Requirement: change process faster and more atomic than a coordinated multi-repo tag train

[djbclark]

Requirement: change process faster and more atomic than a coordinated multi-repo tag train

Normative for tendcf: the Site Model → signed-release → deploy path must be much faster and much more atomic than cutting a coordinated tag across several sibling repositories.

This is in the current design:

• D19 — a private-site lockfile pins inputs. The signed release is the deploy artifact. There is no sibling-repo tag lockstep.
• The unit of apply is a per-host ChangePlan, not a multi-repo release ceremony.

Still open

• No numeric latency target has been picked (for example: one Site Model edit → signed → applied in under N minutes).
• The mechanism is not built. That is Step 6 on Tracker: tendcf architecture #1: signed releases, push-only, ChangePlan executor.

This does not relax signing, consent, review gates, or rollback discipline. It shrinks the unit and latency of a change.

Non-goals

• Does not require a coordinated tag train for changes that do not actually span repositories.
• Does not relax the trust model.