the-custodian/docs/decisions/2026-10-11-security-unblock-decisions.md

Security unblock decisions (D1, D2, D3) — 2026-10-11

• Decided by: Bernd Worsch (founder), in an interactive session with Claude Code
• Context: history/20261011-netkingdom-security-progress-assessment.md; packets D1–D3 from docs/decision-packets-2026-10-03.md (CUST-WP-0075). Build-mode stance applies (construction site until production close-down; re-arm items are logged below).

D2 — ArgoCD owns production (89f1058f-33bc-47a8-8a49-0b44d426c67e) — GO (blanket)

1. ArgoCD owns production. make deploy is no longer a production path for the adopted apps.
2. The RPF-WP-0044 sequence (issue-core adoption → ESO adoption with CRD Prune=false,Delete=false → restore automated prune/selfHeal on railiance-apps-root) is approved as a whole. Each step only needs the previous step's automated health/diff proof. No further founder go-ahead is required per step. This also covers RPF-WP-0043-T04 (merge), RPF-WP-0036-T03, RPF-WP-0048-T02 (after the 24 h soak) and RAPP-POLICY-NEXUS-WP-0002-T05 (policy-nexus onboarding).
3. activity-core's autonomous scope is accepted as drafted in ACTIVITY-WP-0041-T03, and its scheduling role as in ACTIVITY-WP-0042-T01/T03. Pruning stays off until the complete tracked set is proven. Changes to access, secrets, schema/maturity rules, destructive operations and budget ceilings remain in the monthly decision packet. Failed routine checks stop, retry or roll back automatically and produce evidence. They do not ask the founder.
4. The read-only check of coulombcore's ArgoCD (RPF-WP-0044-T08) is an operator task and goes into the attended-window checklist (see D1). It is not a decision.

D3 — Trust root and secret custody (1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa) — build-mode default

1. The founder alone holds the OpenBao unseal shares and recovery keys: password manager plus one offline copy. Break-glass is invoked by the founder only. (WARDEN-WP-0027-T02.)
2. P3 disposition: (b) response-wrapped issuer delivery with one-time unwrap. Agents implement it (exact actor/path/audience, TTL, audit, replay/crash cleanup and rollback boundaries go into the implementing workplan's design and are reviewed there). The current attended rule stays in force until (b) is proven on one lane.
3. No rotation trigger has occurred. CUST-WP-0073-T05 stays deferred.
4. The whynot-design npm pointer HOLD stays in place until SECRETS-WP-0006-T06 moves publishing off the legacy path. Then rotate and prove a fresh publish (WARDEN-WP-0037-T03, RPF-WP-0035-T07).
5. Re-arm at production close-down: split unseal/recovery to a quorum with a second holder, and formalize break-glass.

D1 — Attended OpenBao window (62aa95e4-3ccc-4867-8806-5e3db005b483) — standing rule

1. The RPF-WP-0035-T06 scoped delivery proof (memo infd-20261003-p01, proof of 2026-09-13) is accepted.
2. Per-lane informed-decision approvals are replaced by a standing rule: any lane that has a reviewed, receipt-producing command is pre-approved for the next attended window. A lane without such a command is not a founder question. It is owner work.
3. The window checklist is generated deterministically from task state (tasks whose blocking_reason names the attended window and whose owner has published the command). The founder runs a short window whenever the checklist is non-empty.
4. Resolving this decision does not mean that every lane was provisioned. Owners re-qualify their tasks against the standing rule (C-40).

Triage authorization

The founder authorized demoting off-critical-path wait tasks in the security repos to flavor: residual, or cancelling them. Changes are listed in the assessment history file.

Round 2

Standing build-mode change authorization — adopted (to be encoded in policy-nexus)

Pre-authorized: any non-destructive live change on Railiance that has (1) a reviewed diff or dry-run, (2) a declared rollback, (3) a named abort owner, and (4) emits a receipt. An agent or the attended window may execute it without a separate founder go. Conditional approvals execute once their listed evidence exists.

Still founder-gated: destructive deletion of data or hosts; changes to access or secret policy scope (who can read or do what); new spend ceilings; public publication.

Resolves: 877c268b (ops-warden fetch pin rollout, including retroactive acceptance of the install that already ran), 0d6792b6 (INFD-WP-0005-T05 requester custody, executes under the rule), e071b34e (FLEX-WP-0020-T11 old checkout cleanup: conditional on the listed soak evidence; local checkout removal is not destructive to data held elsewhere), and ab85ae8a (RPF-WP-0035-T08 factory audit acceptance: conditional on the archive readback and the revocation receipt).

Re-arm at production close-down: narrow the rule to the production change process.

D10 remainder — Identity record and MFA (cef97ccd) — accepted in principle

The MFA-required journeys specified in USER-WP-0027/0028 are accepted. The founder's real-factor live acceptance (U05–U08, P04–P06) is an attended-window item. Its findings are normal defects, not decisions.

D4 + D5 — Destructive cleanup (5d8dcdb5) and production risk (2fd5849c) — accept + conditional

• The single-node / shared-control-plane risk is accepted as a build-mode risk. Re-arm before customers.
• The single-node outage exercise and the native clock verification are authorized.
• The CoulombCore / railiance-master destructive cleanups (NK-WP-0022-T08, RMASTER-WP-0020-T08, RAIL-HO-WP-0011-T08) are approved as a batch. They execute only after one passing railiance01 restore/restart drill receipt and expired retention windows.
• The State Hub primary stop and the core-hub cutover follow the standing change rule.
• Hall of Helix publication is not covered. It stays with consent decision 8a095daa.

Round 3 — attended-window choices (2026-10-11)

• C1, RPF-WP-0038-T04, Forgejo primary backup: prefix s3://railiance-platform-pg-backup/platform-pg/application-archives/forgejo/ (same bucket contract as coulomb-social, Standard Multi-AZ nl-ams). Retention is 7 daily + 4 weekly + 3 monthly full archives through bucket lifecycle, never deleting the newest good archive. Nextcloud becomes the essentials-only secondary (about 273 MiB) within the 10 GiB budget. The worker gets a prefix-scoped credential.
• C2, RPF-WP-0053-T02/T03, coulomb-social paired backup: approved as proposed. A new prefix-scoped Scaleway IAM credential (write and version-read under application-archives/coulomb-social/ only) is delivered to /etc/coulomb-social-backup/primary.env (0600, parent 0700). Schedule: daily 03:15 UTC (+5 min jitter), RPO 24 h, stale alarm 26 h, provisional RTO 60 min. Acceptance needs the independent retrieve + restore comparison.
• C4, NK-WP-0022-T08 drill: the railiance01 restore/restart drill is blue-lane. Sol prepares and runs it. The approved D4 deletion batch goes into the attended window only once a passing drill receipt exists.
• USER-WP-0035-T02 was not a founder choice. The mail lane exists (EMAIL-WP-0004). The remaining work is user-engine's setup-link delivery handoff, so it was returned to the owner.

Round 4 — CoulombCore (2026-10-11, late)

CoulombCore is not needed for anything. It is retired and the machine reused. This extends the D4 batch approval to wiping the machine after the host-side inventory. It still executes only after the passing railiance01 restore/restart drill receipt. Do not rotate k3s certificates or restart k3s there first: the certificates expired on 2026-08-31, which keeps the undeclared old ArgoCD frozen. Evidence: railiance-platform docs/evidence/2026-10-11-coulombcore-argocd-frozen.md. Tasks: RPF-WP-0044-T08 done; NK-WP-0022-T08 carries the retirement.