Collects the verified environment facts and traps from 2026-09-21:
workstation vs railiance01 kube context, tunnels, harness permissions,
change gate and rollout headroom, attended OpenBao login, secret-read
hazards, ArgoCD layout, and vocabulary. Linked from AGENTS.md and the
session protocol.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An explicit placement overrides the unmapped-is-production default for
that target only; it unblocks ops-mason's only bundle without loosening
the default for platform objects.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Founder rulings: unmapped targets are production-tier until mapped;
an evidence lapse does not loosen the path; deprecated keeps its tier.
The contact is realm:kubernetes with no layer assigned (statute 20.3 stays
unset per ADR-0009 D4). ArgoCD on railiance01 is unverified; until the
production row has a working path, the transition rule covers every
production-tier target. Resolves the conflict gate-house noted between the
two founder records.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Option C: the gate on ADMINISTER @ realm:kubernetes is tiered by ADR-0006
readiness state. Below production-approved, activation=APPROVED by founder
plan approval; at production-approved, CONSTRUCT via ArgoCD for
external-audited evidence, direct apply only as activation=BREAK_GLASS.
rapp-policy-nexus gets a dated transition to 2026-12-21.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Founder plan approval is accepted as the gate for ops-mason's phase-4
protected writes, as an operator-accepted exception to section 6.4, not a
change to the standard. Review 2026-12-21.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Join scheduler-effective cluster requests with owner/service/tenant.
Host and cluster CPUs counted once. Residual millicores are not
admission. T02–T05 remain waiting on Vergabe measurements.
Image main-54b09ee. the-custodian reset-ack then fleet refuse-mode:
52 applied, 69 noop, 2 identifier-collision refusals, 0 retirements.
Fleet-ack not run — nothing was refused for retirement.
Close T02–T06 from live hub evidence, disposition clay-borg product
records as not workplans, lift the task-reset restriction in state-hub,
dump and remove the retired local Postgres instance, and record ADR-010's
work-record divergence as closed.
Close CUST-WP-0064 after the 2026-08-24 unassisted fire ingested
clay-borg, close CUST-WP-0065 now that all 120 active repos project a
classification, and close ADHOC-2026-08-25. Mark CUST-WP-0067 T02/T10
done (reverse relays already gone; work-record recovery lives on 0068).
Park the later no-checkout SBOM regression as CUST-IN-0015. Teach the
classification gate to use this host's checkout path.
All 44 cache-only repository records resolved: 43 onboarded and classified,
agent-harness dropped by owner decision. Central holds 121 repositories.
Corrects an earlier claim in this workplan that the cache would hold nothing
unique once the repository records were resolved. That generalised a
repository-scoped result: the cache still holds ~400 workplans and ~1,950 tasks
that exist nowhere else, which is ADR-010's original divergence.
The cache database still must not be discarded.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Superseded by glas-harness and the rein concept, so there is nothing to
restore. Not onboarded to central; its cache-only record is left to disappear
when the cache database is discarded, rather than preserved as a hub-only
record with no backing file.
Successors verified present and classified on central before dropping.
Ten records remain outstanding.
Refs CUST-WP-0067-T05
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
178 AGENTS.md files moved off the 127.0.0.1:18000 reverse tunnel to the
in-cluster address; both machines report zero stale rows. 100 pushed from the
workstation, 74 picked up by pull on the node, 4 handled individually.
binky-control committed but not pushed — it carries 6 pre-existing unpushed
commits that are not this change's to publish. activity-core was already 39
behind with an unrelated dirty file; only AGENTS.md was taken from origin.
state-hub-railiance01 is now unblocked for removal.
Still open: the block has no single source, so this recurs on the next
topology change; and 68 non-AGENTS.md references need individual judgement
rather than substitution.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
