Implementation Overlay Workstream

Snapshot date: 2026-04-29

This page is the active coordination surface for moving owner-specific Honey deployment facts out of the GloriousFlywheel core repo and into private implementation overlays.

Current State

• tinyland-inc/tinyland-infra is private.
• tinyland-inc/tinyland-infra#2 merged the Tinyland overlay overhaul at 4b31f6ddf12033cbe52e2e7192649295cf2bc473.
• Jesssullivan/jesssullivan-infra is private. PR #2 merged the initial Jess overlay, and PR #4 refreshed its GloriousFlywheel core pin at 0c6490048be94806f612f4cbf5903a7a3b44d91a.
• GloriousFlywheel issue #421 and Linear TIN-568 are closed after the Honey overlay authority and Jess state-rehome closeout.
• GloriousFlywheel PR #420 merged and restored the implementation-overlay architecture while guarding core ARC applies.
• GloriousFlywheel PR #422 merged the workstream surface, owner-distinct ARC registration names, and the read-only enrollment preflight.
• GloriousFlywheel PR #444 merged at 3c7fdf5261ed74babee54c792c3cce3c9e71112f and clarified that stateless Docker work may use sting, while ARC plan/apply remains honey-bound until sting kube-API reachability is separately proved.
• GloriousFlywheel PR #445 merged at 0e42be3bfc39529bc50dce7f23b38d4cb5863df0 and made the local hygiene gate bounded while keeping heavyweight Nix/OpenTofu validation explicit. This reduces operator friction for overlay docs and runner-taxonomy cleanup without weakening the full validation path.
• GloriousFlywheel PR #449 merged the core-pin drift blocker for implementation overlays. Both overlays now pin selected stable core commit 637b7167c400a842cdc7af0709b2251c0542a48a in MODULE.bazel and config/organization.yaml.
• GloriousFlywheel PRs #450 and #451 merged the read-only ARC residue audit guard and classified tubebrain-nix as a known standalone compatibility lane, not product runner taxonomy.
• GloriousFlywheel PR #452 refreshed the top-level management surfaces after #438 / TIN-681 closed the MassageIthaca Docker-capable shared-runner proof.
• GloriousFlywheel PR #468 completed the core cleanup after the six-release Jess state rehome and removed the core recreate hazard.
• GloriousFlywheel PR #469 refreshed the docs/status surfaces so #412 remains package-lane retirement debt rather than stale state-repair work.
• GloriousFlywheel PR #470 refreshed the remaining management docs after the rehome closeout so current-state, roadmap, cleanup, and public-alpha surfaces agree on the post-rehome boundary.
• Jesssullivan/jesssullivan-infra PR #13 pinned its ARC deploy workflow to GloriousFlywheel authority commit defff7fb7d1f3457c5270ce2e57ac6077e797b1c; the Jess apply then reconciled the adopted releases to github-app-secret-jesssullivan, and a follow-up plan reported no changes.

The overlays are beyond scaffold-only status: both have least-privilege core-read wiring, live ARC registration, and strict enrollment preflight passing. Jess is now live state authority for the old personal-boundary compatibility releases. Those lanes remain compatibility debt until downstream repos move to a normal owner/shared scope or the lanes are explicitly removed.

Deep-dive update: the reusable ARC stack now has to distinguish one shared ARC controller owner from additional owner overlays. Tinyland can rehome the existing arc-controller, namespaces, and current Tinyland runner releases. The Jess overlay should attach to that shared controller with deploy_arc_controller = false, create_controller_namespace = false, and create_runner_namespace = false, then use owner-distinct internal Helm release names and ARC runnerScaleSetName values while preserving tinyland-* workflow labels. One-off OpenTofu imports must stay in operator migration steps, not committed to the reusable stack, because each owner overlay may use distinct internal release keys.

Active Boundaries

• Tinyland owner scope is organization-scoped: https://github.com/tinyland-inc.
• Jess owner scope uses Jesssullivan/jesssullivan-infra only as a private ARC registration anchor.
• Shared workflow labels remain capability-shaped: tinyland-nix, tinyland-docker, tinyland-dind, tinyland-nix-heavy, tinyland-nix-kvm, and tinyland-nix-gpu.
• The overlays point at the same Honey cluster, Attic cache, Bazel cache, and RustFS-backed state substrate.
• No personal-account runner group exists or should be described as existing.

