mattwilkinsonn · Oct 18, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
@@ -0,0 +1,6 @@
+---
+id: DL-539
+decision: "Each stack child that runs as a container becomes its own pod: the Server is a one-replica Recreate Deployment with exactly one Runner pod per Server, and NATS is a one-replica StatefulSet; Postgres and the OTel collector are operator-provided outside the renderer, and no LLM gateway is deployed."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-540
+decision: "ghcr.io/rigelbuild/compass-server is built from the .#compass-server nix closure on a digest-pinned distroless static-debian12 base, runs as 65532:65532, is published by digest through the shared --lane runner|server publish and retag scripts, and is gated by SERVER_IMAGE_CLOSURE_PATHS."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-541
+decision: "Migrations stay in Server boot with no migration Job, and the renderer never renders Postgres; the operator brings a Postgres reached through a direct session-mode endpoint whose login role owns the database and is either a CREATEROLE plus BYPASSRLS role on PostgreSQL 16 or later or a superuser on any version, and that answers at boot."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-542
+decision: "The Server renderer names Secrets but holds no values; Server secrets are read through dotenv:// from a read-only mounted Secret file whose master key never changes, forge App ids and secret names render as --forge-* args, XDG_STATE_HOME and the state dir sit on an emptyDir, and the admin token Secret mounts directly at 0440 under pod fsGroup 65532 with no init container, which the Server accepts once it follows the volume symlink and allows group-read for a group it holds."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-543
+decision: "In-cluster NATS requires a user and password carried in COMPASS_NATS_URL, and a NetworkPolicy admits port 4222 only from the Server pod."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-544
+decision: "The Server terminates its own TLS from an operator-supplied kubernetes.io/tls Secret and loads it once, so a renewed certificate takes effect on restart; no ingress terminates TLS, serverAddr is the in-cluster Service, external access is TCP passthrough, and a private CA reaches the Runner through serverCA and clients through --ca."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-545
+decision: "A Runner-cluster entry whose issuer serves no anonymous discovery uses a jwksFile rendered from the cluster's public keys, so no Go change is needed; the rendered Runner gets serverCA, an optional serverName that sets the Runner's TLS server name through --server-name so a certificate naming only the public host verifies against the in-cluster serverAddr, and an egressAllow list rendered as --egress-allow, and its node exposes KVM as the kvmResourceName extended resource, stages the seccompProfilePath profile, and supports hostUsers: false; the Runner's microVM volume root is the volumes subdirectory of the session-volume hostPath mount, and the operator puts the project quota on that subdirectory, never on the hostPath itself, so the quota check has an unprojected reference above it."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-546
+decision: "Public compass holds tools/server-manifests/ and tools/runner-manifests/ while the operator holds values, Secrets, certificates, node config and apply; the head commit of every main push tags both the Server and Runner images :main-<n>-<sha12>, where n is its first-parent count and each tag names that lane's newest publish at or before the commit, so a numerical image-automation policy on n bumps both images together with no operator bump job, and the automation writes only the digest, never the tag, into a pod spec."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-547
+decision: "Every Compass image (agent, runner, server, guest image, gateway) is public, renderers emit no imagePullSecrets, every registry read in the publish, index and release tooling is anonymous and credentials are used only for the write destination, except the pre-push probe of the tag a push is about to write, which is part of the write and uses the login file because GHCR answers an anonymous probe of a package that does not exist yet with 403, and each publish job fails when its package is not public, because no GitHub API sets package visibility."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-560
+decision: "Every Compass image (agent, runner, server, guest image, gateway) is built in compass for linux/amd64 and linux/arm64 and published as an OCI index whose members are first pushed as :git-<sha12>-<arch>, the retag and main-tag tooling verifies an index by its digest and member list, and the guest boot path chooses its kernel file (bzImage or Image) and serial console (ttyS0 or ttyAMA0) per arch."
+status: "Active (Matt, 2026-10-17)"
+record: ../../server-on-kubernetes.md#design
+---
@@ -0,0 +1,6 @@
+---
+id: DL-577
+decision: "The arm64 microVM guest gets no pre-merge boot: the P7 arm64 build gate is the only pre-merge proof, the Runner's startup boot canary fails closed on a node that cannot boot the guest, Runner nodes stay amd64 until an arm64 KVM boot passes, and no self-hosted arm64 CI runner is added."
+status: "Active (Matt, 2026-10-18)"
+record: ../../server-on-kubernetes.md#resolved-decisions
+---