refactor(iac): cluster split — 1 cluster per plane, breakpilot-* naming (#6)

3 Orca clusters (breakpilot-edge / breakpilot-control / breakpilot-app), 1 plane each. Single-VM core with Keycloak co-tenant on vm-edge. App cluster gets prod + stage VMs. Manifests reorganized into clusters/<name>/services/; validator now enforces per-cluster node whitelist. Multi-VM rollout gated on legal entity.

clusters/breakpilot-app/services/prod/admin-compliance.toml

@@ -0,0 +1,15 @@
+# admin-compliance stub — full config lands in M7.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "admin-compliance"
+image = "registry.breakpilot.com/admin-compliance:placeholder"
+port = 3002
+depends_on = ["backend-compliance", "ai-compliance-sdk"]
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/prod/ai-compliance-sdk.toml

@@ -0,0 +1,15 @@
+# ai-compliance-sdk stub — full config lands in M7.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "ai-compliance-sdk"
+image = "registry.breakpilot.com/ai-compliance-sdk:placeholder"
+port = 3001
+depends_on = ["pg-app", "qdrant", "litellm"]
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/prod/backend-compliance.toml

@@ -0,0 +1,15 @@
+# backend-compliance stub — full config lands in M7.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "backend-compliance"
+image = "registry.breakpilot.com/backend-compliance:placeholder"
+port = 3000
+depends_on = ["pg-app", "minio"]
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/prod/certifai-dashboard.toml

@@ -0,0 +1,15 @@
+# certifai-dashboard stub — full config lands in M6.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "certifai-dashboard"
+image = "registry.breakpilot.com/certifai:placeholder"
+port = 3000
+depends_on = ["mongodb", "litellm"]
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/prod/litellm.toml

@@ -0,0 +1,18 @@
+# litellm stub — full config lands in M6.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "litellm"
+image = "ghcr.io/berriai/litellm:main-stable"
+port = 4000
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.env]
+LITELLM_MASTER_KEY = "${secrets.LITELLM_MASTER_KEY}"
+LITELLM_SALT_KEY = "${secrets.LITELLM_SALT_KEY}"

clusters/breakpilot-app/services/prod/minio.toml

@@ -0,0 +1,23 @@
+# minio stub — full config lands in M7.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "minio"
+image = "minio/minio:latest"
+port = 9000
+extra_ports = ["9001:9001"]
+cmd = ["server", "/data", "--console-address", ":9001"]
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/data"
+
+[service.env]
+MINIO_ROOT_USER = "${secrets.MINIO_ROOT_USER}"
+MINIO_ROOT_PASSWORD = "${secrets.MINIO_ROOT_PASSWORD}"

clusters/breakpilot-app/services/prod/mongodb.toml

@@ -0,0 +1,21 @@
+# mongodb stub — full config lands in M6.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "mongodb"
+image = "mongo:7"
+port = 27017
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "2Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/data/db"
+
+[service.env]
+MONGO_INITDB_ROOT_USERNAME = "${secrets.MONGO_ADMIN_USER}"
+MONGO_INITDB_ROOT_PASSWORD = "${secrets.MONGO_ADMIN_PASSWORD}"

clusters/breakpilot-app/services/prod/pg-app.toml

@@ -0,0 +1,23 @@
+# pg-app stub — full config lands in M4.1.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# RISK-1 (§12): single instance owns tenant_registry + compliance schemas. Split into pg-registry + pg-compliance at Tier B.
+
+[[service]]
+name = "pg-app"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "3Gi"
+cpu = 1.0
+
+[service.volume]
+path = "/var/lib/postgresql/data"
+
+[service.env]
+POSTGRES_DB = "platform"
+POSTGRES_USER = "platform"
+POSTGRES_PASSWORD = "${secrets.PG_APP_PASSWORD}"

clusters/breakpilot-app/services/prod/qdrant.toml

@@ -0,0 +1,17 @@
+# qdrant stub — full config lands in M7.x.
+# Host: vm-app-prod. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "qdrant"
+image = "qdrant/qdrant:v1.10.0"
+port = 6333
+
+[service.placement]
+node = "vm-app-prod"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5
+
+[service.volume]
+path = "/qdrant/storage"

clusters/breakpilot-app/services/stage/admin-compliance.toml

@@ -0,0 +1,14 @@
+# admin-compliance stub — full config lands in M7.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "admin-compliance"
+image = "registry.breakpilot.com/admin-compliance:env-stage"
+port = 3002
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/ai-compliance-sdk.toml