Open Work

1. Keep the least-privilege core-read credential green for each overlay repo. Prefer GF_CORE_DEPLOY_KEY backed by a read-only deploy key on tinyland-inc/GloriousFlywheel; use GF_CORE_READ_TOKEN only as a compatibility fallback.
2. Keep the Tinyland GitHub App credentials bound through the overlay secret path: just arc-app-secret-dry-run, then just arc-app-secret-apply from tinyland-infra.
3. Keep the Jess GitHub App credentials bound through the overlay secret path: just arc-app-secret-dry-run, then just arc-app-secret-apply from jesssullivan-infra.
4. Run GF_EXPECTED_CORE_REF=<selected-core-ref> just enrollment-preflight-strict from each overlay after every core pin refresh. The preflight now blocks if config/organization.yaml and MODULE.bazel disagree, or if both pins do not resolve to the selected core ref.
5. Keep #412 focused on package personal-lane retirement, not state rehome. Jesssullivan/scheduling-kit and Jesssullivan/scheduling-bridge already use the workflow-facing shared tinyland-nix label; the remaining blocker is GitHub personal-account runner registration reachability.
6. Prove that overlay plans are non-destructive before applying any core or overlay ARC stack change.
7. Keep a default-branch workflow green on shared labels from each owner scope before counting that owner as shared-lane authority.
8. Document the capacity boundary from TIN-627: owner-distinct scale sets are registration identities, while global concurrency is still enforced by Kubernetes scheduling and bounded node capacity.

Adjacent Workstreams To Monitor

Adjacent Repo Review Notes

• blahaj has the densest nearby OpenTofu surface and owns app deployment stacks such as acuity-middleware and massageithaca. The overlay work should consume shared cluster facts from this reality instead of creating app deployment stacks inside the runner overlay repos.
• MassageIthaca is currently a consumer-side repo in this pass. Its local checkout has package/tooling changes and no Tofu/K8s authority in the quick scan.
• Dell-7810 and XoxdWM are shared-lane reachability consumers. They are proof surfaces for enrollment, not reasons to mint repo-shaped labels.
• jesssullivan-infra is the personal-account overlay authority. Its initial overlay PR, core-pin refresh, and ARC deploy pin have merged, and validation is green after GitHub App registration, cache/auth fixes, state rehome, and apply. The remaining work is capacity policy and compatibility-lane retirement, not “can it start”.
• ci-templates is the compatibility surface to watch for resolver and cache contract drift.
• Fuzzy, tailnet-acl, and observability have substantial local infra or cluster-adjacent work in progress. Do not mix their dirty local changes into the overlay authority PRs.

Validation Already Run

Tinyland overlay:

python3 scripts/validate-overlay-runner-taxonomy.py tofu/stacks/arc-runners/tinyland.tfvars
nix develop ../GloriousFlywheel-infra-overlays -c just check

Jess overlay:

python3 scripts/validate-overlay-runner-taxonomy.py --allow-repo-registration-anchor tofu/stacks/arc-runners/jesssullivan.tfvars
nix develop ../GloriousFlywheel-infra-overlays -c just check

Both overlays also passed Justfile formatting, workflow YAML parsing, git diff --check, and a secret-pattern scan.

Enrollment preflight:

GF_CORE_PATH=/Users/jess/git/GloriousFlywheel-infra-overlays just enrollment-preflight

Current validation result:

• GloriousFlywheel core: main is green at 8e46bf2b847a60f9f7672960a6e3be40df5d32af after PR #470, with Validate, Secret Detection, Tranche Proof Status, Deploy Docs, Publish to FlakeHub, Source Bazel Proof, and Platform Proof passing.
• Runtime audit: just arc-runtime-audit on 2026-04-28 found ARC listeners Running on sting, no active runner job pods at the audit instant, and no CPU/RAM pressure signal on bumble, honey, or sting. TIN-620 later closed after PR #484 / PR #485 added repeatable runtime and network continuity classification coverage, and the stale Jess overlay push check resolved green on run attempt 3. Future lost-runner incidents should start from just arc-runtime-audit, just arc-listener-queue-drift, and just arc-network-continuity-audit instead of inherited assumptions.
• Tinyland overlay: PR #2 is merged, pins selected core 637b7167c400a842cdc7af0709b2251c0542a48a, and strict preflight passes with 0 blockers / 0 warnings.
• Jess overlay: PR #13 pinned the deploy workflow to the selected GloriousFlywheel authority commit, the adopted release apply succeeded, and the follow-up plan was no-op. Strict preflight passes with 0 blockers / 1 expected warning for the private personal-boundary repository registration anchor.
• Remaining blockers are no longer “overlay cannot start”, “stable pin promotion”, or “live state rehome”. They are compatibility-lane retirement and capacity policy across owner-distinct scale sets.