# Dedicated Full Dynamic Dataplane Checkpoint

Status: #406 coordination artifact

Parent: #363

Prerequisite local control-plane proof: #405, PR #419, merge
`35fd547554f028e6fcc5adbb28bf01f979d91b86`.

## Purpose

This document records the non-secret read-only Dedicated dataplane context that
the final #407 dogfood issue needs before it can validate a cp9-owned dynamic
Dedicated AWS dataplane.

It intentionally separates two ownership modes:

- #406 reference dataplane: human-provided staging/reference dataplane,
  read-only evidence, not cp9-owned, not in cp9 cleanup scope.
- #407 dogfood dataplane: cp9-created AWS/Kubernetes resources under cp9
  owner/session tags and cleanup selectors.

## #405 Local CP Proof Link

#405 proved the local Dedicated full control plane before this dataplane
checkpoint was requested.

Non-secret proof summary from PR #419:

- `dedicated-full` local CP `setup` and `doctor` passed.
- `cp9 up` completed for an isolated session.
- `cp9 status` reported the expected 13-service graph: 4 source, 2 live,
  7 stub.
- Source pods reached Running/Ready.
- Regional-server RBAC and CRD gaps were fixed in source artifacts.
- Cleanup for proof session `cp9-david-dedicated-405b` completed with
  `final_survivors=0`.

## Human-Provided Read-Only DP Facts

Sabaping provided these facts in Slock thread `#cp9:74a67f80`, message
`82858fef`, and Alice confirmed the non-secret subset to use. Do not paste
kubeconfigs, tokens, passwords, certificates, or database credentials into this
document.

| Field | Value |
| --- | --- |
| Dataplane identifier | `dedicated-staging-us-west-2-4fd8eaccf2c2639929d80f4a89-22b27c23` |
| EKS cluster name or ARN | `arn:aws:eks:us-west-2:024848481520:cluster/dedicated-staging-us-west-2-4fd8eaccf2c2639929d80f4a89-22b27c23` |
| AWS account | `024848481520` |
| AWS region | `us-west-2` |
| Kubernetes context/reference name | Reference the EKS cluster name above. Access uses the same SSO-profile style in another account; no kubeconfig content is recorded. |
| Dataplane owner/team | Human-provided staging/reference dataplane from Sabaping for Dedicated full validation. |
| Validation boundary | Read-only reference for #407: Dedicated dataplane EKS identity/location, account/region, expected Kubernetes context reference, and staging shape to compare against a later cp9-owned dynamic dataplane proof. |
| Secret handoff path, if needed | Not recorded publicly. If DB, kubeconfig, token, password, or cert access is required, use a private/approved secret path. |

The original Slock message also included a management RDS DB connection string
with credentials. That URL is intentionally excluded from this artifact. Public
#406/#407 text may only refer to the non-secret fact that management RDS
database names are suffixed by `-staging`, if that fact becomes necessary.

## Read-Only Validation Boundary

#406 may record only facts needed to make #407 actionable, such as:

- dataplane identity and location;
- AWS account/region assumptions;
- Kubernetes context/reference name without kubeconfig material;
- read-only staging/reference shape that #407 should compare against when it
  validates cp9-owned dynamic Dedicated dataplane behavior;
- any preconditions #407 must satisfy before creating cp9-owned resources.

#406 must not mutate the reference dataplane.

## #407 Handoff Requirements

#407 can proceed only after this checkpoint records enough non-secret context to
validate cp9-owned Dedicated dataplane behavior.

#407 must:

- provision or operate only cp9-owned resources when it creates cloud state;
- use cp9 owner/session tags and cleanup selectors;
- keep credentials and kubeconfigs out of public issue, PR, and Slock text;
- report product-path evidence and cleanup evidence separately;
- avoid claiming cleanup ownership for the #406 human-provided reference
  dataplane.