Add Railiance staged-promotion overlay for flex-auth

FLEX-WP-0011 T01/T02: railiance.app.v1 contract, independently pinned Helm values for tenant-engine and user-engine, isolated canary cycle (deploy/observe/promote/rollback), and emergency kubectl path retained. T03 waits on the custodian drain-plan row.
2026-08-16 01:32:31 +02:00 · 2026-08-16 01:32:31 +02:00 · 1d58f13eb8
commit 1d58f13eb8
parent 804251514c
19 changed files with 634 additions and 14 deletions
--- a/15
+++ b/15
@ -4,7 +4,7 @@ PKG     := ./...
 VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo 0.0.0-dev)
 LDFLAGS := -X main.version=$(VERSION)

-.PHONY: all build test vet lint fmt tidy sbom clean ci
+.PHONY: all build test vet lint fmt tidy sbom clean ci overlay-render overlay-dry-run

 all: vet lint test build

@ -56,4 +56,15 @@ sbom:
 clean:
 	rm -rf $(BIN_DIR)

-ci: vet lint test build
+ci: vet lint test build overlay-render
+
+overlay-render:
+	@tests/stage1.sh
+
+overlay-dry-run:
+	@test -n "$$KUBECONFIG" || { echo "set KUBECONFIG to the railiance01 kubeconfig"; exit 1; }
+	@for values in values/stage2-canary.yaml values/user-engine.yaml values/tenant-engine.yaml; do \
+		echo "server-dry-run $$values"; \
+		helm template flex-auth charts/flex-auth -f "$$values" --namespace flex-auth \
+		  | kubectl apply --dry-run=server --server-side -f -; \
+	done
--- a/charts/flex-auth/Chart.yaml
+++ b/charts/flex-auth/Chart.yaml
@ -0,0 +1,6 @@
+apiVersion: v2
+name: flex-auth
+description: Independently rollable flex-auth policy-decision Deployment (one consumer per release).
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
--- a/charts/flex-auth/templates/_helpers.tpl
+++ b/charts/flex-auth/templates/_helpers.tpl
@ -0,0 +1,20 @@
+{{- define "flex-auth.image" -}}
+{{- if not .Values.image.digest }}
+{{- fail "image.digest is required (digest_policy=required); do not deploy by tag" }}
+{{- end }}
+{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}}
+{{- end -}}
+
+{{- define "flex-auth.name" -}}
+{{- required "name is required" .Values.name -}}
+{{- end -}}
+
+{{- define "flex-auth.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "flex-auth.name" . }}
+{{- end -}}
+
+{{- define "flex-auth.labels" -}}
+{{ include "flex-auth.selectorLabels" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/part-of: flex-auth
+{{- end -}}
--- a/charts/flex-auth/templates/deployment.yaml
+++ b/charts/flex-auth/templates/deployment.yaml
@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "flex-auth.labels" . | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: flex-auth
+          image: {{ include "flex-auth.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            {{- toYaml .Values.args | nindent 12 }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+          livenessProbe:
+            httpGet:
+              path: {{ .Values.health.path }}
+              port: http
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: {{ .Values.health.path }}
+              port: http
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
--- a/charts/flex-auth/templates/networkpolicy.yaml
+++ b/charts/flex-auth/templates/networkpolicy.yaml
@ -0,0 +1,29 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      {{- include "flex-auth.selectorLabels" . | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  egress: []
+  {{- if .Values.consumer.isolated }}
+  ingress: []
+  {{- else }}
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ required "consumer.namespace is required when not isolated" .Values.consumer.namespace }}
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: {{ required "consumer.podName is required when not isolated" .Values.consumer.podName }}
+      ports:
+        - port: {{ .Values.service.port }}
+          protocol: TCP
+  {{- end }}
--- a/charts/flex-auth/templates/service.yaml
+++ b/charts/flex-auth/templates/service.yaml
@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "flex-auth.name" . }}
+  labels:
+    {{- include "flex-auth.labels" . | nindent 4 }}
+spec:
+  selector:
+    {{- include "flex-auth.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
--- a/charts/flex-auth/values.yaml
+++ b/charts/flex-auth/values.yaml
@ -0,0 +1,38 @@
+# Default chart values. Real pins live in values/*.yaml — never promote a tag.
+name: flex-auth
+namespace: flex-auth
+
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: ""
+  pullPolicy: IfNotPresent
+
+replicaCount: 1
+
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+
+service:
+  port: 8080
+
+health:
+  path: /healthz
+
+consumer:
+  isolated: false
+  namespace: ""
+  podName: ""
+
+resources:
+  requests:
+    cpu: 25m
+    memory: 32Mi
+  limits:
+    cpu: 300m
+    memory: 192Mi
--- a/deploy/README.md
+++ b/deploy/README.md
@ -1,10 +1,13 @@
 # flex-auth production deployment

