the-custodian/docs/decisions/2026-10-11-security-unblock-decisions.md

# Security unblock decisions (D1, D2, D3) — 2026-10-11

- **Decided by:** Bernd Worsch (founder), in an interactive session with Claude Code
- **Context:** `history/20261011-netkingdom-security-progress-assessment.md`; packets D1–D3 from
  `docs/decision-packets-2026-10-03.md` (CUST-WP-0075). Build-mode stance applies
  (construction site until production close-down; re-arm items are logged below).

## D2 — ArgoCD owns production (`89f1058f-33bc-47a8-8a49-0b44d426c67e`) — **GO (blanket)**

1. ArgoCD owns production. `make deploy` is no longer a production path for the adopted apps.
2. The RPF-WP-0044 sequence (issue-core adoption → ESO adoption with CRD `Prune=false,Delete=false`
   → restore automated prune/selfHeal on `railiance-apps-root`) is approved as a whole.
   **Each step only needs the previous step's automated health/diff proof.** No further
   founder go-ahead is required per step. This also covers RPF-WP-0043-T04 (merge), RPF-WP-0036-T03,
   RPF-WP-0048-T02 (after the 24 h soak) and RAPP-POLICY-NEXUS-WP-0002-T05 (policy-nexus onboarding).
3. activity-core's autonomous scope is accepted as drafted in ACTIVITY-WP-0041-T03, and its scheduling
   role as in ACTIVITY-WP-0042-T01/T03. Pruning stays off until the complete tracked set is proven.
   Changes to access, secrets, schema/maturity rules, destructive operations and budget ceilings
   remain in the monthly decision packet. Failed routine checks stop, retry or roll back
   automatically and produce evidence. They do not ask the founder.
4. The read-only check of coulombcore's ArgoCD (RPF-WP-0044-T08) is an operator task and goes into
   the attended-window checklist (see D1). It is not a decision.

## D3 — Trust root and secret custody (`1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa`) — **build-mode default**

1. The founder alone holds the OpenBao unseal shares and recovery keys: password manager plus one
   offline copy. Break-glass is invoked by the founder only. (WARDEN-WP-0027-T02.)
2. P3 disposition: **(b) response-wrapped issuer delivery with one-time unwrap.** Agents implement it
   (exact actor/path/audience, TTL, audit, replay/crash cleanup and rollback boundaries go into the
   implementing workplan's design and are reviewed there). The current attended rule stays in force
   until (b) is proven on one lane.
3. No rotation trigger has occurred. CUST-WP-0073-T05 stays deferred.
4. The whynot-design npm pointer HOLD stays in place until SECRETS-WP-0006-T06 moves publishing off the
   legacy path. Then rotate and prove a fresh publish (WARDEN-WP-0037-T03, RPF-WP-0035-T07).
5. **Re-arm at production close-down:** split unseal/recovery to a quorum with a second holder, and
   formalize break-glass.

## D1 — Attended OpenBao window (`62aa95e4-3ccc-4867-8806-5e3db005b483`) — **standing rule**

1. The RPF-WP-0035-T06 scoped delivery proof (memo `infd-20261003-p01`, proof of 2026-09-13) is **accepted**.
2. Per-lane informed-decision approvals are replaced by a standing rule: **any lane that has a reviewed,
   receipt-producing command is pre-approved for the next attended window.** A lane without such a
   command is not a founder question. It is owner work.
3. The window checklist is generated deterministically from task state (tasks whose `blocking_reason`
   names the attended window and whose owner has published the command). The founder runs a short
   window whenever the checklist is non-empty.
4. Resolving this decision does not mean that every lane was provisioned. Owners re-qualify their tasks
   against the standing rule (C-40).

## Triage authorization

The founder authorized demoting off-critical-path wait tasks in the security repos to
`flavor: residual`, or cancelling them. Changes are listed in the assessment history file.

