# railiance01 package

Target: railiance01 only. The workstation kubeconfig that talks to that API
is the `k3s-api-railiance01` tunnel (local port **16444**).
`~/.kube/config-hosteurope` currently points at 16443 (coulombcore); rewrite
the server port or export a copy before applying.

Apply order is documented in `docs/operator-runbook.md`. Do not apply the
Deployment until:

1. The image digest is pinned (currently `sha256:5f3d01c8…` built from source commit `2b8c9097adaef67c88f329452e42eca1d74b65a7`, AUDIT-WP-0018-T03).
2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
   `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
   applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
3. Apply `deploy/migrate-egress.yaml` before starting the migration Job.
   The default-deny policy selects every pod, while the receiver egress policy
   deliberately selects component `receiver` only. Migration pods need their
   own exact component `migrate` exception: DNS TCP/UDP53 to kube-dns in
   kube-system and PostgreSQL TCP5432 to platform-pg pods in databases.
   No API-server access or service account token is needed.
4. Job `audit-core-migrate` has completed and ledger includes
   `0007-import-receipts` before the current receiver image is released.

```bash
make image-build
make deploy-dry-run
```

The 2026-10-15 NK-WP-0035 migration retries exposed this missing dedicated
egress exception: the first two attempts could not resolve/reach PostgreSQL.
The bounded policy is retained as source so future releases do not depend on
an undocumented repair. Both receiver and migration Job pin immutable image
`forgejo.coulomb.social/coulomb/audit-core@sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271`,
built from source `5227fb14e47f26a01930be4611360fd90f740662`; this follow-up
changes deployment configuration only and requires no image rebuild. Migration
0007 adds import receipts and indexes without changing existing event rows.

AUDIT-WP-0013-T07 (2026-11-03) re-pins receiver and migration Job to
`forgejo.coulomb.social/coulomb/audit-core@sha256:304cfb83daa873e5790a2f262f6c4ccd56498b6e9e1a390368dcf0d407256300`,
built from `818589359ae343d821a009413823f4456962c0d1`. It carries the T06
independent full-scope reconciliation reader and the AUDIT-WP-0018-T02
reject-only secret_policy overlay. No migration beyond 0007 is added, so no
migration Job run is required; rollback to `b479801b…` stays schema-compatible.

AUDIT-WP-0018-T03 (2026-11-03) re-pins receiver and migration Job to
`forgejo.coulomb.social/coulomb/audit-core@sha256:5f3d01c8a1f90411a1429451b46c66a9ac9262fc7fce68790c16e22eeb7871a6`,
built from `2b8c9097adaef67c88f329452e42eca1d74b65a7`. It adds the
`opening_without_closing` stream finding (`closing_classes`). No schema
change and no migration Job rerun are needed. Rollback to `304cfb83…` is
compatible: the older image ignores the `closing_classes` overlay key.