coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Railiance staged-promotion overlay for flex-auth
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned
Helm values for tenant-engine and user-engine, isolated canary cycle
(deploy/observe/promote/rollback), and emergency kubectl path retained.
T03 waits on the custodian drain-plan row.
This commit is contained in:
tegwick 2026-08-16 01:32:31 +02:00
parent 804251514c
commit 1d58f13eb8
19 changed files with 634 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

56
workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Bring flex-auth under the railiance staged-promotion contract"
domain: infotech
repo: flex-auth
status: proposed
status: active
owner: codex
topic_slug: netkingdom
planning_priority: P2
@ -14,7 +14,7 @@ depends_on_workplans:
related_workplans:
- RAIL-BS-WP-0006
created: "2026-08-11"
updated: "2026-08-11"
updated: "2026-08-16"
state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
---
@ -61,7 +61,7 @@ policy rollouts.
```task
id: FLEX-WP-0011-T01
status: todo
status: done
priority: medium
state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
```
@ -84,11 +84,31 @@ rollback runbook content rather than discarding it.
Done when the overlay renders and a server-side dry run of the full manifest
set is accepted.
Done 2026-08-16: `railiance/app.toml` validates against `railiance.app.v1`
(`criticality = high`, `digest_policy = required`, both production
`/healthz` endpoints plus isolated canary). One chart, three independently
rollable values files (`values/tenant-engine.yaml`,
`values/user-engine.yaml`, `values/stage2-canary.yaml`).
`tests/stage1.sh` renders all five values files. `bin/railiance run .`
passed (stage1 result `/tmp/flex-auth-stage1-result.json`). Server-side
dry run of canary + both production pins accepted (`kubectl apply
--dry-run=server --server-side` and `helm upgrade --dry-run=server` for
the canary). `deploy/README.md` kept as the emergency kubectl path and
points at the overlay.
Live discovery while pinning values: `flex-auth-tenant-engine` is back on
`sha256:c25fc34a…` (four-action policy). `tenant.retire` /
`tenant.update` / `tenant.reactivate` deny `unknown_action`. The
FLEX-WP-0010 image `sha256:9320df39…` is a ReplicaSet at desired=0.
Overlay pins match live; tenant-engine was notified
(`50a48026-a75b-4b1f-97f6-7c60063a30b8`). This workplan does not
re-promote that image.
## T02 - Prove the stage commands
```task
id: FLEX-WP-0011-T02
status: todo
status: done
priority: medium
state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
```
@ -101,11 +121,31 @@ target before promoting.
Done when a full promote-then-rollback cycle has been demonstrated and the
evidence ids are recorded here.
Done 2026-08-16 on railiance01, isolated release `flex-auth-canary` only.
Production pins were not moved.
| Step | Result | Evidence |
| --- | --- | --- |
| Approval | isolated-canary-only | progress `6b07bee3-0fd6-4b08-bb06-5dddac4130d9` |
| `stage deploy` apply | Helm rev 1, deploy 1/1 | stage2-deploy-result status `applied` |
| `stage observe` live | rollout/pods passed; metrics optional unavailable | stage2-observe-result status `passed` |
| Canary `/healthz` | 200 `{"status":"ok"}` | port-forward 19101 |
| Canary `me.read` | allow / `self_service` | `decision:27cbab2e5533508a` |
| `stage promote` apply | Helm rev 2 | stage3-promote-result status `applied` |
| `stage rollback` apply `--revision 1` | Helm rev 3 "Rollback to 1" | stage3-rollback-result status `applied` |
| Cleanup | `helm uninstall flex-auth-canary` | production deploys unchanged |
Previous stable recorded before promote:
`flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
`flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa`
Candidate image: `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`.
## T03 - Correct the stale drain-plan row
```task
id: FLEX-WP-0011-T03
status: todo
status: wait
priority: low
state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
```
@ -122,3 +162,9 @@ whether wave 7 can be closed.
Done when the row reflects reality or a custodian decision id explains why it
stands.
Raised 2026-08-16 with `the-custodian` (message
`7219e675-fd39-42ca-a302-8722a895531d`). Confirmed the same day:
railiance01 namespace `flex-auth` is Active (7d+); coulombcore has k3s
but no `flex-auth` namespace and no flex-auth Deployments. Wave 7.3 has
nothing left to drain. T03 waits on the canon edit or a decision id.