[immakermatty]

Why

On 2026-10-16 adding one person's work Environment took a whole day. Native Machines applies ran from the Admin's computer, which many agent sessions share, whose disk was full and whose single global Tailscale profile is switched between tailnets. Custody lived in that computer's user directory. Plans were captured and committed by hand. Every Environment needed pull requests in four places: the Organization's Deployment Repo; the Conglomerate Host's Deployment Repo for the issuer client, enrollment key, DNS and SSH grant; the Dashboard for a projection pin and diagnostics producer; and new secret versions. On top of that came a manual "receiver first" ordering and a 24-hour enrollment-key window. Every failure after Permit consumption cost a 30–60 minute recovery ceremony, and runtime errors were hidden behind generic codes (HumanAndMachine-ai/Machines#546). The same day Matěj (Organization Admin) decided the target direction. This PR records it as decision 0205.

What changes

manual/decision-register.md gets one new row, 0205 (Czech, register style). It records the Admin's decision of 2026-10-16, links plan DEV-6671 and ends with Dnes: rozhodnuto, nenasazeno.

• One change path: a pull request to the Organization's Deployment Repo (infra). CI validates the intent and computes the native Plan. The Organization persona or the Owner approves both the PR and the Plan. After merge the apply runs with the pinned Machines release. Evidence, Permit and audit stay in that repo. An Organization Owner can add a colleague's Environment on their own server without Lazurio operators in the path.
• Lazurio supplies, services read: Machines is how Environments are built. The Dashboard and other services only read published state, so there are no per-Environment Dashboard PRs and no pinned projection ids.
• Runner:
  • By default an ephemeral GitHub-hosted runner authenticates with GitHub OIDC to the Organization's Conglomerate Host. Acting as gateway, the host checks repo, ref and GitHub Environment. It then issues a one-time tailnet key whose narrow ACL reaches only that Organization's hosts, plus short-lived custody credentials. The node expires after the job.
  • No secrets are stored in GitHub.
  • A sensitive Organization can instead get an ephemeral VM on its own Proxmox.
  • There are no dedicated deploy servers. The Admin's computer is no longer a runner; it only experiments on the reference Organization (0204).
• Small Conglomerate Host: target 1 vCPU / 2 GB. A host serving three Organizations plus the central sign-in Keycloak may use 4 GB. Images are built in CI and pulled by pinned digest.
• Custody: it moves to the Conglomerate Host boundary, sourced from the Organization's Lazurio Vaultwarden (0203).
• Personal Environments: they have no Deployment Repo. The Lazurio account is the source of truth, and a gateway Lazurio operates reconciles the personal pool with the same Machines. Bridges into an Organization stay declared in that Organization's infra.
• One declaration per person and Environment: Machines derives the rest, and the pipeline orders the steps, with no human 24-hour windows.
• Recovery: a failure proven to happen before any mutation recovers automatically. Runtimes report specific error codes. Repair is forward-only (0166).
• Machines rollout: automated pin-bump PRs into each Organization's infra, reference Organization first (0204).
• Out of scope: access authority (GitHub and Auth per 0192) and the Machines release process itself.
• Open questions:
  • Fully automatic apply or one Owner click via a GitHub Environment? The recommendation is a click at first.
  • Where does evidence for personal Environments live?
  • Where does the central Keycloak go if it does not fit?
  • What are the criteria for the Proxmox-VM fallback?
  • Where does the gateway sit for the reference Organization, which has no Conglomerate Host or tailnet?

What does not change

Nothing is deployed and no manual is rewritten. Today's practice stays valid until DEV-6671 delivers: push apply with Permit from the operator, custody on the operator's computer, and the Dashboard reading a pinned projection. Access authority, 0192 and the Machines release process are unchanged.

Verification

• bun run terminology:test: 31 pass (includes the public-example boundary test).
• bun run check:docs: pass on the committed head. The distribution build test needs a clean checkout, so it was run after the commit.
• bun run pr:preflight: ok against origin/main 8c66e48.
• The row names no client Organization, person other than the deciding Admin, host or address.

Plan: DEV-6671 in the Organization's Mission Control.

🤖 Generated with Claude Code

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T16:41:18.128945Z	dd79178	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dd791789c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[immakermatty]

Addressed both review points in 368cb46: (1) 0205 now names the Organization's private Deployment Repo (usually infra; for the reference Organization the private machines repo per 0204 point 8, with the public infra documentation-only), and every later infra mention says Deployment Repo. (2) A persona or Kolega review checks the PR and the Plan, but only the merge by a named human with live rights to the Deployment Repo (Owner or a delegated Operator) authorizes the apply; a persona never approves an apply.

[agentrozjedemeai]

@immakermatty Reviewed exact head 368cb46. Decision 0205 names the private Deployment Repo and preserves the public-infra exception of 0204; PR/Plan review is separated from authorization by merge by a named human with live repository rights. The OIDC runner, Vaultwarden custody, personal Environment exception, rollback/recovery and reference-Organization gateway placement are correctly framed as target direction/open questions, not deployment claims. Text-only diff passes git diff --check, 9 focused docs/scope/terminology tests pass; exact-head CI green and both old review threads resolved. No merge.