diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..d72fd52
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.pdf binary
diff --git a/docs/evidence/2026-11-05-vergabe-pilot-preflight.json b/docs/evidence/2026-11-05-vergabe-pilot-preflight.json
new file mode 100644
index 0000000..46b2942
--- /dev/null
+++ b/docs/evidence/2026-11-05-vergabe-pilot-preflight.json
@@ -0,0 +1,134 @@
+{
+ "schema": "railiance.vergabe-pilot-readiness.v1",
+ "observed_at": "2026-11-05T13:51:41.461787+00:00",
+ "workplan": "RAPPS-WP-0014",
+ "task": "RAPPS-WP-0014-T03",
+ "runtime_mutations": false,
+ "status": "waiting_for_two_user_workflow_and_native_recovery",
+ "expected": {
+ "cluster_uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+ "namespace": "vergabe-demo-company",
+ "release": "vergabe-teilnahme",
+ "database": "vergabe_demo_company",
+ "image_digest": "sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91",
+ "claims": [
+ "vergabe-teilnahme-media",
+ "vergabe-teilnahme-app-state"
+ ]
+ },
+ "kubernetes_reads": [
+ {
+ "command": [
+ "kubectl",
+ "--request-timeout=10s",
+ "get",
+ "namespace",
+ "kube-system",
+ "-o",
+ "json"
+ ],
+ "status": "ok",
+ "uid": "a553c742-0115-43d4-99a4-a5ca56fe0786",
+ "expected_uid_matches": true
+ },
+ {
+ "command": [
+ "kubectl",
+ "--request-timeout=10s",
+ "get",
+ "nodes",
+ "-o",
+ "json"
+ ],
+ "status": "forbidden"
+ },
+ {
+ "command": [
+ "kubectl",
+ "--request-timeout=10s",
+ "get",
+ "deployment",
+ "vergabe-teilnahme",
+ "-n",
+ "vergabe-demo-company",
+ "-o",
+ "json"
+ ],
+ "status": "forbidden"
+ },
+ {
+ "command": [
+ "kubectl",
+ "--request-timeout=10s",
+ "get",
+ "pvc",
+ "-n",
+ "vergabe-demo-company",
+ "-o",
+ "json"
+ ],
+ "status": "forbidden"
+ }
+ ],
+ "http_reads": [
+ {
+ "path": "/demo-company/health/",
+ "method": "GET",
+ "cookies_supplied": false,
+ "status": 200,
+ "final_host": "vergabe-teilnahme.coulomb.social",
+ "final_path": "/demo-company/health/",
+ "health_ok": true
+ },
+ {
+ "path": "/demo-company/",
+ "method": "GET",
+ "cookies_supplied": false,
+ "status": 200,
+ "final_host": "vergabe-teilnahme.coulomb.social",
+ "final_path": "/demo-company/accounts/login/",
+ "netkingdom_welcome_present": true
+ },
+ {
+ "path": "/demo-company/accounts/welcome/",
+ "method": "GET",
+ "cookies_supplied": false,
+ "status": 200,
+ "final_host": "vergabe-teilnahme.coulomb.social",
+ "final_path": "/demo-company/accounts/welcome/",
+ "netkingdom_welcome_present": true
+ },
+ {
+ "path": "/demo-company/ausschreibungen/dashboard/",
+ "method": "GET",
+ "cookies_supplied": false,
+ "status": 200,
+ "final_host": "vergabe-teilnahme.coulomb.social",
+ "final_path": "/demo-company/accounts/login/",
+ "netkingdom_welcome_present": true
+ },
+ {
+ "path": "/demo-company/media/pilot-readiness-nonexistent.pdf",
+ "method": "GET",
+ "cookies_supplied": false,
+ "status": 200,
+ "final_host": "vergabe-teilnahme.coulomb.social",
+ "final_path": "/demo-company/accounts/login/",
+ "netkingdom_welcome_present": true
+ }
+ ],
+ "claims": {
+ "public_health_verified": true,
+ "cluster_uid_verified": true,
+ "live_release_and_claims_verified": false,
+ "two_user_acceptance_verified": false,
+ "three_store_offhost_recovery_verified": false
+ },
+ "credential_routing": {
+ "catalog_id": "railiance-backup-offsite-lane",
+ "owner": "railiance-platform",
+ "subsystem": "OpenBao + Nextcloud",
+ "route_resolvable": true,
+ "upload_or_custody_verified": false
+ }
+}
diff --git a/docs/fixtures/vergabe-pilot-acceptance.pdf b/docs/fixtures/vergabe-pilot-acceptance.pdf
new file mode 100644
index 0000000..0760adc
--- /dev/null
+++ b/docs/fixtures/vergabe-pilot-acceptance.pdf
@@ -0,0 +1,32 @@
+%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 595 842] /Resources << /Font << /F1 4 0 R >> >> /Contents 5 0 R >>
