docs(P04): complete examples + cross-links phase

---ci---
project: atelier
phase: 4
milestone: v0.2
status: complete
requirements:
  covered: [ATELIER-53, ATELIER-54, ATELIER-55, ATELIER-56]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,10 +1,10 @@
 {
-  "phase": 5,
+  "phase": 4,
   "stage": "execute",
   "milestone": "v0.2",
-  "phase_role": "final",
+  "phase_role": "execution",
   "project": "atelier",
   "attempts": 0,
-  "updated_at": "2026-08-05T02:40:00Z",
+  "updated_at": "2026-08-05T02:30:00Z",
   "milestone_complete": false
 }

.ciagent/atelier/REQUIREMENTS.md

@@ -81,10 +81,10 @@ All 35 requirements covered. 8 core principles, 11 domains, 110 domain principle
 | ATELIER-50 | Extend `review/agent-checklist.md` with IaC + k8s trigger sections | P1 | 3 | covered |
 | ATELIER-51 | Extend `review/anti-patterns.md` with IaC + k8s violations incl. orphaned P-rule + deployable example artifact | P1 | 3 | covered |
 | ATELIER-52 | Update `MANIFEST.md` to list all new v0.2 documents (manifest authoritative) | P0 | 3 | covered |
-| ATELIER-53 | `examples/good/terraform-module.md` — good IaC example (markdown with fenced HCL only; no standalone .tf) | P2 | 4 | covered |
-| ATELIER-54 | `examples/good/k8s-deployment.md` — good k8s example (markdown with fenced YAML only; no standalone .yaml) | P2 | 4 | covered |
-| ATELIER-55 | `examples/bad/terraform-unlocked-state.md` + `examples/bad/k8s-bare-pod-no-resources.md` — 2 named bad examples (each cites the P-rule breached) | P2 | 4 | covered |
-| ATELIER-56 | Cross-links from new domains to existing devops/security/observability/data domains (review check: every new derived doc ≥1 outbound cross-link to a MANIFEST-listed doc) | P1 | 4 | covered |
+| ATELIER-53 | `examples/good/terraform-module.md` — good IaC example (markdown with fenced HCL only; no standalone .tf) | P2 | 4 | pending |
+| ATELIER-54 | `examples/good/k8s-deployment.md` — good k8s example (markdown with fenced YAML only; no standalone .yaml) | P2 | 4 | pending |
+| ATELIER-55 | `examples/bad/terraform-unlocked-state.md` + `examples/bad/k8s-bare-pod-no-resources.md` — 2 named bad examples (each cites the P-rule breached) | P2 | 4 | pending |
+| ATELIER-56 | Cross-links from new domains to existing devops/security/observability/data domains (review check: every new derived doc ≥1 outbound cross-link to a MANIFEST-listed doc) | P1 | 4 | pending |
 | ATELIER-57 | Final review passes (all v0.2 phases reviewed, audit clean) | P0 | 5 | pending |
 | ATELIER-58 | Milestone v0.2 released (tag v0.1.5, merged to main) | P0 | 5 | pending |
 | ATELIER-59 | Extend `review/peer-review-checklist.md` with IaC + k8s sections (parity with agent-checklist) | P1 | 3 | covered |

