the-custodian/docs/evidence/2026-10-22-wave2-apply.md

CUST-WP-0071 wave 2 — apply evidence (2026-10-21/22, 22:00–22:50 UTC)

Authority: docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md (sections "Wave 2" and "Wave 2 apply scope").

Method:

• Four worker agents prepared the owner changes in disjoint repo sets.
• Each change was diffed against live as a full render, showing changed key paths only, with no Secret values.
• Applies went one owner at a time through the owner deploy path. Where an owner's make target goes through the broken ssh hop, the equivalent local command was used.
• Databases were restarted one at a time, each followed by a health check.

Node CPU requests (of 4000m allocatable)

	CPU requested	Memory requested
Before wave 2	3840m (96%)	12496Mi (78%)
After wave 2	2755m (68%)	12356Mi (77%)

Afterwards, nothing was Pending, every Deployment and StatefulSet was Ready, and all 50 ExternalSecrets reported SecretSynced. Argo CD apps were Synced and Healthy, except bao-notice and informed-decision, which were already OutOfSync before wave 2.

Applied

• Stateless applications:

  • core-hub (Helm 34), coulomb-social (Helm 17) and reuse-surface (Helm 12).
  • issue-core: Argo CD pin 11af3cb.
  • canned-prompts and sbom-nexus: runtime manifest only, so no migration Job re-ran.
  • tenant-engine, audit-core (Deployment only), mail-address-semantics and rapp-qonto.
  • email-connect, including the approved annotation drift.
  • rein-aharness, including the approved labels; Deployment only.
  • flex-auth-ops-warden (Helm 4).
  • playwright: CPU limit 2 cores.
  • Vergabe: memory 512Mi plus the approved release-unit label, Helm 4.
  • inter-hub: release uninstalled.

• Identity stack:

  • lldap CPU limit raised from 200m to 1 core; it had been throttled 54%.
  • authelia, keycape, identity-provisioner and privacyIDEA right-sized.
  • Checks: KeyCape discovery returns 200, and the forge sign-in redirect works.

• Platform:

  • Argo CD controller and repo-server.
  • ESO (Helm 9) and the openbao UI gateway.
  • cert-manager (Helm 2): the ACME solver nameserver flag is now written into values.
  • traefik, through its HelmChartConfig; ingress returned 200 throughout.

• Databases (single-instance CNPG; each restart confirmed with the new requests and Cluster in healthy state):

  Cluster	Restarted (UTC)	Notes
  platform-pg-2	—	—
  platform-pg	—	dependents logged connection refusals for about 1 min after "healthy", then recovered
  user-engine-pg	22:33	—
  forgejo-db	22:37	the forge stayed reachable
  net-kingdom-pg	22:40	—
  target-revenue-pg	22:42	the first Argo sync stopped mid-restart; a second sync completed

• activity-core: the infrastructure, including the app-db and temporal-db StatefulSets and their declared 1Gi limits, the relay and llm-connect.

Not applied (open, with owner records)

• flex-auth: 8 of 9 releases. Chart HEAD would add --caller-audience and change sitting's image; that needs owner review (FLEX-WP-0038-T01).
• activity-core api, worker and event-router: the promotion check admits image changes only, so this needs an exception (ACTIVITY-WP-0049-T01).
• CNPG operator (100m→50m): it has no source file (RAPP-POSTGRES-WP-0008-T01).
• k3s addons (coredns, metrics-server, local-path-provisioner): founder-run with sudo on railiance01 (RCLUSTER-WP-0020-T03). kube-reserved and system-reserved follow only after that and a measurement.
• Namespaces coulomb and inter-hub: the founder checks leftover credential objects before deleting them.