What you settle next

★ T1 There is no Bun API template. How is an API + worker service made? OPEN

bun-consumer is worker-only ("NOT an HTTP server"). The only API template is dotnet-api (C#). Today's real repos put API and consumers in one repo; diene templates are one module per repo. Papers silent on multi-module.

• A: add a bun-api template node, like dotnet-api (proposed).
• B: one repo carries several modules (api + worker) (R20 assumes submodules; today's real tin repo does this).
• C: two repos, tin-api and tin-worker, sharing the database records (proposed).

Sources: bun-consumer.md §Purpose; R20 "submodules share secret + config"; notes A §5.1

T2 Who runs cyanprint update on a live service repo, and how do template updates meet hand edits? OPEN

No bun branch has a cyan.yaml yet; turning branches into cyanprint templates is the unbuilt finalize step. Papers only say "cyanprint template updates".

The papers give no options.

Sources: SPEC §0, §8; R4

T3 Which step strips factory-only files (probes/, .github/named-checks/) from a generated repo? OPEN

Papers say they never ship; they sit on every template branch.

The papers give no options.

Sources: AUTHORING-RULES "Named checks never ship"; PROBES.md L39

T4 bun-consumer is from 9 August and misses every later parent change. CONTRADICTION

Reload label, chart checks, release-note job, problemgen, config names: all newer than the leaf. Needs a merge-down, not a decision.

The papers give no options.

Sources: branch tips: bun-consumer 77158f85 (08-09) vs workspace 71a50ddc (11-14)

★ P1 The built CD does not publish the primordial chart. CONTRADICTION

Papers and owner D3 #5: image + 2 charts at one version, or Kargo never makes Freight. The PoC publishes it (before the app chart).

• Add a helm-primordial job to cd.yaml (what the PoC does).

Sources: OD D3 #5; ARCH §8; bun-consumer cd.yaml; PoC release.yml

P2 Image name: CI pushes …/diene-workspace; the chart pulls ghcr.io/atomicloud/diene.bun-consumer. CONTRADICTION

The workspace placeholder was never renamed. R4 says the image name is renamed per instance.

The papers give no options.

Sources: bun-consumer ci.yaml, values.yaml; R4

P3 What is the registry path for images and charts? OPEN

Three shapes exist; ruling 7b says registry is a template question.

• Template: ghcr.io/<owner>/<repo>/<name>.
• Papers example: ghcr.io/atomicloud/nitroso-tin + oci://ghcr.io/atomicloud/charts/nitroso-tin[-primordial].
• PoC: <registry>/charts/<chart>.

Sources: scripts/ci/helm.sh; lens-repo-cicd §2; PoC

P4 Version string: v1.4.3 (template) or 1.4.3 (papers, PoC)? CONTRADICTION

Kargo only needs them equal, but pins and names should be one shape.

The papers give no options.

Sources: cd.yaml github.ref_name; PoC VER=${GITHUB_REF_NAME#v}

P5 Should CI push an image and chart on every push (<sha>-<branch>)? OPEN

Built CI does; papers silent.

The papers give no options.

Sources: ⚡reusable-docker.yaml CI_DOCKER_PUSH

P6 Chart folder and landscape file names differ. CONTRADICTION

infra/root_chart + infra/primordial_chart (template) vs infra/app + infra/primordial (PoC); values.<l>.yaml (papers) vs landscapes/<l>.yaml (PoC, which the AppSet reads).

• Keep the template names; teach the compiler chart values.<l>.yaml (proposed).

Sources: notes A §5.10–11; rows-appsets.yaml L46

★ S1 Does config ship in the chart (ConfigMap) or in the image? CONTRADICTION

Papers: copied into the app chart at build → ConfigMap. Built: no copy step in CI, and the Dockerfile bakes config/ into the image.

• Chart, as the papers say: add the copy step to scripts/ci/helm.sh; drop COPY config from the image (fix proposed).

Sources: HW L257; R20; bun-consumer Dockerfile, helm.sh

S2 Config file names: config/<l>.yaml or config/<l>.settings.yaml? CONTRADICTION

The corpus uses both; the branch uses .settings.yaml.

The papers give no options.

Sources: errors-and-problems §3; bun-standard-config; bun-consumer.md L107

★ S3 How does a password reach the pod: env vars, a mounted Secret folder, or a T3-written file? CONTRADICTION

Papers + built: ESO → Secret → envFrom. Workspace helper (D59): live pods refuse env vars. T3 lock (PR 71) and PoC: a mounted file, polled. D47: env-var apps must be part of the migration design.