## Round 2

### Standing build-mode change authorization — **adopted** (to be encoded in policy-nexus)

**Pre-authorized:** any non-destructive live change on Railiance that has (1) a reviewed diff or dry-run,
(2) a declared rollback, (3) a named abort owner, and (4) emits a receipt. An agent or the attended
window may execute it without a separate founder go. Conditional approvals execute once their listed
evidence exists.

**Still founder-gated:** destructive deletion of data or hosts; changes to access or secret policy
*scope* (who can read or do what); new spend ceilings; public publication.

Resolves: `877c268b` (ops-warden fetch pin rollout, including retroactive acceptance of the install
that already ran), `0d6792b6` (INFD-WP-0005-T05 requester custody, executes under the rule),
`e071b34e` (FLEX-WP-0020-T11 old checkout cleanup: conditional on the listed soak evidence; local
checkout removal is not destructive to data held elsewhere), and `ab85ae8a` (RPF-WP-0035-T08 factory
audit acceptance: conditional on the archive readback and the revocation receipt).

**Re-arm at production close-down:** narrow the rule to the production change process.

### D10 remainder — Identity record and MFA (`cef97ccd`) — **accepted in principle**

The MFA-required journeys specified in USER-WP-0027/0028 are accepted. The founder's real-factor
live acceptance (U05–U08, P04–P06) is an attended-window item. Its findings are normal defects,
not decisions.

### D4 + D5 — Destructive cleanup (`5d8dcdb5`) and production risk (`2fd5849c`) — **accept + conditional**

- The single-node / shared-control-plane risk is accepted as a build-mode risk. **Re-arm before customers.**
- The single-node outage exercise and the native clock verification are authorized.
- The CoulombCore / railiance-master destructive cleanups (NK-WP-0022-T08, RMASTER-WP-0020-T08,
  RAIL-HO-WP-0011-T08) are approved as a batch. **They execute only after one passing railiance01
  restore/restart drill receipt and expired retention windows.**
- The State Hub primary stop and the core-hub cutover follow the standing change rule.
- Hall of Helix publication is not covered. It stays with consent decision `8a095daa`.

## Round 3 — attended-window choices (2026-10-11)

- **C1, RPF-WP-0038-T04, Forgejo primary backup:** prefix
  `s3://railiance-platform-pg-backup/platform-pg/application-archives/forgejo/` (same bucket contract
  as coulomb-social, Standard Multi-AZ nl-ams). Retention is 7 daily + 4 weekly + 3 monthly full
  archives through bucket lifecycle, never deleting the newest good archive. Nextcloud becomes the
  essentials-only secondary (about 273 MiB) within the 10 GiB budget. The worker gets a prefix-scoped
  credential.
- **C2, RPF-WP-0053-T02/T03, coulomb-social paired backup:** approved as proposed. A new
  prefix-scoped Scaleway IAM credential (write and version-read under
  `application-archives/coulomb-social/` only) is delivered to `/etc/coulomb-social-backup/primary.env`
  (0600, parent 0700). Schedule: daily 03:15 UTC (+5 min jitter), RPO 24 h, stale alarm 26 h,
  provisional RTO 60 min. Acceptance needs the independent retrieve + restore comparison.
- **C4, NK-WP-0022-T08 drill:** the railiance01 restore/restart drill is blue-lane. Sol prepares and
  runs it. The approved D4 deletion batch goes into the attended window only once a passing drill
  receipt exists.
- **USER-WP-0035-T02** was not a founder choice. The mail lane exists (EMAIL-WP-0004). The remaining
  work is user-engine's setup-link delivery handoff, so it was returned to the owner.

## Round 4 — CoulombCore (2026-10-11, late)

CoulombCore is not needed for anything. **It is retired and the machine reused.** This extends the D4
batch approval to wiping the machine after the host-side inventory. It still executes only after the
passing railiance01 restore/restart drill receipt. Do not rotate k3s certificates or restart k3s there
first: the certificates expired on 2026-08-31, which keeps the undeclared old ArgoCD frozen.
Evidence: railiance-platform `docs/evidence/2026-10-11-coulombcore-argocd-frozen.md`. Tasks:
RPF-WP-0044-T08 done; NK-WP-0022-T08 carries the retirement.