From f906d26807c8b3db7ed11744a0f07924b1b6366d Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Sun, 26 Jul 2026 14:14:26 +0200
Subject: [PATCH] Add generic Knative service contract

---
 examples/service.yaml                         |  30 ++++++++++++++++++
 ...test_contract.cpython-312-pytest-7.4.4.pyc | Bin 0 -> 6785 bytes
 tests/test_contract.py                        |  23 ++++++++++++++
 ...-KNATIVE-WP-0001-bootstrap-derived-rail.md |  11 +++++--
 4 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 examples/service.yaml
 create mode 100644 tests/__pycache__/test_contract.cpython-312-pytest-7.4.4.pyc
 create mode 100644 tests/test_contract.py

diff --git a/examples/service.yaml b/examples/service.yaml
new file mode 100644
index 0000000..123fe16
--- /dev/null
+++ b/examples/service.yaml
@@ -0,0 +1,30 @@
+apiVersion: serving.knative.dev/v1
+kind: Service
+metadata:
+  name: example-workload
+  namespace: example-workload
+  annotations:
+    serving.knative.dev/visibility: cluster-local
+spec:
+  template:
+    metadata:
+      annotations:
+        autoscaling.knative.dev/min-scale: "0"
+        autoscaling.knative.dev/max-scale: "3"
+        autoscaling.knative.dev/target: "4"
+    spec:
+      containerConcurrency: 4
+      timeoutSeconds: 30
+      containers:
+        - image: registry.example.invalid/workload@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+          ports:
+            - containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /healthz
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+  traffic:
+    - latestRevision: true
+      percent: 100
diff --git a/tests/__pycache__/test_contract.cpython-312-pytest-7.4.4.pyc b/tests/__pycache__/test_contract.cpython-312-pytest-7.4.4.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..093e66e50811949fff9a4c689d00ca66b4b5638f
GIT binary patch
literal 6785
zcmd^E&2JmW72jPhx%?1GQL-G%u^ifI60?OV>f35<#;MiVs8PA-M+yin7HiH*T6wu-
zXIHYsE(;;`p+O4Nr`QJ{dNqvx9}RMe>bfkp1&E@T8od+|P&7LAz1badX%V3WBq)Lm
zcHeyP&D)tbZ{Gag@S}7(DL}gTslM@th#>p}D?CA+rF{#s2Lcg@XbLML%cW|hB8fs(
zUWtnMi)6;C%8J6uq8VR_OM<TGi6^2jV&jCLhbf7SLv<xZ<a@%(5Qzd!lNiv<j#yBh
zBkOWO^yKer&iZqdQ^6*lWGLVO_um2XKyZQ&3BrcNS-QD{+$<5Xkpdot*Sq<XpvZ^(
zL!lroAB^eSTD5NK_N1-TEu*3rceJWmkUbf5FJWt|x@y)m;>ka_b?Zl7g6bMk9evw*
zEbODigVN-Bt*TGntx>zOK1nshym-gb9AitLbadOX8C5Ga%b{AuDb{y9CHNH0K>rxL
zb{@#C@V8X<x8?WBk7hqUzqt4EV(awM-sz>Mr{8{>y8f|zoelw0kBV?*nTr0D=v5J)