• A: ESO Secret mounted as a folder; works for live and restart (fits the workspace helper and PR 71 B1).
• B: env vars, restart pods only (papers + built today).
• C: T3 writes the Secret straight into each cluster (PoC shortcut).

Sources: secrets-chain; workspace _helpers.tpl; PR 71 B1; PoC; OD D47, D59

S4 The built ExternalSecret reads /shared and /tin, but T3 writes /database/main. CONTRADICTION

Database passwords would never reach the pod.

The papers give no options.

Sources: dependency-operator L213; bun-consumer externalsecret.yaml

S5 Name of the platform secret store. CONTRADICTION

carbon renders carbon-store; bun-consumer expects platform-store; helm-wrapper sample-store.

The papers give no options.

Sources: charts/carbon; bun-consumer values; helm-wrapper

S6 Reload: label live|restart (owner) vs older Reloader opt-out + "every Deployment has auto". CONTRADICTION

Owner D59/D61 and the workspace helper are newer; helm-wrapper, chlorine and vanadium goals were not rewritten. A live pod fails vanadium's rule.

• Rewrite the older goals to your rule (proposed).

Sources: OD D59, D61, D75; helm-wrapper L315; vap-policies L90

S7 How do live pods switch database connections? (!A309) OPEN

The connection-switch strategy waits on your pick; queue consumers are untested.

• See !A309 (one connection at a time, with the fix).

Sources: !A309; OD D84, D121

S8 Who may write app-only secrets (a third-party key) into Infisical, and how are they reviewed? OPEN

Papers cover machine writers only.

The papers give no options.

Sources: secrets-chain

S9 O7 and O8: one secret store per platform per cluster? Which Infisical is the real one? OPEN

O7 fixes a tested cross-platform read hole (default adopt). O8: docs disagree on the address.

• O7 default: adopt.
• O8 default: keep the address a deployment input.

Sources: OD O7, O8; spike B

S10 Labels: 4 on workloads with durian.cloud (workspace, stand-in) vs 6 on everything with atomi.cloud (vanadium, helm-wrapper). CONTRADICTION

D53 makes the prefix configurable and D54 requires labels on workloads only; older goals not rewritten.

The papers give no options.

Sources: OD D53, D54; workspace §1; vap-policies L27

★ K1 Which policy set is real, Deny or Warn, and who installs it in clusters? CONTRADICTION

Workspace pins the stand-in (Deny); helm-wrapper and charts/* pin vanadium (Warn/Audit); today's primordial says never Deny. Nobody is named to install it.

• Stand-in now, vanadium later (D75); Warn first, Deny per landscape (vap-policies goal).

Sources: OD D75; workspace chart-checks.yaml; helm-wrapper chart-checks.yaml; vap-policies

★ K2 How are base-layer (sulfoxide) and policy chart versions pinned and promoted per landscape? OPEN

Papers silent. The PoC used a baseline AppSet in fleet.

• A: Kargo stages, like services (proposed).
• B: one pin in fleet machinery/ for all clusters (what the PoC did).
• C: per-landscape pins in fleet (proposed).

Sources: ARCH §10; PoC §3

K3 NetworkPolicy for a normal service? OPEN

Silent for services; mercury lists one.

The papers give no options.

Sources: mercury.md L146

K4 HPA, KEDA, PDB, ServiceAccount for api and worker? OPEN

HPA listed for dotnet-api only; KEDA in your base-layer list but has no paper.

The papers give no options.

Sources: dotnet-api.md L170; OD D49

K5 HTTPRoute: parent Gateway name and namespace; which helper renders it? OPEN

No service template renders one; the PoC used Ingress.

The papers give no options.

Sources: R20; helm-wrapper webhook-route.yaml

★ K6 Primordial namespace for records: nitroso or nitroso-pichu? OPEN

With one namespace per platform, two landscapes' records of the same service would clash unless the name carries the landscape.

• A: <platform> (error-portal.md), landscape in each name.
• B: <platform>-<landscape> (PoC).

Sources: error-portal.md L196; PoC rows-appsets.yaml L100

K7 Is production one serving landscape or four? CONTRADICTION

Changes host names (api.tin.nitroso.raichu… vs …serving…), issuers and failover.

