CUST-WP-0058: DR-1/2/3 resolved — consistency refinement, plan activated

DR-1: C (instance-per-client, early cost-optimization move)
DR-2: B (coulomb.social standalone app; Binky Hedgehog as client #1)
DR-3: A (app-local accounts; demand-gated NK-WP-0011 triggers)

Refinements: consolidation-ready data model required by the service
contract; coulomb.social auto-trigger for Keycloak retired in favor of
three demand triggers. T01-T03 done (NetKingdom notified), T04/T05
unblocked, workplan active.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/business-platform-decision-records.md

@@ -2,8 +2,10 @@
 
 **Created:** 2026-07-10
 **Workplan:** `CUST-WP-0058`
-**Status:** All three decisions **pending** — Bernd's to resolve; this document
+**Status:** All three decisions **resolved** by Bernd on 2026-07-10 (hub
-frames options and recommendations only.
+decision records `d85cd185…`, `1f8b109e…`, `ebcf0573…`). See *Resolutions and
+consistency refinement* at the end; the option tables below are kept as
+decision history.
 
 ## Context
 
@@ -25,7 +27,7 @@ happens via State Hub decision records (`resolve_decision`).
 
 ## DR-1 — Tenancy model for vergabe-teilnahme
 
-**Status:** pending
+**Status:** resolved 2026-07-10 — **Option C** (hybrid)
 
 ### Question
 
@@ -59,7 +61,7 @@ German business clients.
 
 ## DR-2 — coulomb.social rebuild architecture
 
-**Status:** pending
+**Status:** resolved 2026-07-10 — **Option B** (standalone application)
 
 ### Question
 
@@ -96,7 +98,7 @@ wins.
 
 ## DR-3 — External identity path for business clients
 
-**Status:** pending
+**Status:** resolved 2026-07-10 — **Option A** (app-local accounts), demand-gated follow-up
 
 ### Question
 
@@ -130,11 +132,60 @@ lane, because a social platform on app-local accounts is not viable.
 
 ---
 
-## Resolution protocol
+## Resolutions and consistency refinement (2026-07-10)
 
-1. Each DR is registered as a pending State Hub decision (custodian topic).
+All three decisions were resolved by Bernd in the State Hub on 2026-07-10.
-2. Bernd resolves via `resolve_decision()` or by stating the choice in a
+The resolved set was then reviewed for internal consistency; two refinements
-   session; the resolving agent updates this document's status lines and the
+follow from reading the three choices together.
-   hub record together.
+
-3. `CUST-WP-0058` tasks T01–T03 track the facilitation; downstream tasks
+### Resolved set
-   stay `wait` until their gating DR is resolved.
+
+| DR | Choice | Bernd's rationale (hub record) |
+| --- | --- | --- |
+| DR-1 | **C — hybrid** | Instance-per-client to serve early customers easily, but "move on to resource cost optimization early" |
+| DR-2 | **B — standalone app** | coulomb.social is its own application, distinct in purpose and operations model; an application *of* Binky Hedgehog GmbH just as other apps are provided to clients; the fact that Binky Hedgehog provides the ecosystem (coulomb domain, Forgejo repos) is not relevant to the app itself |
+| DR-3 | **A — app-local accounts** | Lightweight version now; follow up with Keycloak (NK-WP-0011) only on actual demand |
+
+### Unifying model
+
+**Binky Hedgehog GmbH is client #1 of its own platform.** coulomb.social is
+delivered through the same standalone-app lane, service contract, and tenancy
+rules as apps sold to external clients. There is exactly one app shape
+(standalone service, forge→apps delivery) and one tenancy default
+(instance-per-client) — no special cases.
+
+### Refinement 1 — consolidation-readiness (DR-1 C ↔ DR-3 A)
+
+DR-1's early cost-optimization move implies consolidating instances later,
+which app-local accounts per instance would turn into an account-migration
+problem. Therefore:
+
+- The business-app service contract (CUST-WP-0058-T04) **must require
+  consolidation-ready design**: tenant-clean data model (all client data
+  keyed by a tenant identifier) even when deployed single-tenant.
+- **Instance consolidation is itself a DR-3 demand trigger**: when the
+  cost-optimization move consolidates instances, the platform-identity
+  follow-up (NK-WP-0011) activates as part of that move.
+
+### Refinement 2 — identity triggers corrected (DR-2 B ↔ DR-3 A)
+
+The original DR-3 framing made a coulomb.social greenlight an automatic
+Keycloak trigger. DR-2 B + DR-3 A overrule this: a standalone social app
+owning its own user accounts is a normal, viable shape. The corrected,
+purely demand-based triggers for activating NK-WP-0011 are:
+
+1. A client requests SSO / AD federation.
+2. Instance consolidation under DR-1's cost-optimization move (Refinement 1).
+3. Operational toil from local account administration across >2 apps.
+
+### Downstream actions
+
+- T04 service contract: encode instance-per-client provisioning,
+  consolidation-ready data model, app-local identity baseline.
+- T05 client-hub scoping: client↔instance mapping assumes 1..n instances per
+  client, consolidation-aware.
+- NetKingdom lane notified: NK-WP-0011 stays proposed with the three triggers
+  above (no auto-activation).
+- coulomb.social rebuild + bubble.io migration assessment: seeded as
+  standalone-app workplan skeletons (T08), consuming the same delivery lane
+  as vergabe-teilnahme.