zYEy7wO>q^PB9WSsE4tF13s8%=5!-aIFH0L8_3;)#Ai%RK5*hofN>2igP#+xl3&|C^
zatH89oR35wNez(Hlu3*zu55^`7Ik1oehNuqmdxAz+>LTcJbxGLcUx?V@J3+90*T}N
zNrKU2po`R3R2M@`3u&f>m>cWSO(xJy_A9BIUR?|`T_{ePTbrwJ`)W!g*NnT88^5yz
zcAIb$_J<)G?YEOg+yv~TQS8&*N#ul+<<d8Xd8wQ8J-j8@<01JYT@GGy&@r&Y$4J9H
z`s~xgJuDH%)Aa{^`gAogfUmQ+2k^!DXvx?kneF-{IZ0k}lYtLN9oYw@xFntjK0pB<
zAi<k}^@<VS_D=;?o(rrT*YGIbaD;io@h`VGB&VBVM-wljCP<FaGfXS&eAqggJ|>tx
z&VI@D@d})a`R0(*K`-tQ!UwRI_{Pa#Q-!i-S`yqe-<i#fo7p%O`Z*{zv%r<@a1Dcw
zhPU7}awGReI~v**{d~narq}b>r|T<1efsUp&Z$dY{oH&?M<aYs4fH98dVo)Pb->7n
zxby*h=_B%Gj>wliBHu9QBVT)@Fdvm8uaVc?T;QWdj_jjGxFnv3aSHgTA$a5Prs2)N
zn{5v72!%J6y`)w*-qERT)U3uy1{|%mVgN9UMBkd+ntCiANLQ{D#Ky>L7wS7x1v`J`
zN*;@|1-l@55okj)+sJ4(NO0J1^936l=e>AUcQm3onwQcntL6Z7tyy;CY~ODgwsG4q
z4QHp3u9%y)qtlCKt)iKpY}fUQ7k6|3)0(3<&S{%Y&4yo$7lvCktc%#Ldt&J`xU_Ab
ziz3=DhzDXB<~JEkD*20`koV_VD%cmWWg6z2Z05^sf(tl7!*U+WIL{K2X^KXQrG<mA
zE*5=VEP5vprfY_!(`z-WvPr3KRd(RRIh2ly^+khT8}Y05x;8yG|4lF1>12CRqpGdx
z5Y<SA6<!d-;tS$Me-7WMQQXKduNY`N&v@_iZ}=^Ye+s_jPZmqTY^PwFK_irSBj_M#
zgi_FWiMK%knwXAepg75d&w;jzop2`Eya2i@nzg$+^~)47ctN3~fzD=7adSv6c`~S@
z#OO4mvyE)Xwx-aykY&D*W<idZyjtJEXh_wlms4T+O_l0(TB%j*8r8joig6aUc$v4D
zje-q+hteALM%C3Ct!j>{Z-ZrFU{$l|8646O$W(7{8m41dwijb|XnUtrd%d=45++|=
zGi$dsQ?<0J&Za{#hVY_nmW5GIHo#!L6bkZ(UkX=d!j);i;tysnTv?!adWLzY!j<`O
zrKjU1e+s@xP-kcyv*F4@xU%SX@`pP$)l-}45jfXVTd;8*^M?~fkn4@J)nU=@nhy4F
zR8$_N-h|)L6zqRN431Ii$oq@COKo|vb)2UytF7Za&t&y4+0pxNzvn*u?q2qd-5YIr
zrFER=nY_}Lf7<$Dp0>QuI?nS)d7&*|YaR1x%ge3*-*foF0dG~<g+m^oOZZNPgB|~}
zfk+Ha3f)8975K3SfD6O&@I}OboG8d;X`>Ikfh!2Sh=}$=O%m%Ky&HWl2Kb0r_|%o(
z36=O41;OduC-E@?)amxXJDL~L;T`~WVnjOfh{i(l`;4foEgI(RGm<VRj6e!W?Z?}J
zi39jL0US|+z)U7_k_cVS<hVjYlKKRugDz)C@*Z4JEeU+BnlWdLOLk*?HJS=Z0U%c(
z;Kr*f$(11B?ygUNi;=)$hOkc;M3eN9*C)LGeb%QNF7Po9w3vS2I31crzxC>9U;tm|
zYGMFiH{i|$>zW{0GVCS{|I#h#9CcljeBL|{z-$bFD+{`taR9HmWs1>}r@+PM>Z(zp
z81GR01|Xvnq8-2@K4w8s(hKDPY$22jfGh*6rfwBvdKQJ?QAP_$&|rFSEkGUm4QQ-%
zE{vgqPHP6<{nvrq6hv@duJAKB)F2*)`$BYAABYb`QTR<t7IwtnNA8LMoRzvxE4t+@
z(-bg3gH$YeF-N0ox?`i)$miMNd62k_XXbXDmK!B@js`PU4O=BTfMfu@hV2-Y;$<JD
zl#87nFM%8zjqIPoe|LqJTz)2(KebU+?`Cu2a{>jft_~RNV!;=XZ=fy)eeKOEoq*o-
z9Fp@WC&j=RUB-qIk|`u}Nam3&Aelyj%A&JKehdUUeh<r+k-UXu2}v1<4^4asvq;~>
z=5Hanisai!t^u)8fg$MOV~&Z>)D`^+^uc{&KLrA~BQy5C@i4ZRdF6MBz0B8lueaqh
ztuOv*%Vk)U&;9wcTxREMA?w9ChGi?^jjKLXF8UA;;4XmlyA+VBm*_NkO3=pE5iAw{
zLotop6b+r?G3~`wb=5F+RmC46j&W=s0Hdd&H<6%znPszq_?8^MT&<B!Q!i5$e#I?h
zqj~&0B8p;L5bg=jgj0VNQh!%czrOLSU$&HqJ!Rsdwx{HG<xgZ$ydi!PONh6`{gV;#
HO(yn#4Cf1g

