CUST-WP-0071: wave 1 applied (except Forgejo server); evidence

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

WORK-RECORDS.md

@@ -466,7 +466,7 @@
 | task | CUST-WP-0071-T01 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
 | task | CUST-WP-0071-T02 | done | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
 | task | CUST-WP-0071-T03 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
-| task | CUST-WP-0071-T04 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
+| task | CUST-WP-0071-T04 | progress | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
 | task | CUST-WP-0071-T05 | wait | — | workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md |
 | task | CUST-WP-0072-T01 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |
 | task | CUST-WP-0072-T02 | done | — | workplans/CUST-WP-0072-fleet-flavor-and-depends-on-backfill.md |

docs/evidence/2026-10-21-wave1-apply.md

@@ -0,0 +1,64 @@
+# CUST-WP-0071 wave 1 — apply evidence (2026-10-21)
+
+**Authority:** `docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`
+(wave 1; local kubectl allowed; probe uninstall approved).
+**Target:** railiance01, node 92.205.62.239, verified before each step.
+**Method:** applied from the workstation kubeconfig, one owner at a time, in the
+order STATE-WP-0099 requires.
+
+## Node CPU requests (of 4000m allocatable)
+
+| After step | CPU requested | Memory requested | Change |
+|---|---:|---:|---|
+| Before | 3605m (90%) | 9856Mi | — |
+| 1 Knative (requests 220→60m, HPA max 20/5/10→3/2/3) | 3445m | 9856Mi | −160m |
+| 2 Probe uninstalled | — | — | −50m / −128Mi |
+| 3 state-hub API 250→390m | — | — | +140m |
+| 4 state-hub-db none→70m/416Mi | 3605m (90%) | 10144Mi | +70m |
+| 5 rapp-telemetry (Prometheus 205m/1152Mi, Grafana 35m/512Mi, 10d retention) | — | — | +10m / +880Mi |
+| 6a Forgejo runner (dind 100m/432Mi, runner 25m/64Mi) | 3740m (93%) | 11520Mi (72%) | +125m / +496Mi |
+| 6b Forgejo server | deferred | | (+200m / +976Mi when applied) |
+
+Wave 1 nets out as the review predicted. The node is now at 93% of CPU
+requests. Further increases, including the deferred Forgejo server and routine
+state-hub release surges, depend on the wave-2 reductions
+(STATE-WP-0099-T06, RESOURCE-WP-0008).
+
+## Verification per owner
+
+- **Knative** (RAIL-KNATIVE-WP-0003 finished, RCLUSTER-WP-0020-T02):
+  - all six deployments request 10m and are Ready;
+  - HPA max is 3/2/3;
+  - Kourier is ClusterIP and ksvc rapp-qonto is Ready;
+  - the PodDisruptionBudgets are unchanged.
+
+  The policy `reject-secret-last-applied` refused the runtime-generated webhook
+  certificate object, which stayed unchanged; follow-up RCLUSTER-WP-0020-T04.
+- **Probe** (CORE-WP-0012-T02): the Helm release was removed. Namespace `coulomb`
+  was kept until the founder checks for a leftover probe credential object.
+- **state-hub** (STATE-WP-0099-T03..T05):
+  - Helm revision 78, API at 390m, health ok, schema current;
+  - the image also moved 5dd3df9 → c103cbf (an already-committed values bump);
+  - rollback: revision 77;
+  - the DB in namespace `databases` requests 70m/416Mi and is healthy.
+- **rapp-telemetry** (RAPP-TELEMETRY-WP-0002-T03):
+  - targets all up, about 7.3 days of history retained;
+  - the forgejo effective-request series is 0.1;
+  - host/k3s cAdvisor series are present;
+  - rollback: revision 4.
+- **Forgejo** (FORGE-WP-0011-T02):
+  - **runner:** the founder-run, redacted diff showed resources only, so it was
+    applied, and the daemon is up;
+  - **server:** deferred, because the Helm upgrade would also apply the NetKingdom
+    sign-in declaration (railiance-apps 4d6a8dd) over the source activated natively
+    on 19 Oct (CUST-WP-0080 T42/T43).
+
+## Follow-ups raised
+
+- whitehat-security `WHITEHAT-IN-0003`: a secret-aware release-diff review
+  facility, so the founder accepts a redacted report instead of diffing by hand.
+- RCLUSTER-WP-0020-T04: make the installer compatible with the annotation policy,
+  and fix its ssh/kubeconfig access path.
+- Forgejo Helm reconciliation together with the sign-in owners. Retire the
+  legacy "gitea" naming when convenient (the upstream chart name, not the retired
+  Gitea server).

workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md

@@ -152,11 +152,9 @@ unrelated deletion, procurement or automatic resource changes.
 
 ```task
 id: CUST-WP-0071-T04
-status: wait
+status: progress
 priority: medium
 assignee: the-custodian
-depends_on: [CUST-WP-0071-T03]
-blocking_reason: "Await reviewed allocation proposals and applicable workload-owner authority."
 state_hub_task_id: "944f98e2-7e42-5894-925b-752423f3a1cc"
 ```
 
@@ -590,3 +588,24 @@ Apply blocker: the founder allowed local kubectl for wave 1, but Claude Code's
 permission classifier refuses cluster writes from this session ("Protected-Scope
 IaC Apply"). The founder runs the applies, or adds a permission rule. No
 production allocation has changed.
+
+## Wave 1 applied — 2026-10-21
+
+All five wave-1 owners were applied one at a time, except the Forgejo server.
+Evidence: `docs/evidence/2026-10-21-wave1-apply.md`.
+
+- Knative: requests −160m, HPA caps 3/2/3.
+- Probe: Helm release removed (−50m).
+- state-hub: API 390m (Helm revision 78; the image also moved to an
+  already-committed c103cbf); DB 70m/416Mi.
+- rapp-telemetry: sizing, 10-day retention and the new measurement series.
+- Forgejo runner: resources only, applied after a founder-run, redacted diff.
+
+The Forgejo server upgrade is deferred, because it would also re-apply the
+NetKingdom sign-in source that was activated natively on 19 Oct (CUST-WP-0080
+T42/T43).
+
+The node is at 3740m of 4000m CPU (93%) and 72% of memory, as budgeted. T03 and T04
+stay open until the wave-2 receiving tasks reduce requests (routine state-hub
+releases need that headroom: STATE-WP-0099-T06) and the effects are observed
+over a representative window (RAPP-TELEMETRY-WP-0002-T05 re-measures after 7 days).