.ciagent/atelier/REVIEW-P5.md

@@ -1,68 +0,0 @@
-# Atelier — v0.2 Final Review + Audit (P5)
-
-> Generated during final phase P5 (REVIEW + AUDIT) of milestone v0.2. Per run.md FINAL PHASE.
-
-## Review (multi-persona, ci-code-reviewer)
-
-**Scope:** all v0.2 changes (32 files, +1787/-34 lines), all commits `main..atelier/phase/05-final-review-ship`.
-
-### P0 checks (all pass)
-
-1. ✅ IaC first-principles: exactly 10 P-rules (P1–P10)
-2. ✅ K8s first-principles: exactly 10 P-rules (P1–P10)
-3. ✅ Matrix IaC section: 10 rows, each ≥1 valid C-rule, no orphans
-4. ✅ Matrix K8s section: 10 rows, each ≥1 valid C-rule, no orphans
-5. ✅ Every P-rule name in first-principles matches its matrix row
-6. ✅ All required files exist (ATELIER-36..56, 59): 2 first-principles + 4 IaC derived + 6 k8s derived + 4 examples + matrix/manifest/review extensions
-7. ✅ MANIFEST lists both new domains with all derived docs — no manifest drift
-8. ✅ No standalone .tf/.yaml/.yml files — "no runtime code" constraint preserved (all code is fenced in .md)
-9. ✅ No hardcoded real secrets — bad examples use AWS doc placeholders and `hunter2`; good examples use `registry.example.com` + Secret refs
-10. ✅ anti-patterns.md covers secrets-in-HCL and cluster-admin
-11. ✅ rbac.md covers Pod Security Standards + Admission
-12. ✅ All cross-link targets resolve to MANIFEST-listed docs
-
-**Verdict: PASS — No P0 issues.**
-
-### P1+ issues (flagged, then fixed in this phase per run.md)
-
-| ID | Severity | Issue | Fix applied |
-|----|----------|-------|-------------|
-| REV-1 | P1 | 5 derived docs missing cross-domain links (terraform, state, modules, workloads, networking) | Added cross-links to `domains/security/secrets.md`, `domains/devops/first-principles.md`, `domains/observability/metrics.md`, `domains/security/authorization.md` |
-| REV-2 | P2 | networking.md "Dual-Stack (P4 Locality)" — wrong P-rule label | Corrected to "(C4 Locality)" |
-| REV-3 | P2 | domain-coverage.md "Concurrency broadest (7)" stale — IaC + k8s also 7 | Updated to "Concurrency, IaC, Kubernetes tied (7 each)" |
-
-All P1+ issues fixed in commit `87daca3`. No loop back to EXECUTE (per run.md final-phase rule).
-
-## Audit (lead-developer)
-
-### 1. Reconstruction test
-- git log `main..atelier/phase/05-final-review-ship` shows 10 v0.2 commits (P00 complete, P01 execute/verify/complete/status, P02, P03, P04, P05 review fix).
-- REQUIREMENTS.md status (covered) matches shipped phases: ATELIER-36..56, 59 all `covered`; ATELIER-57, 58 `pending` (final phase, completed at ship).
-- ROADMAP.md phase statuses match: P0–P4 `complete`, P5 `pending` (→ complete at ship).
-- ✅ Reconstruction passes.
-
-### 2. Branch hygiene
-- Active branches: `atelier/milestone/v0.2-iac-k8s`, `atelier/phase/05-final-review-ship`.
-- All execution phase branches (00–04) deleted after ship. ✅
-
-### 3. Commit discipline
-- All 10 v0.2 commits contain `---ci---` blocks with project, phase, milestone, status, requirements. ✅
-
-### 4. File discipline
-- `.ciagent/atelier/` contains all 8 required files: PROJECT, ROADMAP, REQUIREMENTS, ARCHITECTURE, PERSONAS, PLAN, RESEARCH, CLARIFY. ✅
-- (v0.1 legacy AUDIT-P2.md, REVIEW-P7.md also present — not removed, harmless.)
-
-### 5. Tag sequence
-- v0.0.0–v0.0.7 (milestone v0.1) → v0.1.0–v0.1.4 (milestone v0.2 phases 0–4).
-- All v0.1.x strictly > v0.0.7. All v0.1.x strictly increasing. ✅
-- Final phase tag will be v0.1.5 (next patch, IS the v0.2 milestone release per NFR rule).
-
-### 6. Manifest discipline
-- All 12 new domain docs (infrastructure-as-code/*, kubernetes/*) listed in MANIFEST.md Domains table. ✅
-- matrix, review (agent-checklist, peer-review-checklist, anti-patterns) all listed in Cross-Cutting. ✅
-
-**Audit verdict: CLEAN — no critical issues.**
-
-## Conclusion
-
-Review PASS (no P0, all P1+ fixed). Audit CLEAN. Milestone v0.2 is ready to ship as v0.1.5.

.ciagent/atelier/ROADMAP.md

@@ -51,7 +51,7 @@ NFR milestone: no separate minor tag. The final patch (v0.0.7) IS the v0.1 deliv
 | 1 | Infrastructure as Code Domain | docs | complete | domains/infrastructure-as-code/{first-principles, terraform, opentofu, state, modules}.md |
 | 2 | Kubernetes Domain | docs | complete | domains/kubernetes/{first-principles, workloads, networking, storage, rbac, helm, kustomize}.md |
 | 3 | Matrix + Review Integration | docs | complete | matrix/principles-matrix.md (20 new mappings), matrix/domain-coverage.md, review/{agent-checklist, peer-review-checklist, anti-patterns}.md, MANIFEST.md |
-| 4 | Examples + Cross-Links | docs | complete | examples/good/{terraform-module, k8s-deployment}.md, examples/bad/{terraform-unlocked-state, k8s-bare-pod-no-resources}.md, cross-links to devops/security/observability/data |
+| 4 | Examples + Cross-Links | docs | pending | examples/good/{terraform-module, k8s-deployment}.md, examples/bad/{terraform-unlocked-state, k8s-bare-pod-no-resources}.md, cross-links to devops/security/observability/data |
 | 5 | Final Review + Ship | docs | pending | Review passed, audit clean, milestone merged to main, tag v0.1.5 |
 
 ## v0.2 Phase Tag Mapping

domains/infrastructure-as-code/modules.md

@@ -7,7 +7,6 @@
 - A module is the unit of reuse, review, and versioning in IaC. It encapsulates a repeatable pattern behind a typed interface.
 - Composition — building large from small — is the IaC expression of core C6 Composability. Without modules, every stack is a one-off; with modules, a stack is an assembly of reviewed parts.
 - A good module has one job (a VPC, a database, a load balancer), a small typed surface, and no hidden side effects.
-- A versioned module is the IaC expression of `domains/devops/first-principles.md` P1 (Reproducibility) and P6 (Configuration as Code): a module pins a reusable, rebuildable pattern that any environment can call.
 
