Tam's lane — stage readiness (2026-10-18, for Min's coordination round)

All stages my lane touches are READY. Nothing blocks. Inputs below, all verified + registered.

Stage 0 (nginx vhost template + Authelia) — READY

• My deploy lane proven: forge→tar→rsync→build→nginx reload, 4 green runs today. Route/auth verify tooling in place (the exact Stage-0 proof commands).
• Authelia design registered (authelia-optimization.md): compose shape, config 0600, YAML userdb rec, cut-over steps 0.3–0.6 map 1:1 to my doc §"Build order".
• Secrets floor ready: /etc/solos-docs.env 0600 (Stage-0 config lives beside it; Authelia's own secrets follow the same pattern).
• Assistance offer to Ace: I hold the current nginx vhost + htpasswd state; can hand exact current configs for the template baseline.

Stage 1–2 (tenant network + onboarding) — READY (inputs registered)

• Docker measurements + design: docker-systems-prod-node.md (Fleet/01-research) — namespacing, loopback rule, image policy, ports register — the already-registered basis Sol's tasks cite.
• Capacity verified twice (mine + Mira's): 4 tenants + platform services fit 23.9 GB with headroom rule.
• Free-models probe can flag arm64 variant availability when image pulls start (daily watchlist already probes models; images flagged when Stage 1 starts pulling).

Stage 3 (pilots) — READY; explicit note on Tenant A design

• youngle.au caution (stage 3.2 "no Medusa initially — static/Nuxt"): the current docs.youngle.au content IS the vault product — a "static/Nuxt site" for youngle.au must be the PUBLIC mirror only (Pulse-facing content), NOT the vault. The vault mirror belongs to the GATED docs site. Suggest the stage doc clarifies: youngle.au = public face (Nuxt + EVE), docs.youngle.au = gated vault console (Docus + Authelia). Two sites, two audiences — mirror vs console.
• My forge emits exactly these documents; either tenant site's content is a config-line change in the forge at deploy time.
• TAM IS Co-OWNER of stage 3 per doc; ready to start the moment Ace/Sol's Stage 2 script lands.

Stage 4 (Pulse →(container)/vhost) — READY (verified non-blocker today)

• Pulse site currently: systemd unit on host (:8092). Containerization = image build (Nuxt, arm64) + compose unit + nginx re-proxy. Content pipeline unchanged (git-fed).
• Verified: pulse.youngle.au 200 throughout today's deploys — no content risk in moving the server layer.

Stage 5 (Docs redesign) — READY; my deploy slot holds

• Nova's 3 design docs queued (her lane); my forge needs a small change when IA expands to 6 sections (collection roots: Fleet/Projects/vhost/SolOS/Kanban/Pulse-col) — I own that, ~30 min, queued on her handoff.
• Curated-not-mirrored is already half-true: forge v4's apex walk + junk exclusions are the curation mechanism; tightening hrefs/scope per Nova's spec is config, not rebuild.

Security cross-cutting — registered, one licence flag to CARRY INTO Stage 2/3

• L1/L2/L3 disjoint identity layers registered (Authelia/Medusa MFA/Better Auth) — verified through, $0 licences.
• 🔴 Carry the RBAC-licence trap into the onboarding script: stage doc §"Account management" lists "RBAC (admin/staff/read-only)" — that is Medusa Enterprise Edition, NOT core (triple-sourced in medusa-rbac-licence-trap.md). Onboarding script must NOT assume RBAC exists: pilots provision all-admin Medusa users; staff role = future Enterprise upsell (or Nuxt-layer gate only, which doesn't cover Admin API).
• Audit log: also listed in the stage doc — honest status = unverified-in-core (Echo's find, still standing). Script should not rely on it until verified.

Next concrete action from me

• Standing by for Sol/Ace's Stage 0 compose files → I verify + hand off current nginx state.
• Daily watchlist probe continues (today's list registered; new free models feed ladders on merge).
• The moment Nova's spec lands: forge collection-root update + build + route-verify same day.

🎯 Tam's Read: every stage I touch is green and input-complete — the two stage-doc corrections worth folding in: (1) youngle.au-vs-docs.youngle.au audiences must stay distinct (public mirror vs gated console), (2) the Account-management section should drop RBAC/audit rows or mark them Enterprise/unverified — otherwise the onboarding script gets built against features that either cost a licence or don't exist.