From eb9bcdd0b4c4f9e511dda388497d994569c74ad4 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 21 Oct 2026 09:04:14 +0200 Subject: [PATCH] CUST-WP-0071: record wave-1/wave-2 receiving work and apply blocker Co-Authored-By: Claude Opus 5.5 --- ...6-10-21-cust-wp-0071-delivery-interview.md | 10 +++++++++ ...sured-workload-sizing-and-weekly-review.md | 22 +++++++++++++++++++ 2 files changed, 32 insertions(+) diff --git a/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md b/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md index d097cdb1..b0b31467 100644 --- a/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md +++ b/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md @@ -68,3 +68,13 @@ completion of T04. only. Wave 2 and anything outside the reviewed wave-1 diffs need a new approval. - ihp-railiance-probe: "Find owner first". Trace the owner from the repos; make no change until the owner is confirmed. + +## Wave-1 apply path and probe (same session) + +- Apply path: "Local kubectl allowed". The ssh-based installers can't read the k3s + kubeconfig on railiance01, so this session applies the reviewed wave-1 changes + with kubectl/helm from the workstation, using its kubeconfig, one owner at a time. +- ihp-railiance-probe: "Approve uninstall" (CORE-WP-0012-T02). Run + `helm uninstall ihp-railiance-probe -n coulomb`; delete namespace `coulomb` only + if it is empty. +- flex-auth: its receiving task goes to access-engine, next to `charts/flex-auth`. diff --git a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md index 79ac815f..7667efb9 100644 --- a/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md +++ b/workplans/CUST-WP-0071-measured-workload-sizing-and-weekly-review.md @@ -568,3 +568,25 @@ CPU below 500m, or apps-pg above 600m. Gaps: no SSO, ingress or TLS; a standalon database instead of CNPG; a synthetic closed loop; a single quiet-hour run. These results are provisional. They do not prove human workflow acceptance, which stays with RAPPS-WP-0014-T03 / VERGABE-WP-0019. + +## Wave-1 and wave-2 receiving records — 2026-10-21 + +Wave-1 receiving work is ready but not applied: +- RAIL-KNATIVE-WP-0003 (rail-knative `76cb9c7`, pushed) and RCLUSTER-WP-0020 + (railiance-cluster `3b18b84`, pushed): HPA caps 20/5/10 → 3/2/3, CPU requests 220m → 60m. +- STATE-WP-0099 (state-hub `a6afb08`): API 250m → 390m, state-hub-db → 70m/416Mi, + preflight surge read from the values. This has to land after Knative and before + forge and telemetry. +- FORGE-WP-0011 (railiance-forge `6d79567`): a patch for railiance-apps. gitea gets + 200m/1104Mi with a 1536Mi limit; the runner pod gets 125m/496Mi with dind limited to 1500m/2Gi. +- rapp-telemetry: worker still running. + +Wave-2 receiving workplans are committed in 21 repos: the 20 listed by the worker, +plus access-engine FLEX-WP-0038 (`9f954a0`) for flex-auth. They include CORE-WP-0012-T02, +the uninstall of the leftover ihp-railiance-probe Helm release, which the founder +approved. Every wave-2 task waits on `needs_human`. + +Apply blocker: the founder allowed local kubectl for wave 1, but Claude Code's +permission classifier refuses cluster writes from this session ("Protected-Scope +IaC Apply"). The founder runs the applies, or adds a permission rule. No +production allocation has changed.