earnkit

EARNKIT — BUILT (2026-07-12): github.com/Cooperation-org/earnkit (private; checkout /opt/shared/repos/earnkit). One Ansible playbook (site.yml) stands up the full earned-governance stack on a fresh Ubuntu 24.04 VM: Taiga 6.8.1 native (back/async/events/front + taiga-contrib-linkedtrust-auth), Marten (vite build, nginx static), Odoo 17 (source, one DB per team, dbfilter), amebo (with migration ledger runner), GovKit (whitenoise, gunicorn). playbooks/add-team.yml = per-team Odoo DB init + OIDC provider + Taiga project + amebo instance + GovKit org. CI/CD: restricted deploy user + whitelisted per-tool update scripts + GH workflow sample (merge to main in amebo/govkit/marten -> deploys). Composition-only: no app code, every tool standalone (Golda 2026-07-12). No Docker, no local Postgres (database_host), LT SSO everywhere. STATUS: both playbooks pass syntax check; NEVER YET RUN against a real VM. Before first run Golda must: create VM (500+, ~8GB/4c), pick hostname scheme, register OIDC clients on the IdP, set deploy keys + vault secrets (docs/DECISIONS.md lists all open items + VERIFY flags). Ticket: Taiga earned-governance-toolkit-accelerator #12.