+The sanctioned promotion path is the Railiance overlay in
+[`../railiance/`](../railiance/README.md) (`railiance/app.toml`,
+`charts/flex-auth`, `values/*.yaml`). These flattened files are the
+emergency kubectl path recovered on 2026-08-11 from live
+`last-applied-configuration`, kept so a rollback does not depend on a
+cluster annotation or on Helm history.
+
 Manifests for the two cluster-local flex-auth policy-decision services.
-Both were previously applied with `kubectl apply` from a file that lived
-outside this repo; these were recovered from the live objects'
-`kubectl.kubernetes.io/last-applied-configuration` on 2026-08-11 and
-committed so that a rollback does not depend on a cluster annotation.

 | File | Deployment | Consumer | Service DNS |
 | --- | --- | --- | --- |
@ -83,8 +86,8 @@ last-known-good digest below.

 | Deployment | Last-known-good digest | Policy state |
 | --- | --- | --- |
-| `flex-auth-tenant-engine` | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | **current** — seven-action policy, FLEX-WP-0010, CI-built from `e9911eb`, live 2026-08-11 |
-| `flex-auth-tenant-engine` *(previous)* | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | four-action policy, pre-FLEX-WP-0010 (lifecycle actions deny `unknown_action`) |
+| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; `tenant.retire`/`update`/`reactivate` deny `unknown_action` |
+| `flex-auth-tenant-engine` *(FLEX-WP-0010)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, CI-built from `e9911eb`; ReplicaSet present but scaled to 0 |
 | `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | **current** — FLEX-WP-0009-T04, nine fixtures (incl. registration-applicant) verified live 2026-08-16 |
 | `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures verified live 2026-08-10 |

