railiance-apps/workplans/RAPPS-WP-0003-policy-nexus-production-binding.md

---
id: RAPPS-WP-0003
type: workplan
title: "Bind and deploy the permanent policy surface"
domain: financials
repo: railiance-apps
status: finished
owner: the-custodian
topic_slug: railiance
created: "2026-08-18"
updated: "2026-08-18"
related:
  - POLICY-NEXUS-WP-0001
  - RAPP-POLICY-NEXUS-WP-0001
  - REEF-RAILIANCE-WP-0004
state_hub_workstream_id: "668fbb2e-1060-57dd-b499-ff2e1a265a23"
---

# RAPPS-WP-0003 — policy-nexus production binding

## Goal

Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
`https://policy.coulomb.social` without duplicating policy content or its rApp
chart in the S5 repository.

## Establish the S5 release boundary

```task
id: RAPPS-WP-0003-T01
status: done
priority: high
state_hub_task_id: "11e4292b-6c30-58bf-9478-2097063cbb57"
```

The production binding, guarded delegating Make targets, and runbook are
present. `policy-nexus` owns content/image creation;
`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
selection and production approval.

## Record the first immutable release

```task
id: RAPPS-WP-0003-T02
status: done
priority: high
state_hub_task_id: "54b23078-231a-5f99-8736-fe57b7f3c0cb"
```

Publish a clean-source image, resolve its registry OCI digest, record it and the
publication-manifest digest in `bindings/policy-nexus-production.json`, and set
the binding status to `release-approved`. The two values must be reviewed
together.

Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
and publication digest
`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.

Release 2 was recorded from successful Forgejo Actions run 7 with four jointly
reviewed identities: OCI image, publication manifest, source inventory, and
deterministic source set. The production binding now selects that candidate.

## Server-dry-run and deploy

```task
id: RAPPS-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6327bc32-15f9-547b-a11c-8bc48eb6410e"
```

From an authorized operator workstation, run package checks and the Kubernetes
server-side dry-run, then execute the guarded deployment target.
The Forgejo image runner intentionally has no cluster-deploy authority. Capture
the Helm revision and workload readiness.

Completed 2026-08-18. Real-digest server dry-runs passed for both chart
generations. The guarded operator target installed revision 1 and upgraded to
release 2 as revision 2 atomically. Following the rollback drill, release 2 is
serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace
`policy-nexus`; the certificate is Ready.

## Verify the public surface and rollback path

```task
id: RAPPS-WP-0003-T04
status: done
priority: high
state_hub_task_id: "97934187-e815-51f6-99cc-6f7240da0819"
```

HTTPS, current and immutable document paths, permanent legacy redirect,
certificate readiness, deployed OCI digest, publication digest, source
inventory, and source set all passed for release 2. The drill rolled back to
release 1, verified its original image and publication identities, then restored
release 2 and repeated the four-identity smoke successfully. Evidence is held by
`rapp-policy-nexus` at
`evidence/live/2026-08-18-railiance01-release2-rollback.json`.