the-custodian/docs/decision-packets-2026-10-03.md

Decision packets — 2026-10-03

Ranked list of the founder decisions recorded by CUST-WP-0075. Each packet is one open hub decision. Tasks carry their decision_id in the owner repo. Resolving a decision raises C-40 for owner review; each concrete human act and verification must still be satisfied before its task can clear.

Rank is by what the decision unblocks per sitting, from the dependency graph in docs/evidence/2026-10-03-dependency-graph-triage/.

1. D1 — Attended OpenBao provisioning window: one session clears the pending credential lanes

• Decision id: 62aa95e4-3ccc-4867-8806-5e3db005b483

• What you do: Bernd runs one attended platform-admin session (warden access openbao-platform-admin-login --exec) and works through a pre-assembled checklist: CCR applier-apply for reviewed metadata, then value provisioning per lane, then each owner records positive/negative evidence. Resolve this decision when the window has run; tasks whose lane was not provisioned get re-qualified by their owner.

• Why this rank: Largest fan-in in the graph: clears the credential lanes that SAND-WP-0015, SECRETS-WP-0009, GLAS-WP-0012 and CUST-WP-0073 hang off (7+ workplans transitively).

• Unblocks: transitively SAND-WP-0015/0014, GLAS-WP-0012, CUST-WP-0073, FEP-WP-0008, FI-WP-0005, LLM-WP-0009, REINAH-WP-0003, SECRETS-WP-0007/0008/0009, IR-WP-0006/0007, CORE-WP-0010 — the largest fan-in in the graph

• Gated tasks (19): RPF-WP-0035-T02, RPF-WP-0035-T03, RPF-WP-0035-T06, RPF-WP-0027-T03, RPF-WP-0027-T06, RPF-WP-0038-T04, MASON-WP-0004-T02, MASON-WP-0007-T05, RAPPCOREHUB-WP-0003-T04, RAPP-OPENBAO-WP-0002-T02, SECRETS-WP-0006-T05, IR-WP-0005-T02, GLAS-WP-0015-T03, HUB-WP-0012-T06, HFACT-WP-0001-T01, HFACT-WP-0001-T03, USER-WP-0035-T02, MARKITECT-WP-0002-T07

• Readiness check (2026-10-03, later): only RPF-WP-0035-T06 is a pure human act, and it needs no session. It is drafted as informed-decision memo infd-20261003-p01 (informed-decision/docs/batches/2026-10-03-provisioning-window/). MASON-WP-0007-T05, RPF-WP-0035-T02 and RAPPCOREHUB-WP-0003-T04 still lack a reviewed command, design or CCR, and RPF-WP-0035-T08 was already provisioned on 2026-09-11. Approve lanes one memo at a time through informed-decision once each has a reviewed command, not as one batch session.

2. D2 — ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation

• Decision id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
• What you do: Bernd gives the ordered go-aheads in RPF-WP-0044 (issue-core adoption → ESO adoption with CRD Prune=false → restore prune/selfHeal), accepts activity-core's autonomous scope (ACTIVITY-WP-0041-T03) and its scheduling role (ACTIVITY-WP-0042-T01/T03). One read-only check of coulombcore's ArgoCD (RPF-WP-0044-T08) is part of it.
• Why this rank: One ordered sequence of go-aheads; unlocks the whole ArgoCD lane plus activity-core autonomy and scheduling.
• Unblocks: RPF-WP-0043, RAPP-POLICY-NEXUS-WP-0002, MASON-WP-0006, ACTIVITY-WP-0040/0041/0042, RPF-WP-0048 (the R5 lane)
• Gated tasks (16): RPF-WP-0044-T03, RPF-WP-0044-T04, RPF-WP-0044-T05, RPF-WP-0044-T06, RPF-WP-0044-T07, RPF-WP-0044-T08, RPF-WP-0043-T04, RPF-WP-0048-T02, ACTIVITY-WP-0040-T02, ACTIVITY-WP-0041-T03, RAPP-POLICY-NEXUS-WP-0002-T05, MASON-WP-0006-T06, ACTIVITY-WP-0042-T01, ACTIVITY-WP-0042-T03, RPF-WP-0036-T03, ACTIVITY-WP-0041-T02

3. D7 — Vergabe pilot: two real users run the invited setup-to-workflow acceptance

• Decision id: d06307e5-2737-461a-a2f4-a12c3b492a9a
• What you do: Bernd and the company contact complete the two-user/document workflow; railiance-apps records the restore/rollback evidence under RAPPS-WP-0014-T03.
• Why this rank: Two real users; also feeds CUST-WP-0071 sizing measurements and USER-WP-0027.
• Unblocks: RAPPS-WP-0014, VERGABE-WP-0019 → USER-WP-0027, CUST-WP-0071 measurements
• Gated tasks (2): RAPPS-WP-0014-T03, VERGABE-WP-0019-T06

