Bind Policy Nexus production release

docs/policy-nexus-production.md

@@ -0,0 +1,56 @@
+# policy-nexus production release
+
+`railiance-apps` owns only the approved production binding for
+`policy.coulomb.social`. Policy sources and the OCI artifact belong to
+`policy-nexus`; the Helm chart, hardening, verification, and rollback belong to
+`rapp-policy-nexus`. This repository must not copy either the generated site or
+the chart.
+
+## Binding a release
+
+The source-controlled binding is
+`bindings/policy-nexus-production.json`. Before deployment, replace both null
+values and set `status` to `release-approved`:
+
+- `image_digest`: the registry-resolved `sha256:...` digest of the image
+  published by `policy-nexus`;
+- `publication_manifest_digest`: the 64-hex SHA-256 printed by the release
+  verifier for the exact `publication-manifest.json` in that image.
+
+Tags are not accepted as production identity. The image digest and publication
+digest must be reviewed in the same change; this binds runtime bytes to policy
+source provenance without making this repository a second policy authority.
+
+## Preflight and deployment
+
+With sibling checkouts of `railiance-apps` and `rapp-policy-nexus`:
+
+```sh
+make policy-nexus-check-binding
+make policy-nexus-check-image
+make policy-nexus-render
+make policy-nexus-server-dry-run
+make policy-nexus-deploy
+make policy-nexus-status
+make policy-nexus-smoke
+```
+
+Production deployment is an operator action. The current Forgejo build runner
+has registry-publication authority but intentionally has no cluster-deploy
+authority, kubeconfig, or SSH lane. Do not add those credentials to make this
+release automatic. The guarded Make targets refuse the current
+`approved-awaiting-artifact` binding and provide the reviewed execution path
+from an authorized operator workstation.
+
+## Rollback
+
+Find the last known-good Helm revision with `make policy-nexus-status`, then:
+
+```sh
+make policy-nexus-rollback POLICY_NEXUS_REVISION=<revision>
+make policy-nexus-smoke
+```
+
+After an emergency rollback, restore the binding file to the two immutable
+identities actually serving and capture the smoke output. The package promises
+restart recovery on the single-node reef, not multi-node high availability.