docs(launchpad): record ADR-0013 -- config-management tool, Ubuntu baseline, runtime shape

[serina-mcfall]

Summary

Records ADR-0013: Ansible as the configuration-management tool, Ubuntu 24.04 LTS (noble) as the supported baseline, and containers via the existing deploy/compose/ bundle as the runtime shape. Folds in the archived deploy/archived/ansible/ attempt as supporting evidence rather than precedent to resume, since its later archival was for an orthogonal reason (wrong upstream image selection).

Related issue

Closes #24

Issue type

ADR

---

Agent provenance

Field	Value
Harness / provider	Claude Code
Model	claude-sonnet-5
Session reference	N/A - harness does not expose a run id/URL in this session
Initiating human	@serina-mcfall

Objective

Add launchpad/decisions/ADR-0013-config-management-ubuntu-baseline-runtime-shape.md, recording the bundled decision for #24.

Impacted components

launchpad/decisions/ADR-0013-config-management-ubuntu-baseline-runtime-shape.md
launchpad/scripts/test-adr-0013-frontmatter.sh

Approach and rejected alternatives

Followed the recommendation posted on #24 and confirmed by @serina-mcfall in chat on 2026-08-15. Rejected alternatives, per the issue's own Considered options: Ansible managing host-native services in place of deploy/compose/ (discards an upstream-maintained artifact and creates the divergence-at-every-sync maintenance trap launchpad/AGENTS.md section 3 already exists to avoid); shell scripts plus systemd (cannot satisfy Ruling 11's convergence requirement without effectively reimplementing a configuration-management system, called out explicitly in the issue itself); a different configuration-management system such as Salt or Chef (no driver in the issue favors either over Ansible, which is already the PRD's named expectation). Also considered whether to treat the archived deploy/archived/ansible/ attempt as resumable precedent — rejected, since the archive is marked a failed deployment method; its measured facts are used as evidence for this decision, but no code from it is reused.

Verification

Command run:

/home/serina/Launchpad/buzz/launchpad/scripts/test-adr-0013-frontmatter.sh

Raw output:

PASS: ADR-0013 exists at the expected path
PASS: not filed under the issue number (0024)
PASS: frontmatter parses and status is Proposed
PASS: the H1 heading number matches the filename
PASS: no duplicate ADR numbers on this branch (found: none)
PASS: the Ansible-unfamiliarity contingency trigger is stated

===================================================
6 passed, 0 failed

• Tests or checks were run and the raw output is pasted above
• The diff is confined to the scope of the linked issue
• No secrets, keys, tokens or hostnames were added to tracked files

Not verified

Whether the cohort already has Ansible experience was not checked in this session — the issue's own original caveat, still open. The archived measurements (peak memory, Compose version, all-healthy timing) were read from launchpad/deploy/archived/temp-handoff.md and launchpad/deploy/archived/ansible/README.md, not re-measured here. No implementation exists yet to verify this ADR's decision against; this PR records the decision, not its execution.

Security implications

This ADR determines what confinement means for the rest of #5: container runtime permissions/capabilities/networks (Rulings 4, 5, 9) rather than operating-system users and AppArmor applied directly. It also carries forward the archived attempt's secret-handling pattern (generate .env secrets on the target host, never commit them, never template from control-node variables) and the requirement that the private VPS hostname stay out of the committed inventory (inventory/hosts.local.yml, gitignored). No code changes accompany this PR, so no new runtime exposure is introduced by the PR itself.

Escalations

None beyond what's already recorded in the ADR's Provenance section — the recommendation and its contingency were both confirmed directly by @serina-mcfall in chat before this PR was opened, per launchpad/AGENTS.md rule 1 (agents draft, never decide).