@@ -0,0 +1,14 @@
+# ai-compliance-sdk stub — full config lands in M7.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "ai-compliance-sdk"
+image = "registry.breakpilot.com/ai-compliance-sdk:env-stage"
+port = 3001
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/backend-compliance.toml

@@ -0,0 +1,14 @@
+# backend-compliance stub — full config lands in M7.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "backend-compliance"
+image = "registry.breakpilot.com/backend-compliance:env-stage"
+port = 3000
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/certifai-dashboard.toml

@@ -0,0 +1,14 @@
+# certifai-dashboard stub — full config lands in M6.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "certifai-dashboard"
+image = "registry.breakpilot.com/certifai:env-stage"
+port = 3000
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/stage/customer-portal.toml

@@ -0,0 +1,15 @@
+# customer-portal stub — full config lands in M5.1.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "customer-portal"
+image = "registry.breakpilot.com/portal:env-stage"
+port = 3000
+domain = "*.stage.breakpilot.com"
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/stage/litellm.toml

@@ -0,0 +1,14 @@
+# litellm stub — full config lands in M6.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+
+[[service]]
+name = "litellm"
+image = "ghcr.io/berriai/litellm:main-stable"
+port = 4000
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/mongodb-stage.toml

@@ -0,0 +1,15 @@
+# mongodb-stage stub — full config lands in M6.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral.
+
+[[service]]
+name = "mongodb-stage"
+image = "mongo:7"
+port = 27017
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/orca-proxy.toml

@@ -0,0 +1,15 @@
+# orca-proxy stub — full config lands in M1.2.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Stage proxy only routes to stage app containers.
+
+[[service]]
+name = "orca-proxy"
+image = "orca-managed/orca-proxy:placeholder"
+port = 443
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "256Mi"
+cpu = 0.5

clusters/breakpilot-app/services/stage/pg-app-stage.toml

@@ -0,0 +1,15 @@
+# pg-app-stage stub — full config lands in M4.1.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral; no backup, no volume; reset on each release.
+
+[[service]]
+name = "pg-app-stage"
+image = "postgres:16-alpine"
+port = 5432
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "1Gi"
+cpu = 0.5

clusters/breakpilot-app/services/stage/qdrant-stage.toml

@@ -0,0 +1,15 @@
+# qdrant-stage stub — full config lands in M7.x.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Ephemeral, tiny corpus.
+
+[[service]]
+name = "qdrant-stage"
+image = "qdrant/qdrant:v1.10.0"
+port = 6333
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25

clusters/breakpilot-app/services/stage/tenant-registry.toml

@@ -0,0 +1,19 @@
+# tenant-registry stub — full config lands in M4.1.
+# Host: vm-app-stage. Resource budget per INFRASTRUCTURE.md §6 co-tenant notes.
+# Calls PROD Keycloak per §2 "Calls OUT to prod"; audience is stage_client_id.
+
+[[service]]
+name = "tenant-registry"
+image = "registry.breakpilot.com/tenant-registry:env-stage"
+port = 8090
+depends_on = ["pg-app-stage"]
+
+[service.placement]
+node = "vm-app-stage"
+
+[service.resources]
+memory = "512Mi"
+cpu = 0.25
+
+[service.env]
+KEYCLOAK_ISSUER = "https://auth.breakpilot.com/realms/breakpilot-prod"