[justgithubaccount]

Closes #28

Summary

• pin all application live-smoke source checkouts to one audited commit SHA per component and verify those same values before the provider key is exposed
• classify and validate every Taskfile entrypoint, repair nodes, guard the versioned GitOps root, and render the Argo CD chart once before a same-render retry
• consolidate Argo CD polling behind the existing wait helper while retaining the legacy script path and its kubeconfig behavior
• move SealedSecret values out of process arguments, fail closed on missing/legacy input, retain seal:postgree, and preserve its existing chat-postgree Secret name
• align CI on Terraform 1.13.5, pin Task/ShellCheck/tfsec tooling, and make the clean tfsec baseline blocking
• document side effects, consumers, compatibility, rollback, optional secret paths, and validation

Compatibility and rollback

Area	Before	After	Rollback
live smoke	tags/branch plus duplicated stale SHA checks	one immutable SHA per component used by checkout and verification	restore the previous refs and expected values together
nodes	missing scripts/check-nodes.sh	direct read-only kubectl get nodes -o wide	restore a maintained script and its Taskfile reference
Argo wait	duplicate polling implementations	legacy wrapper delegates to tested wait helper while retaining default/explicit kubeconfig behavior	restore legacy implementation if its formatting is required
bootstrap	Helm chart rendered again after an apply failure	render once and retry the identical file once	restore previous pipeline
app-of-apps	raw main for the Kubernetes root	guarded app-poly-gitops-k8s@v1.5.0 root	override with reviewed tag/SHA or restore branch tracking
Argo self-management	infra values source follows main	intentionally remains on main: the only existing tag, v0.1.0, itself points back to main	replace only after a newer release contains an immutable self-reference
secrets	secret values in argv; misspelled PostgreSQL task	environment/stdin flow; canonical chat-postgres task plus legacy chat-postgree entrypoint	old KEY=value form is intentionally not retained because it leaks via process listings
CI	Terraform 1.6, moving ShellCheck, soft tfsec	pinned versions/commits, Terraform 1.13.5, strict tfsec	revert individual workflow pins/gates

External/manual callers cannot be proven absent, so both argocd-sync-check.sh and seal:postgree remain compatibility entrypoints. The optional SealedSecret path is retained and is not called by active dev/smoke workflows.

Validation

• 17 Python contract/budget tests
• disposable workflow/script suite and floating-IP cleanup tests
• all 24 Task entrypoints parsed and dry-run successfully with Task 3.54.0
• Bash syntax and ShellCheck 0.11.0
• actionlint 1.7.12 and yamllint 1.37.1
• Terraform 1.13.5 fmt, init with -backend=false -input=false, and validate
• tfsec 1.28.14: 0 critical/high/medium/low findings, before and after
• Helm render comparison against main: no self-management desired-state delta
• regression coverage for legacy chat-postgree and default/explicit kubeconfig behavior

No cloud workflow, live paid smoke, deployment, Terraform plan/apply/destroy, release, or Kubernetes operation was run.