; the owner may raise it to 96Mi in the same change.

Prepared 2026-10-21 (wave-2 worker W1a; not applied). Live owner is a server-side apply with field manager rapp-sbom-nexus (make deploy in rapp-sbom-nexus). Change: rapp-sbom-nexus bd3eff4, manifests/runtime.yaml CPU request 25m → 10m; memory 64Mi and limits unchanged. The optional 96Mi raise was not taken. Server-side diff of the rendered runtime.yaml: only resources.requests.cpu. The migration Job is gone live; make deploy would recreate and wait on it, so apply only the runtime part: make render && kubectl apply --server-side --force-conflicts --field-manager=rapp-sbom-nexus -f .rendered/runtime.yaml (local kubectl rather than the Makefile's ssh path). The pre-existing forge-URL test failure is unrelated to this change.

Evidence: resource-control docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md (+ .json, commit 3d9b1bd). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).

Steps:

1. Map the pod-aggregate proposal onto the named container(s) in the source file; where a workload has several containers or pods, split by the per-pod figures in 2026-10-21-workload-usage.json and keep the sum at the proposed value.
2. Prepare the source change as a reviewed commit (no push, no sync) and record the before values here.
3. Apply only inside the batched wave-2 rollout, after founder approval, through the owner's normal deploy path (ArgoCD sync or documented helm/kubectl apply).

Verification: kubectl -n <ns> get pod -o jsonpath='{..resources}' shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.

Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after kubectl get -o yaml captures as the receipt.

Applied — 2026-10-22 (SBOM-WP-0005-T01)

Applied under the founder's wave-2 authorization (the-custodian docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md), after a full-render diff against live that showed resources only. Server-side apply of the runtime render with field manager rapp-sbom-nexus; Ready. Evidence: the-custodian docs/evidence/2026-10-22-wave2-apply.md.