+endobj
+4 0 obj
+<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica >>
+endobj
+5 0 obj
+<< /Length 259 >>
+stream
+BT /F1 18 Tf 50 780 Td (Vergabe demo-company pilot) Tj 0 -30 Td /F1 12 Tf (Synthetic acceptance document - no customer data.) Tj 0 -20 Td (Reference: RAPPS-WP-0014 / PILOT-2026-11-05) Tj 0 -20 Td (Keep these bytes for restart and restore verification.) Tj ET
+endstream
+endobj
+xref
+0 6
+0000000000 65535 f
+0000000009 00000 n
+0000000058 00000 n
+0000000115 00000 n
+0000000241 00000 n
+0000000311 00000 n
+trailer
+<< /Size 6 /Root 1 0 R >>
+startxref
+620
+%%EOF
diff --git a/docs/vergabe-demo-company-acceptance.md b/docs/vergabe-demo-company-acceptance.md
new file mode 100644
index 0000000..cbee0e9
--- /dev/null
+++ b/docs/vergabe-demo-company-acceptance.md
@@ -0,0 +1,89 @@
+# Demo-company pilot walkthrough
+
+Prepared 2026-11-05 for RAPPS-WP-0014-T03 and VERGABE-WP-0019-T04/T06.
+The steps below are pending user execution; preparing them records no acceptance.
+
+## Sign in separately
+
+Open in two separate
+browser profiles, one for each ordinary demo-company member. Each person selects
+**Mit NetKingdom anmelden**, completes their own sign-in/MFA and any first-use
+company confirmation, then reaches the company workspace. Record pass/fail for
+each person. If the second account needs setup, use the existing native User
+Engine invitation/password-setup path through .
+The recipient completes their own setup. Keep credentials and setup links private.
+
+## Work together on one synthetic tender
+
+Use only synthetic content. Keep the resulting records until the recovery drill
+has verified them.
+
+1. User A creates an Ausschreibung named **PILOT-2026-11-05**, with the synthetic
+ issuer **Demo Auftraggeber**. Complete the required fields with demo values.
+ Add a Los named **Pilot-Los** and a task named **Pilot-Dokument pruefen**.
+2. User B opens that same tender and task, makes a small change to the task
+ description, and saves. User A reloads and confirms the change is visible.
+ If assigning the task is available, select User B; report any missing member
+ separately from sign-in success.
+3. User A uploads [the supplied synthetic PDF](fixtures/vergabe-pilot-acceptance.pdf)
+ under the tender's Dokumente, with version **1.0**. User B downloads it;
+ User A downloads it again after reload. Both files must match the original.
+4. On the task, open **Externes Issue → + Verknüpfen**, enter **Pilot recovery
+ check**, and save. Confirm the **LOKAL** badge and issue key, then reload
+ from both sessions. Use the local issue; leave **Nach Gitea** unused.
+5. Complete the tender's participation decision, required **Freigaben**, and
+ **Abgabe dokumentieren** with synthetic details. This records a demo workflow
+ in the app; no real procurement submission is part of this session. Record
+ any missing control, validation failure or required role.
+6. Open the uploaded document's actual download address in a signed-out browser.
+ It must require sign-in or deny access. Report whether the file bytes are
+ refused, rather than treating a login page's HTTP 200 as a document download.
+
+The original PDF is 803 bytes. Its SHA256 is
+`23a6850fa2391a58280c8515361ca29e9e92fa65fdadc36be7b44b552192e381`.
+On Linux/WSL use `sha256sum path/to/downloaded.pdf`; on Windows PowerShell use
+`Get-FileHash -Algorithm SHA256 path/to/downloaded.pdf`.
+
+Return only pass/fail or the failing step, synthetic tender/task/document IDs,
+the local issue key, and download hash equality. No passwords, tokens, setup
+links or private customer files belong in the receipt. First-use sign-in and
+the collaborative workflow are distinct verdicts.
