[justgithubaccount]

Outcome

Restore the existing dev public networking chain for exactly:

• https://argo.syncjob.ru — Argo CD over its insecure-mode HTTP backend, service port 80.
• https://grafana.syncjob.ru — Grafana using a stable externally provisioned admin Secret.
• https://chat-dev.syncjob.ru/docs — FastAPI, protected with HTTP basic authentication.

Dev overlays reuse the pinned ingress-nginx, cert-manager and external-dns Applications.
Cloudflare DNS reconciliation is ingress-only, zone/annotation-filtered, TXT-owned and
upsert-only. OpenWebUI, CrewAI, Loki and Vector are not exposed. Smoke and the other
environment compositions are unchanged.

TLS uses per-namespace ingress-shim certificates, not a replicated wildcard Secret.
The issuer is rendered by cert-manager extraObjects at sync wave 10, after its CRDs
and webhook, rather than placed in the bootstrap root. Cluster-bound old
SealedSecrets are excluded from dev.

Validation

• All repository shell contract tests pass: chat, CrewAI, dev and Vector (real container validation).
• node tests/test_release_notes.mjs passes.
• python3 tests/test_dev_networking.py: 8 tests pass, including real renders of all
  four pinned controller/Grafana charts and Grafana repeat-render stability.
• Kubeconform: dev, smoke, tst, stg and prd render with zero invalid resources/errors.
• OPA evaluated each of the 23 dev/smoke resources individually: zero violations.
• git diff --check passes.
• Independent read-only review found one Important Grafana password/checksum churn
  issue; replaced random Helm-generated credentials with admin.existingSecret and
  verified the regression test RED → GREEN. This fix was self-verified, not an
  independent approval of the final head.

Exact-head CI: Validate K8s Manifests, run 40871948947
completed SUCCESS for both dev and smoke at
da124f9b94943ebec827967657bf6513ddb9ce17. Local and CI tests are not runtime verification.

Required before an authorized deployment

See docs/DEV-WEBS.md for fresh Cloudflare Secrets in external-dns/cert-manager,
the FastAPI ingress auth Secret, and the one-time Grafana admin Secret. These are
references, not committed credentials. Existing Grafana default passwords require
explicit rotation; no claim is made that Helm values rotate stored credentials.

The legacy ingress-nginx controller is retired upstream. This is temporary
restoration of the existing dev architecture, not a recommendation for a new
permanent public deployment; a controller migration is a separate decision.
A LoadBalancer/public IP can incur additional provider charges.

Boundaries and evidence

• Only app-poly-gitops-k8s changed; base 80bf015cc6e2066732dacb125ef4b6d41c17cd78.
• No merge, release, provisioning, deployment, Cloudflare writes or secret-value reads.
• Runtime LoadBalancer readiness, DNS adoption/recreation, certificate issuance and
  public auth: UNKNOWN until an authorized live deployment.
• local_repo drift: NONE_DETECTED against verified GitHub main; routed_artifacts:
  NOT_CHECKED (no federation authority claims); live_runtime: NOT_CHECKED.
• branch_merge_status: NOT_AUDITED.