--- a/deploy/flex-auth-tenant-engine.yaml
+++ b/deploy/flex-auth-tenant-engine.yaml
@ -23,7 +23,7 @@ spec:
        - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
        - --policy
        - /opt/flex-auth/examples/tenant-engine/policy_package.md
-        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7
+        image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
        livenessProbe:
          httpGet:
            path: /healthz
--- a/railiance/README.md
+++ b/railiance/README.md
@ -0,0 +1,82 @@
+# flex-auth Railiance overlay
+
+Canonical staged-promotion contract for flex-auth (`RAIL-BS-WP-0006`,
+`FLEX-WP-0011`). The recovered `deploy/*.yaml` files remain as an emergency
+kubectl path; this overlay is the sanctioned shape.
+
+## Layout
+
+| Path | Role |
+| --- | --- |
+| `railiance/app.toml` | `railiance.app.v1` contract |
+| `charts/flex-auth/` | One Deployment + Service + NetworkPolicy per release |
+| `values/tenant-engine.yaml` | Production pin for `flex-auth-tenant-engine` |
+| `values/user-engine.yaml` | Production pin for `flex-auth-user-engine` |
+| `values/stage2-canary.yaml` | Isolated canary `flex-auth-canary` (no consumer ingress) |
+| `values/stage3-production.yaml` | Stage 3 values for that same isolated canary release |
+| `tests/stage1.sh` | Local render of every values file |
+
+The two production consumers stay independently pinned and independently
+rollable. Do not collapse them into one Helm release. The official
+`bin/railiance deploy|observe|promote|rollback` cycle operates on the
+**isolated canary** so it cannot move a production pin by accident.
+
+## Stage 1
+
+```bash
+tests/stage1.sh
+# or
+/home/worsch/railiance-bootstrap/bin/railiance run . --pretty
+```
+
+## Stage 2 / Stage 3 (isolated canary)
+
+```bash
+RAILIANCE=/home/worsch/railiance-bootstrap/bin/railiance
+$RAILIANCE deploy --stage 2 . --plan
+$RAILIANCE deploy --stage 2 . --server-dry-run --pretty
+$RAILIANCE deploy --stage 2 . --apply --approval-id <state-hub-id>
+$RAILIANCE observe --stage 2 . --live --pretty
+$RAILIANCE promote . --plan
+$RAILIANCE promote . --apply --approval-id <state-hub-id>
+$RAILIANCE rollback . --apply --approval-id <state-hub-id> --revision <helm-rev>
+```
+
+The canary Service is `flex-auth-canary.flex-auth.svc.cluster.local:8080`.
+Production consumers keep calling their own Service names.
+
+## Rolling a production pin
+
+Policy is baked into the image. Do not build images on a workstation.
+`.forgejo/workflows/image.yaml` publishes `:latest` and `:main-<short-sha>`;
+deploy by digest.
+
+```bash
+# 1. Edit the digest in values/<consumer>.yaml
+# 2. Record the previous digest as the rollback target
+# 3. Apply only that release
+helm upgrade --install flex-auth-<consumer> charts/flex-auth \
+  --namespace flex-auth -f values/<consumer>.yaml --wait --timeout 2m
+
+# 4. Prove the new policy, not just that the pod started
+kubectl -n flex-auth port-forward svc/flex-auth-<consumer> 19099:8080
+curl -s -X POST http://127.0.0.1:19099/v1/check \
+  -H 'Content-Type: application/json' \
+  -d @examples/<consumer>/<request that exercises the change>.json
+```
+
+Emergency kubectl path (no Helm history): `kubectl apply -f deploy/flex-auth-<consumer>.yaml`.
+
+## Rollback
+
+Preferred: `helm rollback flex-auth-<consumer> <revision> -n flex-auth --wait`.
+
+If Helm history is missing: `kubectl -n flex-auth rollout undo deploy/flex-auth-<consumer>`,
+or re-apply the last-known-good digest in `deploy/README.md`.
+
+| Deployment | Last-known-good digest | Policy state |
+| --- | --- | --- |
+| `flex-auth-tenant-engine` | `sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa` | **live 2026-08-16** — four-action policy; lifecycle actions deny `unknown_action` |
+| `flex-auth-tenant-engine` *(FLEX-WP-0010 image, scaled to 0)* | `sha256:9320df394a642eff24da8af4a0ee8886a7bb78b0f14d8ee1deeb30ea8eeeaba7` | seven-action policy, previously live 2026-08-11 |
+| `flex-auth-user-engine` | `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4` | FLEX-WP-0009-T04, nine fixtures, live 2026-08-16 |
+| `flex-auth-user-engine` *(previous)* | `sha256:a31961c45215aa6baf3bc748c6741ab703c2c8325e61aa7983a355026195e51b` | FLEX-WP-0009-T03, six fixtures |
--- a/railiance/app.toml
+++ b/railiance/app.toml
@ -0,0 +1,188 @@
+schema_version = "railiance.app.v1"
+
+[app]
+id = "flex-auth"
+name = "flex-auth"
+repo = "flex-auth"
+owner = "platform-security"
+criticality = "high"
+description = "Policy-as-code authorization PDP. Two independently pinned production Deployments (tenant-engine, user-engine). Outage fails closed: consumers receive deny/403 rather than an unauthorized allow, but write paths block."
+
+[source]
+revision = "git:main"
+artifact = "image"
+digest_policy = "required"
+
+[rollback]
+strategy = "helm-revision"
+command = "helm rollback <release> <revision> --namespace flex-auth --wait"
+verification = "Both Services' /healthz return 200 and the rolled-back Deployment image digest matches the recorded previous_stable pin."
+
+[[platform.dependencies]]
+name = "railiance01-k3s"
+kind = "network"
+required = true
+stage = "stage2"
+evidence = "kubectl -n flex-auth get ns reports Active on railiance01."
+
+[[platform.dependencies]]
+name = "forgejo-oci"
+kind = "other"
+required = true
+stage = "stage2"
+evidence = "Image forgejo.coulomb.social/coulomb/flex-auth is pullable by digest."
+
+[secrets]
+references = []
+
+[[observability.health_endpoints]]
+name = "local-health"
+url = "http://127.0.0.1:8080/healthz"
+stage = "stage1"
+expected_status = 200
+
+[[observability.health_endpoints]]
+name = "tenant-engine-health"
+url = "http://flex-auth-tenant-engine.flex-auth.svc.cluster.local:8080/healthz"
+stage = "stage2"
+expected_status = 200
+
+[[observability.health_endpoints]]
+name = "user-engine-health"
+url = "http://flex-auth-user-engine.flex-auth.svc.cluster.local:8080/healthz"
+stage = "stage2"
+expected_status = 200
+
+[[observability.health_endpoints]]
+name = "canary-health"
+url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
+stage = "stage2"
+expected_status = 200
+
+[[observability.logs]]
+name = "canary-pods"
+reference = "kubectl -n flex-auth logs deploy/flex-auth-canary --tail=50"
+stage = "stage2"
+
+[stages.stage1]
+enabled = true
+namespace = "local"
+release = "flex-auth-local"
+commands = ["make test", "tests/stage1.sh"]
+checks = ["unit-tests", "helm-template", "contract-schema"]
+evidence = ["go test output", "helm template of tenant-engine, user-engine, and canary values", "app.toml schema validation"]
+requires_approval = false
+
+[stages.stage2]
+enabled = true
+namespace = "flex-auth"
+release = "flex-auth-canary"
+commands = ["bin/railiance deploy --stage 2 . --plan", "bin/railiance observe --stage 2 . --plan"]
+checks = ["server-dry-run", "canary-ready", "canary-health", "operator-approval"]
+evidence = ["isolated canary release name", "pod Available", "canary /healthz 200", "State Hub approval id"]
+requires_approval = true
+canary_mode = "isolated"
+observation_minutes = 15
+
+[stages.stage3]
+enabled = true
+namespace = "flex-auth"
+release = "flex-auth-canary"
+commands = ["bin/railiance promote . --plan", "bin/railiance rollback . --plan"]
