From e98dd26153973637e9a449b44b41a65b113452a0 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 21 Sep 2026 15:47:36 +0200 Subject: [PATCH] Place the whitehat namespace in the non-production tier (founder). An explicit placement overrides the unmapped-is-production default for that target only; it unblocks ops-mason's only bundle without loosening the default for platform objects. Co-Authored-By: Claude Opus 5 --- docs/kubernetes-change-gate-decision.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/docs/kubernetes-change-gate-decision.md b/docs/kubernetes-change-gate-decision.md index 0f8b070..9a3a9a8 100644 --- a/docs/kubernetes-change-gate-decision.md +++ b/docs/kubernetes-change-gate-decision.md @@ -32,6 +32,16 @@ The question is what gates `ADMINISTER @ realm:kubernetes`, and whether that gat 3. **Why production goes through git: the `EvidenceBoundary` dimension.** A direct apply is `target-audited`: the only evidence of the change is held by the realm being changed. A change through the manifest repository adds `external-audited` evidence, which survives the actor and the realm. For production that is the property that matters, and it is a statement about evidence, not about trust in ops-mason. +## Explicit tier placements + +Some targets have no binding readiness state, but the founder has placed them in a tier explicitly. An explicit placement overrides the "unmapped is production-tier" default for that target only. + +| Target | Tier | Decided | Reason | +|---|---|---|---| +| namespace `whitehat` (whitehat-security; ops-mason bundle `whitehat-foundational-plane`) | non-production | founder, 2026-09-21 | A security-testing workload that no other layer depends on at runtime. Placing it explicitly keeps the unmapped default strict for real platform objects, and makes whitehat a deliberate exception rather than an accidental block. | + +A placement is revisited if the target gains dependants, or if it gets a binding with its own readiness state. If it gets a binding, the binding's state governs from then on. + ## Transition for rapp-policy-nexus `rapp-policy-nexus` is `production-approved` (reef-railiance `bindings/rapps.yaml`), but ArgoCD does not manage it. Its `railiance-apps-root` applications are external-secrets, issue-core, openbao-secretstore and target-revenue. So the production path does not yet exist for the one workload that needs it.