+
+## Recovery follow-through
+
+The [read-only preflight](evidence/2026-11-05-vergabe-pilot-preflight.json)
+confirms the recorded cluster UID, public health and the NetKingdom welcome
+gate. Node, Deployment and PVC reads are forbidden to the current agent identity;
+fresh image/release/claim status remains unverified. The binding's expected image
+and claims are historical reference values until a permitted native readback.
+
+After the populated workflow, prepare the exact attended recovery action from
+the existing [pilot recovery contract](vergabe-teilnahme-pilot.md#persistence-and-recovery)
+and [deployment binding](vergabe-demo-company-binding.md). Its receipt must cover:
+
+- A fresh release/schema/claim readback and recovery-point manifest for
+ `vergabe_demo_company`, `/app/media` and `/app/.issue-facade/issues.db`.
+ Include the synthetic identifiers above and document SHA256. Capture all
+ stores during one quiesced write window; use a consistent SQLite backup,
+ including any required journal state.
+- Pod replacement with the same claims, followed by both users reopening the
+ tender, task, document and local issue. Record interruption and readiness time.
+- Encrypted off-host publication and independent readback of that exact matched
+ point through railiance-platform's admitted custody/storage lane. The route
+ lookup alone is not custody or upload evidence.
+- Restore into a separate database and separate claims with isolated routing
+ and outgoing writes disabled. Repeat the two-user/document/issue checks,
+ verify bytes and database/file consistency, and record elapsed recovery time.
+ Product login callbacks need an owner-admitted isolated route before claiming
+ restored interactive sign-in; do not repoint the live callback to a scratch app.
+- A demonstrated image/schema-compatible rollback with current writes retained,
+ named backup and incident/support owners, cadence, retention, destination and
+ accepted recovery objectives. Historical Helm revisions are not automatically
+ safe rollback targets.
+
+Existing database-only backup/restore targets default to historical `vergabe_db`
+and omit both file stores. They cannot establish this three-store recovery claim.
+The human sign-in/workflow response is pending; the attended restart, off-host
+capture, isolated restore and rollback action has not been prepared or executed.
+Logged-in account deactivation remains a separate owner-run access-control check
+from the pilot contract. No account is disabled as part of these walkthrough steps.
diff --git a/docs/vergabe-teilnahme-pilot.md b/docs/vergabe-teilnahme-pilot.md
index abe8632..b63b069 100644
--- a/docs/vergabe-teilnahme-pilot.md
+++ b/docs/vergabe-teilnahme-pilot.md
@@ -73,6 +73,10 @@ HA is not claimed.
## Manual onboarding and acceptance
+The [demo-company walkthrough](vergabe-demo-company-acceptance.md) provides the
+two-user tender/task/document/local-issue sequence and a synthetic PDF for the
+remaining pilot gate. Its preparation is not a user verdict or recovery proof.
+
The current demo-company release uses NetKingdom OIDC and the company welcome
flow. Provision ordinary members through the native User Engine journey and
have each invited recipient complete their own login/MFA and confirmation.
diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
index af15267..4246bd2 100644
--- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
+++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
@@ -9,7 +9,7 @@ flavor: implementation
owner: the-custodian
topic_slug: railiance
created: "2026-09-11"
-updated: "2026-10-21"
+updated: "2026-11-05"
related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001, CUST-WP-0071]
state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57"
---
@@ -247,6 +247,19 @@ all remaining work; no task or workplan was opened.
2026-10-03: human gate routed to hub decision d06307e5-2737-461a-a2f4-a12c3b492a9a (D7: Vergabe pilot: two real users run the invited setup-to-workflow acceptance) by CUST-WP-0075; resolving that decision raises C-40 here.
+2026-11-05 continuation: read-only preflight confirms the recorded Railiance01
+cluster UID, public health and NetKingdom welcome gating. Node, Deployment and
+PVC reads are forbidden to the current agent identity; no fresh native release
+or claim readiness is asserted. Receipt:
+`docs/evidence/2026-11-05-vergabe-pilot-preflight.json`. Prepared
+`docs/vergabe-demo-company-acceptance.md` with the two-user tender/lot/task,
+PDF round-trip, local issue and domain approval/submission-recording walkthrough,
+plus the remaining recovery/rollback evidence contract. A synthetic 803-byte PDF
+and its SHA256 are supplied. Requested the users' separate sign-in results;
+no response, workflow acceptance, account change or runtime mutation is inferred.
+The offsite route still names railiance-platform; resolving that route is not
+an authenticated upload. T03 remains wait for the existing human/recovery gate.
+
## Validate synthetic sizing against the exact release and shared contention