The papers give no options.

Sources: GAPS G1; logto-operator L558; ARCH L78

G1 O1: drop services.yaml? OPEN

Argo refuses the old design; the row-file names work (tested).

• Default: drop.

Sources: OD O1; spike A

★ G2 Row file layout, and do rows live in their own fleet-state repo? OPEN

FLEET: platforms/<p>/landscapes/<l>/<svc>.yaml. jaeda pick: platforms/<p>/<svc>/<l>.yaml in fleet-state (PoC). You were not asked.

• A: by landscape, in fleet.
• B: by service, in fleet-state (PoC).

Sources: FLEET L111; dm/a/picks.md #3, #4

G3 Row pin keys: {chart, image} or {primordial, chart, image}? CONTRADICTION

T3 lock stub has two; the PoC ran three.

The papers give no options.

Sources: PR 71 L1099; PoC §2

G4 fleet layout: machinery under registry/ (FLEET) or its own machinery/ (D2)? CONTRADICTION

fleet.md not rewritten yet.

The papers give no options.

Sources: OD D2; FLEET L141

G5 May people still edit row values: and make break-glass commits? CONTRADICTION

FLEET allows both; D3 says people touch fleet only for landscapes and clusters.

The papers give no options.

Sources: OD D3; FLEET L111; GAPS G18

G6 First release when the database is not ready yet. OPEN

The PoC fix (required Secret volume + health for dependency records) is tested but not in the design.

• Write the PoC fix into the T3 goal (earlier explainer proposal D-2).

Sources: GAPS G3; PoC drill G3

G7 Rollback for a normal service, and for the schema. OPEN

Only Workers have a written rollback.

• Promote an older Freight; migrations stay backward-compatible for one release (earlier explainer proposal D-3).

Sources: GAPS G16

★ X1 Dependency records: five kinds (Database, KeyValue…) or one PlatformDependency? CONTRADICTION

You ruled "split it" (D4); PR 71 writes it in but is not merged; corpus main, helm-wrapper and built code still have one kind.

• Merge PR 71, then update the helm-wrapper helpers and bun-consumer (follows D4).

Sources: OD D4; PR 71; dependency-operator main L530

X2 Rotation on/off knob still in corpus and code. CONTRADICTION

D5: always on.

The papers give no options.

Sources: OD D5; dependency-operator L537

X3 A queue has no dependency kind of its own. OPEN

Built bun-consumer rides Redis streams on the KeyValue/Upstash module. Fine for this example; other brokers have no path.

The papers give no options.

Sources: bun-consumer.md L112

X4 The Migration record (database move) shape; and its name clashes with schema migrations. OPEN

O2 default only. "Migration" also means the db-init schema step.

• Yes to a Migration record (O2 default); rename one of the two words (proposed).

Sources: OD O2; PoC migrations.yaml

★ X5 Problem pipeline: built code is the old one. CONTRADICTION

Built: a hand list → problems.json, dashed names, no module. Decided: problems/*.yaml → problemgen → code + record named tin.api.pichu.v1 with module. problemgen is PR 104, still open.

• Merge problemgen (PR 104), add module to the CRD, merge down (follows D62–D66).

Sources: OD D62, D63, D66, D102; nix-registry PR 104

X6 Two problem catalogs: problemgen's catalog entry vs T3's edge catalog doc. OPEN

Who reads the problemgen one is not said.

The papers give no options.

Sources: problemgen.md Outputs; error-portal.md Edge-doc split

X7 erbium (the error portal) is not built; its graph ref holds a 2023 site. OPEN

The goal says you archive the old site first.

• Owner action: archive the old site.

Sources: error-portal.md

X8 Signal contract file: name and path? OPEN

Papers say "one contract file"; obs is not built.

The papers give no options.

Sources: observability §3

X9 Which repo deploys Loki, Tempo, VictoriaMetrics and Pyroscope? OPEN

No chart goal names them.

The papers give no options.

Sources: observability §1, §10

X10 Built Alloy chart and Bun otel lib are behind the obs design; telemetry backend D11 (Grafana Cloud) vs self-hosted. CONTRADICTION

Built Alloy: VM + Gigapipe, no pod-label step. Bun otel stamps atomi.* itself. D68 moved to self-hosted; D11 never withdrawn.

The papers give no options.

Sources: ratchet/charts-alloy-g7; lib/bun/otel resource.ts; OD D11, D68