[shipmill-romamo]

Summary

Records how Cloudfall keeps components, runners and environments apart, without containers or a hypervisor of its own.

• Required on every server: a systemd sandbox per unit, a database role per component, secrets through systemd credentials, keys scoped by environment, a non-root deploy user, and ephemeral sandboxed runners (denied production directories, peers and keys when they share a server with production)
• Recommended: separate servers for different trust levels (production and staging, build or CI and production, different owners)
• One server is supported: a team may place everything on one server, several independent projects included, by declaring the accepted risk in the plan; Cloudfall warns about an undeclared placement, and warns more strongly when the trust levels belong to different owners

Adds D-10 to docs/decisions.md and the reasoning in docs/decisions/2026-11-02-isolation-without-containers.md, including where the code stands today (component units have only NoNewPrivileges and PrivateTmp; CI keys land in root's authorized_keys; secrets go through EnvironmentFile=; no resource envelopes yet).

Docs only; no code changes.

🤖 Generated with Claude Code