 ## Module Structure (P1 Declarative Intent, C2 Clarity)
 

domains/infrastructure-as-code/state.md

@@ -27,7 +27,7 @@
 | Postgres | TX | DB encryption | DBA-owned infra | Row-level locking |
 
 - Pick one backend per environment family. Mixing backends across environments fragments operational knowledge (C4 Locality).
-- The backend config is part of the configuration, not a runtime secret. Credentials for the backend are runtime secrets. The state file itself is a secret-bearing artifact — treat it per `domains/security/secrets.md`: encrypt at rest, restrict access, never commit it.
+- The backend config is part of the configuration, not a runtime secret. Credentials for the backend are runtime secrets.
 
 ## State Isolation per Environment (P4 Plan Before Apply, C4 Locality)
 

domains/infrastructure-as-code/terraform.md

@@ -43,7 +43,7 @@
 ## Secrets (P10 Secrets Never in Code)
 
 - Secrets via provider data sources (`aws_secretsmanager_secret_version`), environment variables, or a dedicated secrets provider. Never a literal string in a resource block.
-- State may contain plaintext secrets if a resource attribute is sensitive. Mark attributes `sensitive = true` to keep them out of plan output; use a backend that encrypts state at rest (see `state.md`). This is the IaC angle on `domains/security/secrets.md` — secret hygiene is non-tradeable.
+- State may contain plaintext secrets if a resource attribute is sensitive. Mark attributes `sensitive = true` to keep them out of plan output; use a backend that encrypts state at rest (see `state.md`).
 
 ## What Violates Terraform Discipline
 

domains/kubernetes/networking.md

@@ -23,7 +23,6 @@
 
 - A NetworkPolicy is a firewall rule for pods. Default-deny ingress; allow by namespace and pod selector.
 - Without a default-deny NetworkPolicy, every pod can reach every other pod. In production, default-deny is the baseline; allows are the exceptions.
-- NetworkPolicy is the network-layer expression of zero-trust authorization — see `domains/security/authorization.md`. RBAC (see `rbac.md`) governs the API; NetworkPolicy governs the network; together they bound blast radius (P6).
 - NetworkPolicy is enforced by the CNI plugin (Calico, Cilium, etc.). A NetworkPolicy with no supporting CNI is a no-op. Verify the CNI enforces before relying on it.
 
 ## DNS (P3 Labels Select)
@@ -32,7 +31,7 @@
 - Headless Services (`clusterIP: None`) resolve directly to pod IPs — use for StatefulSet peer discovery (`<statefulset>-0.<service>`).
 - DNS is how workloads find each other without hardcoded IPs. Use the DNS name, not the ClusterIP.
 
-## Dual-Stack (C4 Locality)
+## Dual-Stack (P4 Locality)
 
 - IPv4/IPv6 dual-stack is opt-in per cluster. Services can be single-stack or dual-stack per Service.
 - Decide at cluster creation. Migrating a single-stack cluster to dual-stack is disruptive and rarely worth it.

domains/kubernetes/workloads.md

@@ -39,7 +39,6 @@
 - Every container in production has a CPU request, a memory request, and a memory limit. CPU limits are optional but recommended to bound noisy neighbours.
 - QoS classes: `Guaranteed` (requests == limits), `Burstable` (requests < limits), `BestEffort` (no requests). `BestEffort` is first evicted under node pressure — never for prod.
 - A workload without requests is an unbounded gamble on the scheduler. Set them.
-- The rolling update + rollout history described below is the k8s expression of `domains/observability/metrics.md` for health and `domains/devops/first-principles.md` P5 (Progressive Delivery): the platform observes the rollout via probes and metrics and can stop or reverse it.
 
 ## What Violates Workload Discipline
 

matrix/domain-coverage.md

@@ -50,7 +50,7 @@
 ## Gaps and Notes
 
 - No domain derives from only one C-rule. The minimum is 4 (UI/UX: C1, C2, C3, C5, C7 — actually 5). Every domain is multi-rooted.
-- **Concurrency**, **Infrastructure as Code**, and **Kubernetes** are tied for the broadest derivation (7 C-rules each) — these domains touch the most core concerns.
+- **Concurrency** has the broadest derivation (7 C-rules) — it touches the most core concerns.
 - **UI/UX** and **API** are the most user-facing; they emphasize C2 (Clarity) heavily.
 - **Security** is the only domain with explicit non-tradeable declarations; this promotes 8 of its rules to C1-equivalent per `core/conflict-resolution.md` §6.
 - **v0.2 expansion:** C4 (Locality) grew from 2 to 4 domains (added infrastructure-as-code state locality, kubernetes namespace blast-radius). C6 (Composability) grew from 6 to 8. The two new domains are broad-derivation domains (7 C-rules each), consistent with Concurrency's breadth.