workplans/CUST-WP-0058-business-platform-enablement.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Business platform enablement — decisions, service contract, client plane"
 domain: infotech
 repo: the-custodian
-status: proposed
+status: active
 owner: codex
 topic_slug: custodian
 created: "2026-07-10"
@@ -55,48 +55,53 @@ The Custodian owns decisions, canon, and cross-repo sequencing per ADR-001.
 
 ```task
 id: CUST-WP-0058-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "b7130553-a3d9-4dfd-91d7-6edb503bab58"
 ```
 
-Register DR-1 as a pending State Hub decision (custodian topic); present
+**Resolved 2026-07-10: Option C (hybrid)** — instance-per-client to start,
-options to Bernd; on resolution update
+early cost-optimization move. Hub decision `d85cd185…`; doc updated with
-`docs/business-platform-decision-records.md` and `resolve_decision()`.
+consistency Refinement 1 (consolidation-ready data model required by the
-Propagate the outcome into vergabe-teilnahme's SCOPE if it changes.
+service contract; consolidation is a DR-3 identity trigger). No
+vergabe-teilnahme SCOPE change needed for v1 (stays single-tenant deployed).
 
 ### T02 — Facilitate and record DR-2: coulomb.social architecture
 
 ```task
 id: CUST-WP-0058-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ec09753e-ecef-4368-af5d-5e295cdbda1e"
 ```
 
-Register DR-2 as a pending State Hub decision. If resolution is
+**Resolved 2026-07-10: Option B (standalone application)** — hub decision
-"defer until pilot" (recommended), set the revisit condition to T07
+`1f8b109e…`. coulomb.social is its own app with a distinct ops model; Binky
-completion and keep the decision open with that note. Include a pointer to
+Hedgehog GmbH acts as client #1 of its own platform, consuming the same
-the required bubble.io data-migration assessment either way.
+delivery lane and service contract as external-client apps. The bubble.io
+data-migration assessment and rebuild workplan skeletons are seeded in T08.
 
 ### T03 — Facilitate and record DR-3: external identity path
 
 ```task
 id: CUST-WP-0058-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "ffead70c-2179-46ba-a70a-cf13be87eef8"
 ```
 
-Register DR-3 as a pending State Hub decision. On resolution, message the
+**Resolved 2026-07-10: Option A (app-local accounts)** — hub decision
-NetKingdom lane so `NK-WP-0011` gains concrete activation triggers (or is
+`ebcf0573…`, demand-gated Keycloak follow-up. Refinement 2 replaces the
-activated). Record the identity mode required per app class for T04.
+"coulomb.social auto-trigger" with three demand triggers (client SSO/AD
+request; instance consolidation; local-account toil across >2 apps).
+NetKingdom lane notified 2026-07-10 (message `0d238b6e…`). Identity baseline
+for T04: app-local accounts, consolidation-ready.
 