+checks = ["stage2-accepted", "rollback-target", "operator-approval"]
+evidence = ["promotion command id", "recorded previous_stable digests", "post-promotion canary /healthz 200"]
+requires_approval = true
+promotion_mode = "release-replace"
+previous_stable = "flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4;flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa"
+
+[[checks]]
+id = "unit-tests"
+type = "command"
+stage = "stage1"
+description = "Run repository Go tests."
+required = true
+run = "make test"
+timeout_seconds = 600
+
+[[checks]]
+id = "helm-template"
+type = "helm"
+stage = "stage1"
+description = "Render the isolated canary chart locally."
+required = true
+chart = "charts/flex-auth"
+values = "values/stage2-canary.yaml"
+mode = "template"
+
+[[checks]]
+id = "contract-schema"
+type = "command"
+stage = "stage1"
+description = "Validate railiance/app.toml against railiance.app.v1."
+required = true
+run = "python3 tests/validate_app_toml.py"
+timeout_seconds = 60
+
+[[checks]]
+id = "local-health"
+type = "http"
+stage = "stage1"
+description = "Confirm a locally served flex-auth /healthz when one is running."
+required = false
+url = "http://127.0.0.1:8080/healthz"
+expected_status = 200
+timeout_seconds = 10
+
+[[checks]]
+id = "server-dry-run"
+type = "helm"
+stage = "stage2"
+description = "Server-side dry run of the isolated canary before apply."
+required = true
+chart = "charts/flex-auth"
+values = "values/stage2-canary.yaml"
+mode = "server-dry-run"
+
+[[checks]]
+id = "canary-ready"
+type = "kubernetes"
+stage = "stage2"
+description = "Isolated canary Deployment reaches Available."
+required = true
+namespace = "flex-auth"
+resource = "deploy/flex-auth-canary"
+condition = "Available"
+
+[[checks]]
+id = "canary-health"
+type = "http"
+stage = "stage2"
+description = "Isolated canary Service /healthz returns 200."
+required = true
+url = "http://flex-auth-canary.flex-auth.svc.cluster.local:8080/healthz"
+expected_status = 200
+timeout_seconds = 10
+
+[[checks]]
+id = "operator-approval"
+type = "manual"
+stage = "stage2"
+description = "Human approval recorded before the isolated canary is applied and before any production pin is moved."
+required = true
+evidence_required = "State Hub approval note id, candidate digest, rollback target (both production pins)."
+
+[[checks]]
+id = "stage2-accepted"
+type = "manual"
+stage = "stage3"
+description = "Stage 2 gates passed for the same candidate artifact."
+required = true
+evidence_required = "State Hub Stage 2 acceptance progress id."
+
+[[checks]]
+id = "rollback-target"
+type = "manual"
+stage = "stage3"
+description = "Previous stable digest of each independently rollable Deployment is recorded before promotion."
+required = true
+evidence_required = "flex-auth-user-engine and flex-auth-tenant-engine image digests."
--- a/tests/stage1.sh
+++ b/tests/stage1.sh
@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Stage 1 overlay render: contract + helm template of every independently
+# rollable values file. Does not contact the cluster.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+python3 tests/validate_app_toml.py
+
+for values in values/stage1.yaml values/stage2-canary.yaml values/stage3-production.yaml \
+              values/user-engine.yaml values/tenant-engine.yaml; do
+  echo "helm template ${values}"
+  helm template flex-auth charts/flex-auth -f "${values}" --namespace flex-auth >/dev/null
+done
+
+echo "stage1 overlay render ok"
--- a/tests/validate_app_toml.py
+++ b/tests/validate_app_toml.py
@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Validate railiance/app.toml against the railiance.app.v1 schema."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CONTRACT = ROOT / "railiance" / "app.toml"
+SCHEMA_CANDIDATES = [
+    Path.home() / "railiance-bootstrap" / "schemas" / "railiance-app.schema.json",
+    Path.home() / "railiance-cluster" / "schemas" / "railiance-app.schema.json",
+]
+
+
+def main() -> int:
+    schema_path = next((path for path in SCHEMA_CANDIDATES if path.exists()), None)
+    if schema_path is None:
+        print("railiance-app.schema.json not found in railiance-bootstrap or railiance-cluster", file=sys.stderr)
+        return 1
+    try:
+        import jsonschema
+    except ImportError:
+        print("python3-jsonschema is required to validate railiance/app.toml", file=sys.stderr)
+        return 1
+
+    document = tomllib.loads(CONTRACT.read_text())
+    schema = json.loads(schema_path.read_text())
+    jsonschema.validate(document, schema)
+    print(f"valid {CONTRACT.relative_to(ROOT)} against {schema_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/values/stage1.yaml
+++ b/values/stage1.yaml
@ -0,0 +1,15 @@
+# Local render-only values. Same isolated shape as the canary; no cluster apply.
+name: flex-auth-local
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true
--- a/values/stage2-canary.yaml
+++ b/values/stage2-canary.yaml
@ -0,0 +1,16 @@
+# Isolated canary. Distinct Service name so production consumers never see it.
+# NetworkPolicy admits no ingress. Roll independently of the two production pins.
+name: flex-auth-canary
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true
--- a/values/stage3-production.yaml
+++ b/values/stage3-production.yaml
@ -0,0 +1,18 @@
+# Stage 3 values for the isolated canary release (flex-auth-canary).
+# Promoting this release does not move the production consumer pins.
+# Production pins live in values/user-engine.yaml and values/tenant-engine.yaml
+# and must be rolled independently.
+name: flex-auth-canary
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: true
--- a/values/tenant-engine.yaml
+++ b/values/tenant-engine.yaml
@ -0,0 +1,17 @@
+# Production pin for the tenant-engine policy service. Independently rollable.
+name: flex-auth-tenant-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/tenant-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: tenant-engine
+  podName: tenant-engine
--- a/values/user-engine.yaml
+++ b/values/user-engine.yaml
@ -0,0 +1,17 @@
+# Production pin for the user-engine policy service. Independently rollable.
+name: flex-auth-user-engine
+image:
+  repository: forgejo.coulomb.social/coulomb/flex-auth
+  digest: sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4
+args:
+  - serve
+  - --addr
+  - 0.0.0.0:8080
+  - --registry
+  - /opt/flex-auth/examples/user-engine/registry_snapshot.json
+  - --policy
+  - /opt/flex-auth/examples/user-engine/policy_package.md
+consumer:
+  isolated: false
+  namespace: user-engine
+  podName: user-engine
--- a/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
+++ b/workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
@ -4,7 +4,7 @@ type: workplan
 title: "Bring flex-auth under the railiance staged-promotion contract"
 domain: infotech
 repo: flex-auth
-status: proposed
+status: active
 owner: codex
 topic_slug: netkingdom
 planning_priority: P2
@ -14,7 +14,7 @@ depends_on_workplans:
 related_workplans:
  - RAIL-BS-WP-0006
 created: "2026-08-11"
-updated: "2026-08-11"
+updated: "2026-08-16"
 state_hub_workstream_id: "b17c3296-f8ae-4f61-bcf7-41ac80bacd47"
 ---

