[justgithubaccount]

Summary

• map the verified infra bootstrap, environment roots, child Applications, dormant ApplicationSets/AppProjects, and prune/finalizer risks
• correct README, architecture, and agent guidance without making runtime claims
• remove the proven no-op Dify comment-only manifest while retaining the documented scaffold
• split duplicated CI work into one contracts job plus dev/smoke render jobs; add rendered ownership contracts and a critical npm audit gate

Closes #27
Related audit: justgithubaccount/app-poly-gitops-infra#27
Related application workstream: justgithubaccount/app-poly-gitops-infra#30

Desired-state safety

No rendered Kubernetes object changes. Exact baseline/head hashes:

• dev: e97f127ba4893e3f1e3650f9990621394179cceb59934b28dc059221e03f6b2c (18 resources)
• smoke: 479edc2b4fc4e90477ac0001a6ced7045c4b268824686c9a6ca66f520f410312 (5 resources)

cmp is byte-identical for both roots. No chart, image, target revision, destination, Secret, Namespace, release, deployment, Argo sync, cloud workflow, or live Kubernetes operation was changed or invoked.

Offline verification

• Kustomize: dev/smoke PASS
• kubeconform strict: dev 9 valid/9 skipped; smoke 3 valid/2 skipped; 0 invalid/errors
• OPA: policy check plus 18 dev and 5 smoke resources PASS
• OPA multi-document/fail-closed regression: 5 tests PASS
• ownership regression: 4 tests PASS
• dev networking: 8 tests PASS
• FastAPI/CrewAI/dev/Vector contracts PASS
• release notes regression PASS
• actionlint and diff check PASS
• npm audit --audit-level=critical PASS

Security and unresolved decisions

Current audit still reports one moderate ip-address advisory (GHSA-rxp7-6hxx-x8q5) and one high undici package affected by GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c, GHSA-2m5v-pch6-74hx, GHSA-qrxm-fqhp-jwvm, and GHSA-9fm3-97px-rjf6. Both are bundled inside the npm executable reached through semantic-release@25.0.9 -> @semantic-release/npm@13.2.0 -> npm@11.21.1; the direct release packages are current. npm audit fix --dry-run changes nothing, and the fixed npm major is outside the plugin declared compatibility range. This PR does not force an unsupported override and instead fails CI on critical findings.

Operator/runtime evidence is still required before removing the recursive root-app.yaml, dormant ApplicationSets/AppProjects, the dev open-webui Namespace, alternate database resources, or incomplete tst/stg/prd scaffolds. The ownership document gives the exact evidence and migration constraints.

Rollback

Revert this single no-release commit. Because dev/smoke renders are unchanged, rollback has no Kubernetes prune or workload consequence.

Status: NO_MERGE / NO_DEPLOY.