diff --git a/apps/rbac.yaml b/apps/rbac.yaml
new file mode 100644
index 0000000..5ef4d26
--- /dev/null
+++ b/apps/rbac.yaml
@@ -0,0 +1,21 @@
+# Namespaces and the two lab ServiceAccounts (design 6.11 / 7.3): harness (chaos-mesh) and ai-reader (demo).
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: rbac
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git
+    targetRevision: main
+    path: workloads/rbac
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: default
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
diff --git a/argocd/README.md b/argocd/README.md
deleted file mode 100644
index 690a09d..0000000
--- a/argocd/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# argocd
-
-Placeholder. See the root README for the work package that fills this directory.
diff --git a/argocd/root-app.yaml b/argocd/root-app.yaml
new file mode 100644
index 0000000..8bbb09b
--- /dev/null
+++ b/argocd/root-app.yaml
@@ -0,0 +1,26 @@
+# app-of-apps root (Terraform design 7.2 / 7.3). Applied once by init-cp.sh; everything under apps/ is then Git-driven.
+# The gitops repository is public, so no repository credential is needed.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.seonology.com/selfheal-lab/selfheal-lab-gitops.git
+    targetRevision: main
+    path: apps
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - ServerSideApply=true
diff --git a/bootstrap/kubeadm/README.md b/bootstrap/kubeadm/README.md
deleted file mode 100644
index c4375f2..0000000
--- a/bootstrap/kubeadm/README.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# bootstrap/kubeadm
-
-Placeholder. See the root README for the work package that fills this directory.
diff --git a/bootstrap/kubeadm/init-cp.sh b/bootstrap/kubeadm/init-cp.sh
new file mode 100755
index 0000000..08ae335
--- /dev/null
+++ b/bootstrap/kubeadm/init-cp.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Control-plane bootstrap (Terraform design 7.2). Run ONCE on the CP as root after cloud-init finished:
+#   sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/init-cp.sh
+# Re-running is safe: kubeadm init is skipped when /etc/kubernetes/admin.conf exists; the rest is idempotent apply.
+set -euo pipefail
+FLANNEL_VERSION="${FLANNEL_VERSION:-v0.28.9}"   # https://github.com/flannel-io/flannel/releases
+ARGOCD_VERSION="${ARGOCD_VERSION:-v3.5.3}"       # https://github.com/argoproj/argo-cd/releases
+GITOPS_DIR="${GITOPS_DIR:-/opt/selfheal/gitops}"
+# shellcheck disable=SC1091
+. /opt/selfheal/node.env   # ROLE, POD_CIDR, CP_PRIVATE_IP, CP_PUBLIC_IP (written by cloud-init)
+[ "$ROLE" = cp ] || { echo "not a control plane node (ROLE=$ROLE)" >&2; exit 1; }
+
+if [ ! -f /etc/kubernetes/admin.conf ]; then
+  # advertise on the private IP (VPN peers and workers reach it); the EIP goes into the API server cert SANs
+  kubeadm init \
+    --pod-network-cidr="$POD_CIDR" \
+    --apiserver-advertise-address="$CP_PRIVATE_IP" \
+    --apiserver-cert-extra-sans="$CP_PUBLIC_IP" \
+    --node-name "$(hostname)"
+fi
+export KUBECONFIG=/etc/kubernetes/admin.conf
+install -d -m 700 -o ubuntu -g ubuntu /home/ubuntu/.kube
+install -m 600 -o ubuntu -g ubuntu /etc/kubernetes/admin.conf /home/ubuntu/.kube/config
+
+# CNI: flannel (pod CIDR 10.244.0.0/16 matches its default; ip-masq gives pods the node IP towards the VPN, design 8)
+kubectl apply -f "https://github.com/flannel-io/flannel/releases/download/${FLANNEL_VERSION}/kube-flannel.yml"
+
+# Argo CD (non-HA manifest) + app-of-apps root. Server-side apply: the CRDs exceed the client-side annotation limit.
+kubectl create namespace argocd --dry-run=client -o yaml | kubectl apply -f -
+kubectl apply -n argocd --server-side --force-conflicts -f "https://raw.githubusercontent.com/argoproj/argo-cd/${ARGOCD_VERSION}/manifests/install.yaml"
+kubectl -n argocd rollout status deploy/argocd-server --timeout=600s
+kubectl apply -f "${GITOPS_DIR}/argocd/root-app.yaml"
+
+# Worker join command (bootstrap token, 24h). Copy it to each worker: see join-worker.sh
+kubeadm token create --print-join-command > /opt/selfheal/join.sh
+chmod 600 /opt/selfheal/join.sh
+echo "control plane ready; join command in /opt/selfheal/join.sh"
diff --git a/bootstrap/kubeadm/join-worker.sh b/bootstrap/kubeadm/join-worker.sh
new file mode 100755
index 0000000..9c4a3d3
--- /dev/null
+++ b/bootstrap/kubeadm/join-worker.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Worker join (Terraform design 7.2). Feed the join command produced on the CP through stdin, from the operator host:
+#   ssh -i ~/.ssh/selfheal-lab ubuntu@<CP_EIP> 'sudo cat /opt/selfheal/join.sh' \
+#     | ssh -i ~/.ssh/selfheal-lab -J ubuntu@<CP_EIP> ubuntu@<worker private ip> 'sudo bash /opt/selfheal/gitops/bootstrap/kubeadm/join-worker.sh'
+# The token never touches the operator terminal or a log. Safe to re-run: a joined node exits 0.
+set -euo pipefail
+if [ -f /etc/kubernetes/kubelet.conf ]; then echo "already joined"; exit 0; fi
+JOIN="$(cat)"
+case "$JOIN" in kubeadm\ join*) ;; *) echo "stdin is not a kubeadm join command" >&2; exit 1;; esac
+# shellcheck disable=SC2086
+$JOIN --node-name "$(hostname)"
+echo "joined"
diff --git a/workloads/rbac/ai-reader.yaml b/workloads/rbac/ai-reader.yaml
new file mode 100644
index 0000000..5e58281
--- /dev/null
+++ b/workloads/rbac/ai-reader.yaml
@@ -0,0 +1,19 @@
+# AI VM read-only identity (Terraform design 6.11): built-in ClusterRole view.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ai-reader
+  namespace: demo
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: selfheal-ai-reader-view
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view
+subjects:
+  - kind: ServiceAccount
+    name: ai-reader
+    namespace: demo
diff --git a/workloads/rbac/harness.yaml b/workloads/rbac/harness.yaml
new file mode 100644
index 0000000..4a6b21e
--- /dev/null
+++ b/workloads/rbac/harness.yaml
@@ -0,0 +1,41 @@
+# harness runner identity (Terraform design 6.11): Chaos Mesh CRs, rollout/scale, pod reads, cordon/drain.
+# Tokens are minted by `make token` (kubectl create token harness -n chaos-mesh --duration 24h) into Secret Manager.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: harness
+  namespace: chaos-mesh
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: selfheal-harness
+rules:
+  - apiGroups: ["chaos-mesh.org"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "deployments/scale"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch", "patch"]
+  - apiGroups: [""]
+    resources: ["pods/eviction"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: selfheal-harness
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: selfheal-harness
+subjects:
+  - kind: ServiceAccount
+    name: harness
+    namespace: chaos-mesh
diff --git a/workloads/rbac/namespaces.yaml b/workloads/rbac/namespaces.yaml
new file mode 100644
index 0000000..b93b4b6
--- /dev/null
+++ b/workloads/rbac/namespaces.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: chaos-mesh
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: demo