docs(adr): ADR-0002 — SourceOS as the sovereign Kubernetes substrate (Guix builds, OSTree delivers)

[mdheller]

Decision

Rather than adopting OKD or Talos, blend both into SourceOS over the existing OSTree/cosa base, split into tiers so the two atomic-update mechanisms don't collide:

Tier	Mechanism	Owns
0 — base / delivery	OSTree + cosa (this repo)	kernel, containerd/CRI, kubelet, pinned crypto module
1 — services / definition	Guix generations (SourceOS-Linux/source-os)	managed OS services; declarative, reproducible, rollback
2 — platform	ArgoCD · OLM · Tekton · zot · gitea · Kyverno	the cluster

Guix builds; OSTree delivers. Katello continues to gate promotion (Library → dev → qa → prod) exactly as cosa/WIRING.md already documents.

From OKD: OLM + the Butane/MachineConfig lineage already in socios-ignition (butane/openshift/{master,worker}-minimal.bu).
From Talos: the posture — no SSH, no shell, day-2 config via API with signed receipts.
Kept: OSTree base, caps/ + guard-DSL + nft/ egress, PXE/live-USB installers, channels, and the Foreman/Katello + Tekton rollout lane.

Why not the off-the-shelf options

• OKD runs on Fedora CoreOS, not RHCOS — the validated crypto module is precisely what the OpenShift subscription buys, so OKD-for-free gives OpenShift's shape without its FIPS posture.
• Talos would discard the OSTree/cosa/Butane/Katello substrate already built here.
• We already own the platform layer either would supply (ArgoCD, zot, Tekton, Kyverno, gitea). What's missing is operator lifecycle, cluster lifecycle, and node flavors — not a platform.

Honest limits recorded in the ADR

• FIPS-compliant by construction (validated modules in approved mode) — not FIPS validated. A CMVP certificate cannot be self-issued.
• The Tier-0 crypto pin is declared, not enforced, until the FCOS config in cosa/manifests/sourceos-workstation.yaml is vendored and its crypto packages overridden (that file's existing TODO).
• cosa build needs /dev/kvm. The current GKE cluster is Autopilot (confirmed via warden-* webhooks) and cannot provide it — an independent argument for moving the build tier off Autopilot.
• gitea Actions has never executed a job (action_runner / action_task both empty), so ordering is runner → image build → node flavor → CAPI.
• Guix is MPL/GPL-family, outside the estate's MIT/Apache-only default — a deliberate, recorded exception for the OS tier.

Open questions (flagged, not decided)

• Node flavor derives from FCOS (inherits hardening and crypto) or from a fully vendored manifest? FIPS pin argues the latter; maintenance cost the former.
• CAPI provider purpose-built, or generic bootstrap over Ignition?
• Which tier owns kubelet configuration? Recommendation in the ADR: binary in Tier 0, config via day-2.

Status is proposed — this is the decision record to argue with before implementation re-points the existing IaC.

[mdheller]

Moving this to the sovereign SCM — landed as gitea PR #1 (code.socioprophet.ai/SociOS-Linux/SourceOS/pulls/1). Substrate decision records belong in gitea, not GitHub.