chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-08-18:
  - RAILIANCE-WP-0018-T04: progress → wait

workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md

@@ -0,0 +1,95 @@
+---
+id: RAILIANCE-WP-0018
+type: workplan
+title: "Bind and deploy the permanent policy surface"
+domain: financials
+repo: railiance-apps
+status: active
+owner: the-custodian
+topic_slug: railiance
+created: "2026-08-18"
+updated: "2026-08-18"
+related:
+  - POLICY-NEXUS-WP-0001
+  - RAPP-POLICY-NEXUS-WP-0001
+  - REEF-RAILIANCE-WP-0004
+state_hub_workstream_id: "801197d8-d387-4fcf-9a38-b4e7457847e6"
+---
+
+# RAILIANCE-WP-0018 — policy-nexus production binding
+
+## Goal
+
+Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
+`https://policy.coulomb.social` without duplicating policy content or its rApp
+chart in the S5 repository.
+
+## Establish the S5 release boundary
+
+```task
+id: RAILIANCE-WP-0018-T01
+status: done
+priority: high
+state_hub_task_id: "537639f3-2078-4560-8bd0-4ac7d13f8131"
+```
+
+The production binding, guarded delegating Make targets, and runbook are
+present. `policy-nexus` owns content/image creation;
+`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
+selection and production approval.
+
+## Record the first immutable release
+
+```task
+id: RAILIANCE-WP-0018-T02
+status: done
+priority: high
+state_hub_task_id: "44a2e61e-e4a6-46ab-baf2-c81fb020a68e"
+```
+
+Publish a clean-source image, resolve its registry OCI digest, record it and the
+publication-manifest digest in `bindings/policy-nexus-production.json`, and set
+the binding status to `release-approved`. The two values must be reviewed
+together.
+
+Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
+OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
+and publication digest
+`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.
+
+## Server-dry-run and deploy
+
+```task
+id: RAILIANCE-WP-0018-T03
+status: done
+priority: high
+state_hub_task_id: "d78dbaf0-1df5-4498-b1e4-9aeb6804831b"
+```
+
+From an authorized operator workstation, run package checks and the Kubernetes
+server-side dry-run, then execute the guarded deployment target.
+The Forgejo image runner intentionally has no cluster-deploy authority. Capture
+the Helm revision and workload readiness.
+
+Completed 2026-08-18. The real-digest server dry-run passed, and the guarded
+operator target installed Helm revision 1 atomically. Deployment and pod are
+1/1 Ready in namespace `policy-nexus`; the certificate is Ready.
+
+## Verify the public surface and rollback path
+
+```task
+id: RAILIANCE-WP-0018-T04
+status: wait
+priority: high
+state_hub_task_id: "438b9016-9a11-4905-aa24-a7a3c622a033"
+```
+
+Blocked by T03. Prove HTTPS, current and immutable document paths, permanent
+legacy redirect, certificate readiness, deployed OCI digest, and publication
+digest. Record the previous Helm revision and exercise rollback when a safe
+preceding release exists.
+
+All public, certificate, image, publication, and provenance checks passed on
+2026-08-18. Evidence is held by `rapp-policy-nexus` at
+`evidence/live/2026-08-18-railiance01.json`. This remains in progress only
+because the initial Helm revision has no predecessor to exercise safely.