the-custodian/docs/decision-packets-2026-10-03.md

Decision packets — 2026-10-03

Ranked list of the founder decisions recorded by CUST-WP-0075. Each packet is one open hub decision. Every task it gates carries its decision_id in the owner repo, so resolving the decision (POST /decisions/{id}/resolve) raises C-40 on those tasks and their owners clear them.

Rank is by what the decision unblocks per sitting, from the dependency graph in docs/evidence/2026-10-03-dependency-graph-triage/.

1. D1 — Attended OpenBao provisioning window: one session clears the pending credential lanes

• Decision id: 62aa95e4-3ccc-4867-8806-5e3db005b483
• What you do: Bernd runs one attended platform-admin session (warden access openbao-platform-admin-login --exec) and works through a pre-assembled checklist: CCR applier-apply for reviewed metadata, then value provisioning per lane, then each owner records positive/negative evidence. Resolve this decision when the window has run; tasks whose lane was not provisioned get re-qualified by their owner.
• Why this rank: Largest fan-in in the graph: clears the credential lanes that SAND-WP-0015, SECRETS-WP-0009, GLAS-WP-0012 and CUST-WP-0073 hang off (7+ workplans transitively).
• Unblocks: transitively SAND-WP-0015/0014, GLAS-WP-0012, CUST-WP-0073, FEP-WP-0008, FI-WP-0005, LLM-WP-0009, REINAH-WP-0003, SECRETS-WP-0007/0008/0009, IR-WP-0006/0007, CORE-WP-0010 — the largest fan-in in the graph
• Gated tasks (19): RPF-WP-0035-T02, RPF-WP-0035-T03, RPF-WP-0035-T06, RPF-WP-0035-T08, RPF-WP-0027-T03, RPF-WP-0027-T06, RPF-WP-0038-T04, MASON-WP-0004-T02, MASON-WP-0007-T05, RAPPCOREHUB-WP-0003-T04, RAPP-OPENBAO-WP-0002-T02, SECRETS-WP-0006-T05, IR-WP-0005-T02, GLAS-WP-0015-T03, HUB-WP-0012-T06, HFACT-WP-0001-T01, HFACT-WP-0001-T03, USER-WP-0035-T02, MARKITECT-WP-0002-T07

2. D2 — ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation

• Decision id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
• What you do: Bernd gives the ordered go-aheads in RPF-WP-0044 (issue-core adoption → ESO adoption with CRD Prune=false → restore prune/selfHeal), accepts activity-core's autonomous scope (ACTIVITY-WP-0041-T03) and its scheduling role (ACTIVITY-WP-0042-T01/T03). One read-only check of coulombcore's ArgoCD (RPF-WP-0044-T08) is part of it.
• Why this rank: One ordered sequence of go-aheads; unlocks the whole ArgoCD lane plus activity-core autonomy and scheduling.
• Unblocks: RPF-WP-0043, RAPP-POLICY-NEXUS-WP-0002, MASON-WP-0006, ACTIVITY-WP-0040/0041/0042, RPF-WP-0048 (the R5 lane)
• Gated tasks (16): RPF-WP-0044-T03, RPF-WP-0044-T04, RPF-WP-0044-T05, RPF-WP-0044-T06, RPF-WP-0044-T07, RPF-WP-0044-T08, RPF-WP-0043-T04, RPF-WP-0048-T02, ACTIVITY-WP-0040-T02, ACTIVITY-WP-0041-T03, RAPP-POLICY-NEXUS-WP-0002-T05, MASON-WP-0006-T06, ACTIVITY-WP-0042-T01, ACTIVITY-WP-0042-T03, RPF-WP-0036-T03, ACTIVITY-WP-0041-T02

3. D7 — Vergabe pilot: two real users run the invited setup-to-workflow acceptance

• Decision id: d06307e5-2737-461a-a2f4-a12c3b492a9a
• What you do: Bernd and the company contact complete the two-user/document workflow; railiance-apps records the restore/rollback evidence under RAPPS-WP-0014-T03.
• Why this rank: Two real users; also feeds CUST-WP-0071 sizing measurements and USER-WP-0027.
• Unblocks: RAPPS-WP-0014, VERGABE-WP-0019 → USER-WP-0027, CUST-WP-0071 measurements
• Gated tasks (2): RAPPS-WP-0014-T03, VERGABE-WP-0019-T06

4. D5 — Production risk acceptance and live-host authorizations

• Decision id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd
• What you do: Bernd accepts or mitigates the single-node/shared-control-plane risk, authorizes the single-node outage exercise, the stop of the State Hub primary, the core-hub cutover after its stabilization window, the native clock verification, the live-host authorization, and the Hall of Helix publication.
• Why this rank: Several one-line authorizations; each unblocks a separate chain (core-hub cutover, clock, state-hub retirement).
• Unblocks: REEF-RAILIANCE-WP-0003, RPF-WP-0015, STATE-WP-0079 → HUB-WP-0006, RAPPCOREHUB-WP-0002 → CORE-WP-0010/HUB-WP-0012, RCLK-WP-0005 → RCLK-WP-0004, RAIL-HO-WP-0013, HOH-WP-0002
• Gated tasks (7): REEF-RAILIANCE-WP-0003-T04, RPF-WP-0015-T03, STATE-WP-0079-T06, RAPPCOREHUB-WP-0002-T05, RCLK-WP-0005-T05, RAIL-HO-WP-0013-T04, HOH-WP-0002-T04

5. D3 — Trust root and secret custody: unseal/recovery holders, break-glass, and the deferred rotation of exposed material