 ### T04 — Author business-app service contract (canon standard)
 
 ```task
 id: CUST-WP-0058-T04
-status: wait
+status: todo
 priority: high
 state_hub_task_id: "a3cec70c-04a1-42a9-a6b0-3d2943b73968"
 ```
@@ -105,15 +110,18 @@ Draft `canon/standards/business-app-service-contract_v0.1.md` (proposal →
 human review, per canon gating): obligations every client-facing app must
 meet — build evidence (commit-SHA images, registry), backup/restore hooks
 into ops-hub, incident/runbook registration, cost attribution keys for
-fin-hub, identity mode (from DR-3), data-protection baseline, and instance
+fin-hub, **app-local identity baseline (DR-3 A)**, data-protection baseline,
-provisioning/upgrade duties (from DR-1). vergabe-teilnahme is the reference
+**instance-per-client provisioning/upgrade duties (DR-1 C)**, and
-implementation. **Waits on:** DR-1 and DR-3 resolution (T01, T03).
+**consolidation-ready data model** (Refinement 1: tenant-keyed data even when
+deployed single-tenant). Applies equally to client apps and Binky Hedgehog's
+own apps (coulomb.social — DR-2 B "client #1" model). vergabe-teilnahme is
+the reference implementation. Unblocked: DR-1/DR-3 resolved 2026-07-10.
 
 ### T05 — Scope client-hub (client/commercial plane)
 
 ```task
 id: CUST-WP-0058-T05
-status: wait
+status: todo
 priority: medium
 state_hub_task_id: "442b7f81-44c7-4301-9466-c99c240c4e49"
 ```
@@ -121,10 +129,10 @@ state_hub_task_id: "442b7f81-44c7-4301-9466-c99c240c4e49"
 Write a scoping note (`docs/client-hub-scoping.md`) for the missing fourth
 management plane: client registry, contracts/entitlements, client↔instance
 mapping, support/SLA state. Default shape: **core-hub extension** (ops-hub
-pattern) reusing hub-core primitives — justify any deviation. Output is a
+pattern) reusing hub-core primitives — justify any deviation. Per DR-1 C the
-draft workplan skeleton for the owning repo, not implementation.
+client↔instance model is 1..n instances per client, consolidation-aware;
-**Waits on:** DR-1 resolution (T01) — tenancy determines the
+Binky Hedgehog GmbH itself is client #1 (DR-2 B). Output is a draft workplan
-client↔instance model.
+skeleton for the owning repo, not implementation. Unblocked: DR-1 resolved.
 
 ### T06 — fin-hub client-billing gap assessment
 
@@ -156,8 +164,10 @@ pilot) client instance: vergabe-teilnahme build → immutable image in
 instance → ops-hub evidence (endpoint, backup, smoke) → fin-hub cost
 attribution. Implementation tasks live in the owning repos; this task tracks
 sequencing and captures the evidence bundle under `docs/evidence/`.
-Feeds DR-2 resolution. **Waits on:** T01 (tenancy) and T04 (contract
+DR-2 is already resolved (B), so the pilot no longer feeds that decision —
-draft — may proceed in parallel once DR-1 is resolved).
+it validates the standalone-app delivery lane that now has two consumers
+(vergabe-teilnahme and the coulomb.social rebuild). **Waits on:** T04
+contract draft (DR-1 resolved 2026-07-10).
 
 ### T08 — Closeout: decisions recorded, downstream workplans seeded
 
@@ -177,11 +187,13 @@ SCOPE.md Current State; archive this plan.
 ## Sequencing
 
 ```text
-T01 (DR-1) ──┬──> T04 (contract) ──> T07 (pilot) ──> DR-2 evidence ──> T02 closes
+[DR-1 ✓, DR-2 ✓, DR-3 ✓ — resolved 2026-07-10]
-             └──> T05 (client-hub scope)
+
-T03 (DR-3) ──┘
+T03 (NetKingdom trigger message) — small, immediate
+T04 (contract) ──> T07 (delivery-lane pilot)
+T05 (client-hub scope) — unblocked, parallel to T04
 T06 (fin-hub gap) — independent, anytime
-T08 — last
+T08 (closeout: seed coulomb.social rebuild + bubble.io migration skeletons) — last
 ```
 
 ## References