4. D5 — Production risk acceptance and live-host authorizations

• Decision id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd
• What you do: Bernd accepts or mitigates the single-node/shared-control-plane risk, authorizes the single-node outage exercise, the stop of the State Hub primary, the core-hub cutover after its stabilization window, the native clock verification, the live-host authorization, and the Hall of Helix publication.
• Why this rank: Several one-line authorizations; each unblocks a separate chain (core-hub cutover, clock, state-hub retirement).
• Unblocks: REEF-RAILIANCE-WP-0003, RPF-WP-0015, STATE-WP-0079 → HUB-WP-0006, RAPPCOREHUB-WP-0002 → CORE-WP-0010/HUB-WP-0012, RCLK-WP-0005 → RCLK-WP-0004, RAIL-HO-WP-0013, HOH-WP-0002
• Gated tasks (7): REEF-RAILIANCE-WP-0003-T04, RPF-WP-0015-T03, STATE-WP-0079-T06, RAPPCOREHUB-WP-0002-T05, RCLK-WP-0005-T05, RAIL-HO-WP-0013-T04, HOH-WP-0002-T04

5. D3 — Trust root and secret custody: unseal/recovery holders, break-glass, and the deferred rotation of exposed material

• Decision id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
• What you do: Bernd decides who holds unseal shares and recovery keys, the quorum and break-glass invocation (WARDEN-WP-0027-T02), whether one of the three rotation triggers has occurred (CUST-WP-0073-T05), and the disposition of the legacy whynot-design npm pointer (RPF-WP-0035-T07).
• Why this rank: Design decision; sets the pattern every future credential lane inherits (see the assessment, P3).
• Unblocks: WARDEN-WP-0027, CUST-WP-0073 closure, RPF-WP-0035 closure
• Gated tasks (4): WARDEN-WP-0027-T02, CUST-WP-0073-T05, RPF-WP-0035-T07, WARDEN-WP-0037-T03

6. D10 — Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience

• Decision id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
• What you do: Bernd accepts or amends NK-ADR-0017 after user-engine confirms the AccountAuthority mapping, decides where a workload reads the record (OpenBao-held, platform service, or repository artifact), and accepts the MFA-required user experience from a user's perspective.
• Why this rank: User-engine has now confirmed the AccountAuthority mapping; only Bernd's acceptance of NK-ADR-0017 and the read surface remain.
• Unblocks: NK-WP-0045, NK-WP-0042
• Gated tasks (6): NK-WP-0045-T01, NK-WP-0045-T04, NK-WP-0042-T02, USER-WP-0027-T04, USER-WP-0028-T03, USER-WP-0037-T02

7. D6 — Telegram operator session: register the bots, create the channels, bootstrap the user session

• Decision id: 7f455718-66c9-4049-9aaf-1143aea39d34
• What you do: One operator session: BotFather registration (tokens into OpenBao via the attended path), private then public channel creation, dedicated account api_id/api_hash bootstrap.
• Why this rank: One operator session with BotFather; small, mechanical, unblocks four workplans.
• Unblocks: FLUID-WP-0008/0009, FT-WP-0001/0002
• Gated tasks (5): FLUID-WP-0008-T02, FLUID-WP-0008-T03, FT-WP-0001-T01, FT-WP-0001-T02, FT-WP-0002-T01

8. D8 — ops-mason plan approvals: unclear metadata paths and the live-survey plan

• Decision id: e9f44beb-ad15-4285-8996-1e66d312fe59
• What you do: Bernd rules on the genuinely unclear paths (MASON-WP-0004-T01) and approves the MASON-WP-0005 plan after the live survey (status: approved, approved_by, approved_at).
• Why this rank: Two plan approvals in ops-mason; one feeds RPF-WP-0035-T03.
• Unblocks: MASON-WP-0004, MASON-WP-0005 → RPF-WP-0035-T03
• Gated tasks (2): MASON-WP-0004-T01, MASON-WP-0005-T03

9. D12 — Company vessel founder actions: execute OH-2026-001..005, keep the load log, clear the publish gates

• Decision id: 42ad2ad5-600c-41c0-a627-cad4b0d1a29b
• What you do: Execute the five prepared operator handoffs in binky-control and record outcomes; keep the load log to 2026-10-28; clear IP ownership, domain and Impressum for the first offer.
• Why this rank: Founder-only company actions; time-gated part ends 2026-10-28 at the earliest.
• Unblocks: UPC-WP-0002, UPC-WP-0003, UPC-WP-0004
• Gated tasks (7): UPC-WP-0002-T01, UPC-WP-0002-T02, UPC-WP-0002-T03, UPC-WP-0002-T04, UPC-WP-0003-T03, UPC-WP-0004-T02, UPC-WP-0004-T03