• Decision id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
• What you do: Bernd decides who holds unseal shares and recovery keys, the quorum and break-glass invocation (WARDEN-WP-0027-T02), whether one of the three rotation triggers has occurred (CUST-WP-0073-T05), and the disposition of the legacy whynot-design npm pointer (RPF-WP-0035-T07).
• Why this rank: Design decision; sets the pattern every future credential lane inherits (see the assessment, P3).
• Unblocks: WARDEN-WP-0027, CUST-WP-0073 closure, RPF-WP-0035 closure
• Gated tasks (4): WARDEN-WP-0027-T02, CUST-WP-0073-T05, RPF-WP-0035-T07, WARDEN-WP-0037-T03

6. D10 — Identity record and MFA: accept NK-ADR-0017, choose the record read surface, agree the MFA user experience

• Decision id: cef97ccd-4ee7-40fe-859e-1df9c9360ecb
• What you do: Bernd accepts or amends NK-ADR-0017 after user-engine confirms the AccountAuthority mapping, decides where a workload reads the record (OpenBao-held, platform service, or repository artifact), and accepts the MFA-required user experience from a user's perspective.
• Why this rank: User-engine has now confirmed the AccountAuthority mapping; only Bernd's acceptance of NK-ADR-0017 and the read surface remain.
• Unblocks: NK-WP-0045, NK-WP-0042
• Gated tasks (6): NK-WP-0045-T01, NK-WP-0045-T04, NK-WP-0042-T02, USER-WP-0027-T04, USER-WP-0028-T03, USER-WP-0037-T02

7. D6 — Telegram operator session: register the bots, create the channels, bootstrap the user session

• Decision id: 7f455718-66c9-4049-9aaf-1143aea39d34
• What you do: One operator session: BotFather registration (tokens into OpenBao via the attended path), private then public channel creation, dedicated account api_id/api_hash bootstrap.
• Why this rank: One operator session with BotFather; small, mechanical, unblocks four workplans.
• Unblocks: FLUID-WP-0008/0009, FT-WP-0001/0002
• Gated tasks (5): FLUID-WP-0008-T02, FLUID-WP-0008-T03, FT-WP-0001-T01, FT-WP-0001-T02, FT-WP-0002-T01

8. D8 — ops-mason plan approvals: unclear metadata paths and the live-survey plan

• Decision id: e9f44beb-ad15-4285-8996-1e66d312fe59
• What you do: Bernd rules on the genuinely unclear paths (MASON-WP-0004-T01) and approves the MASON-WP-0005 plan after the live survey (status: approved, approved_by, approved_at).
• Why this rank: Two plan approvals in ops-mason; one feeds RPF-WP-0035-T03.
• Unblocks: MASON-WP-0004, MASON-WP-0005 → RPF-WP-0035-T03
• Gated tasks (2): MASON-WP-0004-T01, MASON-WP-0005-T03

9. D12 — Company vessel founder actions: execute OH-2026-001..005, keep the load log, clear the publish gates

• Decision id: 42ad2ad5-600c-41c0-a627-cad4b0d1a29b
• What you do: Execute the five prepared operator handoffs in binky-control and record outcomes; keep the load log to 2026-10-28; clear IP ownership, domain and Impressum for the first offer.
• Why this rank: Founder-only company actions; time-gated part ends 2026-10-28 at the earliest.
• Unblocks: UPC-WP-0002, UPC-WP-0003, UPC-WP-0004
• Gated tasks (7): UPC-WP-0002-T01, UPC-WP-0002-T02, UPC-WP-0002-T03, UPC-WP-0002-T04, UPC-WP-0003-T03, UPC-WP-0004-T02, UPC-WP-0004-T03

10. D4 — Destructive cleanup after retention expiry: CoulombCore remnants, railiance-master retention, live recipient removal

• Decision id: 5d8dcdb5-6d7b-463e-bb39-0a4737331403
• What you do: After one successful railiance01 restore/restart drill and the retention windows have expired, Bernd approves each destructive deletion explicitly.
• Why this rank: Destructive cleanups; safe to defer until a restore drill has run.
• Unblocks: NK-WP-0022, RMASTER-WP-0020, RAIL-HO-WP-0011
• Gated tasks (3): NK-WP-0022-T08, RMASTER-WP-0020-T08, RAIL-HO-WP-0011-T08

11. D9 — runbook-tutorials execution-mode decisions (RBT-WP-0006 T01–T07)

• Decision id: 1e517449-2114-4a8f-9c6b-fcdbe977378e
• What you do: Bernd answers the seven design questions in one sitting: run identity, scan scope, access/identity/egress, cross-repo pack trust, browserless hosts, v0.3 design start, optional follow-up timing.
• Why this rank: Seven small design questions for runbook-tutorials; one sitting.
• Unblocks: RBT-WP-0006
• Gated tasks (7): RBT-WP-0006-T01, RBT-WP-0006-T02, RBT-WP-0006-T03, RBT-WP-0006-T04, RBT-WP-0006-T05, RBT-WP-0006-T06, RBT-WP-0006-T07

12. D11 — Operator setups with low fan-in: test-driver live-model budget and Playwright, fin-hub Qonto/DATEV confirmation

• Decision id: b6a44b55-8d10-4b96-8a71-524a0c34d2f3
• What you do: Operator agrees the bounded live-model run count and cost ceiling, installs Playwright and clears its licence, selects the engagement target; operator and Steuerbuero confirm the Qonto plan, DATEV tenant, master-data owner, workflow and retention policy.
• Why this rank: Low fan-in operator setups; defer freely.
• Unblocks: TD-WP-0003, TD-WP-0004, FIN-WP-0005
• Gated tasks (5): TD-WP-0003-T01, TD-WP-0003-T06, TD-WP-0004-T05, FIN-WP-0005-T01, TD-WP-0003-T07