Paving · 03 of 03 · Honest notes

Three weeks of the wish list

The last essay ended with a list of what I wanted next. Most of it is built now, and building it turned up three new gaps, which is how a road gets longer.

Three weeks of the wish list Two columns. Left, wished for on October 5, 2026, in the essay A service catalog that grows with the company: the XR makes the function instead of bring your own; an approval for cloud production, a reviewed release like Kubernetes apps have; least privilege inside a boundary, roles nobody can widen; a queue, a bucket, maybe more, the next nouns on the menu; and live cloud health in Tower. Right, where each stands on October 24, 2026: built October 8, the Lambda, ECS and Container Apps targets; built October 7, ADR-0020's release pin PR; built October 16, one-hour roles and no stored AWS key; built October 24, MessageQueue, ObjectStorage and ManagedPostgreSQL; still open, Tower shows history, not health. Bottom, next and written down: gap 8, more consumers (ECS task roles and Kubernetes identity); gap 9, a private database (Lambda inside the VPC and an app role); gap 10, Azure for real (install the providers and run each kind once). WISHED FOR · OCTOBER 5, 2026WHERE IT STANDS · OCTOBER 24, 2026NEXT, AND WRITTEN DOWNThe XR makes the functionnot bring your ownBuilt · Oct 8, 2026Lambda, ECS and Container Apps targetsAn approval for cloud proda reviewed release, like k8sBuilt · Oct 7, 2026ADR-0020: a release pin PRLeast privilege, a boundaryroles nobody can widenBuilt · Oct 16, 2026one-hour roles · no stored AWS keyA queue, a bucket, maybe morethe next nouns on the menuBuilt · Oct 24, 2026MessageQueue · ObjectStorage · ManagedPostgreSQLLive cloud health in Towernot just what was deployedStill openTower shows history, not healthGap 8 · more consumersECS task roles · Kubernetes identityGap 9 · a private databaseLambda inside the VPC · an app roleGap 10 · Azure, for realinstall the providers · run each onceFour of five crossed off in three weeks, and the new gaps are on the page.LEGENDThe wishBuiltStill openKnown gap, planned

Composed, not borrowed

Cloud targets stopped being bring your own on October 8, so the rules finally had somewhere to live.

Keys gone

Crossplane, Lambda and ECS deploys earn one-hour roles. Every role Crossplane creates sits inside one permissions boundary.

Gaps named

Gaps 8 to 10 are in Airframe's known gaps with a proposed fix each, not discovered by the next person.

Hangar · Airframe · Paving