literal 0
HcmV?d00001

diff --git a/tests/test_contract.py b/tests/test_contract.py
new file mode 100644
index 0000000..6443e16
--- /dev/null
+++ b/tests/test_contract.py
@@ -0,0 +1,23 @@
+from pathlib import Path
+import yaml
+
+ROOT = Path(__file__).parents[1]
+
+def service():
+    return yaml.safe_load((ROOT / "examples/service.yaml").read_text())
+
+def test_safe_generic_service():
+    item = service()
+    assert item["apiVersion"] == "serving.knative.dev/v1"
+    assert item["metadata"]["annotations"]["serving.knative.dev/visibility"] == "cluster-local"
+    template = item["spec"]["template"]
+    assert template["metadata"]["annotations"]["autoscaling.knative.dev/min-scale"] == "0"
+    assert int(template["metadata"]["annotations"]["autoscaling.knative.dev/max-scale"]) > 0
+    assert template["spec"]["containerConcurrency"] > 0
+    assert "@sha256:" in template["spec"]["containers"][0]["image"]
+    assert "qonto" not in (ROOT / "examples/service.yaml").read_text().lower()
+
+def test_traffic_is_deterministic():
+    traffic = service()["spec"]["traffic"]
+    assert len(traffic) == 1
+    assert sum(target["percent"] for target in traffic) == 100
diff --git a/workplans/RAIL-KNATIVE-WP-0001-bootstrap-derived-rail.md b/workplans/RAIL-KNATIVE-WP-0001-bootstrap-derived-rail.md
index 9ba7b19..ed55f86 100644
--- a/workplans/RAIL-KNATIVE-WP-0001-bootstrap-derived-rail.md
+++ b/workplans/RAIL-KNATIVE-WP-0001-bootstrap-derived-rail.md
@@ -42,7 +42,7 @@ Validate against `rail-kubernetes/schemas/derived-rail-v1.schema.json`.
 
 ```task
 id: RAIL-KNATIVE-WP-0001-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "ffad44ca-394b-4092-90d7-fb9a070374c6"
 ```
@@ -50,14 +50,21 @@ state_hub_task_id: "ffad44ca-394b-4092-90d7-fb9a070374c6"
 Add generic Service, revision, traffic, scale, cold-start, and rollback
 artifacts without Qonto-specific content.
 
+2026-07-26: Added a cluster-local, digest-pinned generic Service example with
+bounded concurrency, scale-to-zero, maximum scale, health, resources, traffic,
+and offline tests. Live revision rollback remains an admission evidence gate.
+
 ## T04 - Register and reconcile
 
 ```task
 id: RAIL-KNATIVE-WP-0001-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "e3ca4415-f1c7-4839-bc13-b17f6497f71c"
 ```
 
 Register in State Hub and Fabric, publish the base-rail relation, then create
 and push the remote repository through an autonomous sanctioned lane.
+
+2026-07-26: Registered and reconciled the repository, published its base-rail
+relation through Fabric, and pushed the Forgejo remote.