@ -61,7 +61,7 @@ policy rollouts.

 ```task
 id: FLEX-WP-0011-T01
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "edc7fee5-b78d-4a5c-a773-42c5b39d0019"
 ```
@ -84,11 +84,31 @@ rollback runbook content rather than discarding it.
 Done when the overlay renders and a server-side dry run of the full manifest
 set is accepted.

+Done 2026-08-16: `railiance/app.toml` validates against `railiance.app.v1`
+(`criticality = high`, `digest_policy = required`, both production
+`/healthz` endpoints plus isolated canary). One chart, three independently
+rollable values files (`values/tenant-engine.yaml`,
+`values/user-engine.yaml`, `values/stage2-canary.yaml`).
+`tests/stage1.sh` renders all five values files. `bin/railiance run .`
+passed (stage1 result `/tmp/flex-auth-stage1-result.json`). Server-side
+dry run of canary + both production pins accepted (`kubectl apply
+--dry-run=server --server-side` and `helm upgrade --dry-run=server` for
+the canary). `deploy/README.md` kept as the emergency kubectl path and
+points at the overlay.
+
+Live discovery while pinning values: `flex-auth-tenant-engine` is back on
+`sha256:c25fc34a…` (four-action policy). `tenant.retire` /
+`tenant.update` / `tenant.reactivate` deny `unknown_action`. The
+FLEX-WP-0010 image `sha256:9320df39…` is a ReplicaSet at desired=0.
+Overlay pins match live; tenant-engine was notified
+(`50a48026-a75b-4b1f-97f6-7c60063a30b8`). This workplan does not
+re-promote that image.
+
 ## T02 - Prove the stage commands

 ```task
 id: FLEX-WP-0011-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "5283bc1f-88c3-431b-a9ea-4a900a3e5885"
 ```
@ -101,11 +121,31 @@ target before promoting.
 Done when a full promote-then-rollback cycle has been demonstrated and the
 evidence ids are recorded here.