10. D4 — Destructive cleanup after retention expiry: CoulombCore remnants, railiance-master retention, live recipient removal

• Decision id: 5d8dcdb5-6d7b-463e-bb39-0a4737331403
• What you do: After one successful railiance01 restore/restart drill and the retention windows have expired, Bernd approves each destructive deletion explicitly.
• Why this rank: Destructive cleanups; safe to defer until a restore drill has run.
• Unblocks: NK-WP-0022, RMASTER-WP-0020, RAIL-HO-WP-0011
• Gated tasks (3): NK-WP-0022-T08, RMASTER-WP-0020-T08, RAIL-HO-WP-0011-T08

11. D9 — runbook-tutorials execution-mode decisions (RBT-WP-0006 T01–T07)

• Decision id: 1e517449-2114-4a8f-9c6b-fcdbe977378e
• What you do: Bernd answers the seven design questions in one sitting: run identity, scan scope, access/identity/egress, cross-repo pack trust, browserless hosts, v0.3 design start, optional follow-up timing.
• Why this rank: Seven small design questions for runbook-tutorials; one sitting.
• Unblocks: RBT-WP-0006
• Gated tasks (7): RBT-WP-0006-T01, RBT-WP-0006-T02, RBT-WP-0006-T03, RBT-WP-0006-T04, RBT-WP-0006-T05, RBT-WP-0006-T06, RBT-WP-0006-T07

12. D11 — Operator setups with low fan-in: test-driver live-model budget and Playwright, fin-hub Qonto/DATEV confirmation

• Decision id: b6a44b55-8d10-4b96-8a71-524a0c34d2f3
• What you do: Operator agrees the bounded live-model run count and cost ceiling, installs Playwright and clears its licence, selects the engagement target; operator and Steuerbuero confirm the Qonto plan, DATEV tenant, master-data owner, workflow and retention policy.
• Why this rank: Low fan-in operator setups; defer freely.
• Unblocks: TD-WP-0003, TD-WP-0004, FIN-WP-0005
• Gated tasks (5): TD-WP-0003-T01, TD-WP-0003-T06, TD-WP-0004-T05, FIN-WP-0005-T01, TD-WP-0003-T07

2026-10-04 worker reconciliation: additional concrete human gates

These narrow decisions preserve the actual act; broad D1/D4/D5 dispositions do not substitute. All remain unresolved (open or automatically escalated) and their tasks remain wait.

Task	Required act	Decision ID
NK-WP-0011-T02	Name an actual identity adoption demand and acceptance scope	8a5d1eb8-b665-4d25-9742-a15ecfc87c0c
EMERGENT-WP-0002-T02	Ratify the doctrine/adoption scope	d20a9750-2b29-534e-8227-fb866581a6ca
RPF-WP-0035-T08	Accept archive readback and interim bearer revocation evidence	ab85ae8a-12a0-4945-ae64-1d3d86d5b26f
INFD-WP-0005-T05	Accept requester ESO and runtime custody	0d6792b6-59e4-4fa0-887a-c4e51ea8e131
INFD-WP-0005-T10	Authorize the bounded rollout after prerequisites	24b0c846-a58e-43bc-ab80-988180ddd2f9
FEP-WP-0009-T01	Obtain independent human ratings	6f698650-de45-4402-a84f-ea19ae5f96af
FLEX-WP-0020-T11	Authorize old checkout deletion after soak; protected alias excluded	e071b34e-c4d4-49d0-824d-2c58bb0ae496
FLEX-WP-0027-T03	Record actual signed-in user acknowledgements	e1868a8d-cad7-48c6-84d1-78a5a566d4a4
FLEX-WP-ADHOC-2026-10-03-T02	Give the exact live fetch-pin change go-ahead	877c268b-2089-42f1-a811-d98f549c1cb2
ACTIVITY-WP-0042-T08	Accept and authorize actual consumer runtime refresh	6110ead5-1831-4e20-aebd-ac1f978b503b

D3 (1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa) additionally retains the explicit P3 dual-control value-path choice under RPF-WP-0050-T02. The platform checklist is ready locally; date/cadence selection is the live residual CUST-WP-0076-T01 and platform return RPF-WP-0050-T03. No session is scheduled.