A change travels · Deployment model

A merge to main becomes one version, which walks through the landscapes on its own.

person Merge to nitroso.tin main. Pre-commit and CI ran lint, types, tests, chart checks. BUILT · ci.yaml
CI / CD After green CI, releaser reads the commit messages, writes Changelog.md, tags v1.4.3. DECIDED · R10 BUILT · release.yaml
CI / CD CD builds the image and packs both charts at 1.4.3 (config copied into the app chart). DECIDED · ARCH §8 CONTRADICTION · P1 built CD skips the primordial chart
Kargo The Warehouse sees all three at 1.4.3 and makes Freight. DECIDED · FLEET L520 PoC TESTED · spike A
Kargo The pichu Stage pushes 1.4.3 into tin's pichu row in fleet. No PR. DECIDED · OD D53
Argo CD Primordial chart → Primordial (records); app chart → every pichu cluster: db-init Job first, then a rolling update. DECIDED · ARCH §8; R20
Kargo When every pichu deploy is healthy: pikachu, then raichu and ampharos together. PoC TESTED · PoC D3: 112 s for 3 landscapes

Per landscape: Same version everywhere; each landscape takes its own values.<landscape>.yaml and config/<landscape> file. A broken version stops at its stage. PoC TESTED · spike A

Config lives in the repo and ships inside the app chart, so it is a normal release.

person Edit config/settings.yaml (all landscapes) or config/<landscape>.settings.yaml (one). DECIDED · R14 CONTRADICTION · S2 file names
CI / CD Same as a code change: new version, image + 2 charts. The build copies config/ into the app chart. DECIDED · HW CONTRADICTION · S1 built: config baked into the image
Kargo Kargo promotes stage by stage. DECIDED · ARCH §8
Argo CD Argo CD updates tin-config on each cluster of that landscape. DECIDED · HW
pod / ESO restart pods: Reloader restarts them. live pods: the app re-reads the folder and rebuilds its objects. DECIDED · OD D59 OPEN · S7 connection switch !A309

Per landscape: Emergency only: a person can override a chart value in the row's values: block (fleet PR). App config cannot be overridden there. DECIDED · FLEET L362 CONTRADICTION · G5 OD D3 says people stay out of fleet

No git, no release. The value changes in Infisical; ESO copies it; the pod restarts or reloads.

operator Database password: T3 makes a new login and writes it to Infisical nitroso / <landscape> / database/main. Always on. DECIDED · OD D5; secrets-chain
person App-only secret (a third-party key): a person writes it in Infisical under /tin. Who may, and the review: not written. PAPERS SILENT OPEN · S8
pod / ESO ESO refreshes Secret tin on every cluster of that landscape. DECIDED · secrets-chain BUILT · refreshInterval 1h
pod / ESO restart pods: Reloader rolls them. live pods: the app re-reads the mounted file. DECIDED · OD D59 CONTRADICTION · S3 built uses env vars, which live pods refuse
operator After the overlap window T3 revokes the old login. DECIDED · secrets-chain L346

Per landscape: Each landscape is its own Infisical environment, so a change touches only that landscape's clusters. Argo CD and Kargo are not involved.

The charts are part of the release: same path as a code change.

person Edit a template or values.yaml in infra/root_chart or infra/primordial_chart. DECIDED · R20
tool Pre-commit and CI render the chart and run chart-checks (kubectl-validate + kyverno) against the pinned policies. DECIDED · OD D52 BUILT · workspace a-helm-check
CI / CD New version; image + both charts, versions equal. DECIDED · bun-consumer L161
Kargo Same Freight path. DECIDED · ARCH §8
Argo CD Argo CD renders the chart with Helm and applies it. No kustomize. DECIDED · OD D54

A change to ESO, Reloader, gateway or Alloy goes to every cluster, but how it is pinned per landscape is not written.

person Edit and release the platform chart repo (for example chlorine = Reloader). DECIDED · goals/charts/*
CI / CD The chart is published to OCI (real publish deferred by the owner). DECIDED · charts-owner-items #5
Argo CD Argo CD installs it on every registered cluster. DECIDED · ARCH §10
Kargo Kargo stages, a fleet pin, or one pin for all clusters? Not written. The PoC used a baseline AppSet in fleet machinery/. OPEN · K2 PoC TESTED · PoC

Policies are checked twice: offline in each repo's chart checks, and in each cluster. Only the offline half is wired today.

person Change a rule in ProtoDurian/cluster-policies-standin (later: the vanadium chart). DECIDED · OD D75
person Each repo bumps the commit in its chart-checks.yaml by hand. No auto-bump written. BUILT · workspace:chart-checks.yaml PAPERS SILENT · auto-bump
tool Each repo's CI now checks its charts against the new rules. DECIDED · chart-checks.md
Argo CD Who installs the rules into real clusters, and Deny vs Warn: not settled. OPEN · K1 CONTRADICTION · K1 Deny vs Warn/Audit

A library bump is a lockfile change + release. Nothing updates on its own.

tool Dependabot opens a PR, or a person bumps on touch. No Renovate. DECIDED · SCR L345 BUILT · dependabot.yml
person bun.lock (or Chart.lock for an upstream chart) changes. DECIDED · !A201 decided #7
CI / CD Same release path as code. DECIDED · ARCH §8
Kargo Same Freight path. DECIDED · ARCH §8

Edit the primordial chart values and release. T3 does the rest; a provider move also needs a Migration record.

person Add a module, change size, or change type in infra/primordial_chart/values.<landscape>.yaml. A move (provider, region, account, major version) also adds a Migration record. DECIDED · OD D4 OPEN · X4 Migration shape is a default, not ruled
CI / CD Primordial chart published with the rest. CONTRADICTION · P1
Kargo pichu first. DECIDED · ARCH §8
Argo CD Argo CD applies the new Database record. DECIDED · ARCH §8
operator T3 makes or moves the database and writes new connection values to Infisical. DECIDED · dependency-operator PoC TESTED · PoC: Neon
pod / ESO ESO copies the new values; pods restart or switch connections live. OPEN · S7 !A309