← Platform

Monorepo Reorg (rylobasic)

Status
done
Tier
Tier 2 — Platform
Owner
Ryan Colston
Started
2026-05-13
Target launch
2026-05-15

Linear: RYR-232 — werkzeug CVE bump (hardening #9) (2026-07-23 vault→Linear audit) Verification correction (2026-07-24): Hardening #9 (werkzeug CVE) is DONE — all 6 pos-* services already pin werkzeug==3.0.6 (verified 2026-07-24). (RYR-232 canceled)

One-line description. The 5 split repos (platform, CCPJ, content, capri, systems) are now one monorepo at ~/rylobasic/, organized by deliverable instead of by tech layer.

Why

The work used to live in 5 repos split by tech layer. Infra in one. Source in another. Content, brand, and personal tooling each in their own. That split solved the wrong problem. It broke every real system into pieces and scattered them across repos with no single owner.

The setter program was the clearest example. Its code, schema, skills, and runtime sat in 5 different places. One system. Five homes. No owner. The fix is one monorepo organized by the thing you actually ship. Each system owns one folder with all its parts: code, schema, skills, runtime, docs, and project history. Context travels with the work.

Current state

The migration itself is done. ~/rylobasic/ is the only live repo. All 5 source repos are GitLab-archived and held locally read-only at ~/_archived-*-2026-05-15 for a 30-day cold-storage window. The 24h prod watch closed 2026-05-16 after two waves of leftover path landmines were found and fixed.

The active work is the post-cutover hardening campaign. The 2026-05-17 Drift-Reconciled audit verified every claim-bearing doc against the live repo/GCP and the GitLab monorepo-hardening issues drive the rest. Shipped: the full doc-drift batch (every DRIFT-REPORT row merged, ONBOARDING de-CCPJ rewrite, GitLab #7 closed), the view-apply bridge + A5 baseline + v_function_health dead-man's-switch (built and live), and the GitLab #6 canary (the named silent-no-ship handler fixed, deployed, proven live). The reliability half remains: close #2/#3 on an observed natural run, then #1/#4/#5.

Update 2026-06-13 — Terraform CI governance shipped (tf-automation, phases 1–5). Every Terraform root (the 11 pos-* plus the orphans shared, hiring-foundation, bq-bulletproof-dataform, gitlab-runner) is now governed from one filesystem-derived source (infra/terraform/lib/tf-roots.sh): terraform plan renders on every MR; in-place-update plans auto-apply on merge while create/destroy plans gate to a manual-approval job; and a daily drift report auto-heals in-place drift (a stray label or console edit reconciles itself) while filing create/destroy or failed-apply drift into one GitLab issue. This closes the earlier "non-tfvars changes need manual apply" gap (supersedes MR !517). The self-hosted CI runner also now sleeps 11:30pm–6:30am CT (cost decision 2026-06-11) with auto-retry on spot-VM preemption — overnight pipelines queue until wake by design.

Next 3 actions

(See umbrella plan for the full done-when table.)

  1. Wrap up Fix 4 (SIGTERM-aware wrapper) — infra/shared-libs/lib/execution_logger.py enhancement + hermetic test. Independent of observation gate; can ship in parallel.
  2. Observation gate closure for hardening #2 + #3 on the first natural {failed:0} run.
  3. Start hardening #6 fleet sweep (51 silent-no-ship overlay files remaining after today's coaching/dashboard addition).

Decisions log

Open issues

The migration + post-cutover prod watch are closed:

Hardening punch list: glab issue list --label monorepo-hardening (work-items API: glab api 'projects/82206074/issues?state=opened&labels=monorepo-hardening')

References