+Done 2026-08-16 on railiance01, isolated release `flex-auth-canary` only.
+Production pins were not moved.
+
+| Step | Result | Evidence |
+| --- | --- | --- |
+| Approval | isolated-canary-only | progress `6b07bee3-0fd6-4b08-bb06-5dddac4130d9` |
+| `stage deploy` apply | Helm rev 1, deploy 1/1 | stage2-deploy-result status `applied` |
+| `stage observe` live | rollout/pods passed; metrics optional unavailable | stage2-observe-result status `passed` |
+| Canary `/healthz` | 200 `{"status":"ok"}` | port-forward 19101 |
+| Canary `me.read` | allow / `self_service` | `decision:27cbab2e5533508a` |
+| `stage promote` apply | Helm rev 2 | stage3-promote-result status `applied` |
+| `stage rollback` apply `--revision 1` | Helm rev 3 "Rollback to 1" | stage3-rollback-result status `applied` |
+| Cleanup | `helm uninstall flex-auth-canary` | production deploys unchanged |
+
+Previous stable recorded before promote:
+`flex-auth-user-engine@sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`
+`flex-auth-tenant-engine@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa`
+
+Candidate image: `sha256:1f5290376dc5fcf456dc7a785e394d8b90949dabecd1d3e856f38557149bb5f4`.
+
 ## T03 - Correct the stale drain-plan row

 ```task
 id: FLEX-WP-0011-T03
-status: todo
+status: wait
 priority: low
 state_hub_task_id: "bebd6ed9-9145-4fc0-bdc8-cac669643c62"
 ```
@ -122,3 +162,9 @@ whether wave 7 can be closed.

 Done when the row reflects reality or a custodian decision id explains why it
 stands.
+
+Raised 2026-08-16 with `the-custodian` (message
+`7219e675-fd39-42ca-a302-8722a895531d`). Confirmed the same day:
+railiance01 namespace `flex-auth` is Active (7d+); coulombcore has k3s
+but no `flex-auth` namespace and no flex-auth Deployments. Wave 7.3 has
+nothing left to drain. T03 waits on the canon edit or a decision id.