docs: bind the fresh demo-company Vergabe pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

docs/vergabe-demo-company-binding.md

@@ -0,0 +1,66 @@
+# Vergabe demo-company deployment binding
+
+Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
+This is an execution packet; native tenant creation and deployment are pending.
+
+| Item | Binding / execution status |
+| --- | --- |
+| Tenant | `tenant:trial:demo-company`; display `demo-company`; native creation pending |
+| Purpose / data | New demo workspace; synthetic data only; no existing data import |
+| Initial accounts | `demo-user1`, `demo-user2`, ordinary members; creation and private credential setup pending |
+| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
+| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
+| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
+| Helm release | `vergabe-teilnahme` within that namespace |
+| Image source | `ccb6d1f8c7abd50f2ef654491bb1aa5861e795cb`; live CI 29 / publication 31 passed |
+| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005` |
+| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
+| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
+| Proposed URL | `https://demo-vergabe.coulomb.social`; user preference pending |
+| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
+| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
+| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
+| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending |
+| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence |
+
+The target database is a proposed new consumer, not permission to reuse or
+overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration
+demand before applying. Tenant creation itself does not depend on this hostname.
+
+## Native tenant and identity execution
+
+Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`.
+Its `/login` uses KeyCape and the registered native callback. The authenticated
+platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
+the response and read back the exact tenant before creating memberships. Do not
+substitute a service actor, fabricate verified claims, or bypass policy on denial.
+An operator browser has been opened; native login/creation is not yet confirmed.
+
+Create two ordinary memberships through User Engine. Confirm how the identity
+provisioner assigns login names before provisioning the requested demo names;
+do not invent deliverable email addresses or send invitations to third parties.
+The current product uses separately provisioned Django accounts, with no staff
+or superuser flags. Preserve the mapping to this tenant's isolated deployment.
+This establishes a platform tenant and a bounded app pilot, not completed SSO.
+
+## Hostname and deployment execution
+
+`helm/vergabe-demo-company-values.proposed.yaml` pins the published image and
+60m resources, and consistently uses the proposed host for Django and probes.
+The chart does not itself create public ingress or DNS. Confirm the preferred
+hostname, point its DNS to Railiance01 through the DNS owner, configure the
+HTTPS route and abuse control through the existing edge lane, and verify TLS.
+On 2026-09-11 the proposed hostname resolved to 80.158.43.29; the legacy
+`vergabe-teilnahme.whywhynot.de` resolved to 92.205.130.254. Neither was the
+intended Railiance01 address. No DNS changes have been made.
+
+Complete platform database/Secret provisioning and the source-backed namespace,
+network and public edge manifests before deployment. Then migrate the fresh
+database, deploy, provision the demo app accounts, and perform the two-user
+workflow plus restart/isolated-restore checks in the existing owner tasks.
+Only then record the demo environment as available for use.
+
+Validation on 2026-09-11: Helm lint passed. Rendering the proposed values
+produced the pinned digest, one Recreate replica, 60m CPU request, matching
+Django/probe hosts, and two distinct retained PVCs. This is local manifest
+verification; it is not native deployment or tenant-creation evidence.

docs/vergabe-teilnahme-pilot.md

@@ -8,8 +8,9 @@ the historical deployment is still live.
 ## Exact release packet
 
 Before native admission, record the following non-secret values in the company
-binding. Company/host/data selection is pending; do not treat example values as
+binding. The user selects a fresh `demo-company` workspace; see
-an assigned tenant.
+[its prepared binding](vergabe-demo-company-binding.md). Native tenant creation
+and hostname admission are pending; example values do not create a tenant.
 
 | Binding | Required evidence |
 | --- | --- |
@@ -136,4 +137,6 @@ Read-only CNPG metadata also reports `vergabe-db` applied for `vergabe_db` owned
 by `vergabe`, two managed consumers with 20-connection limits, and the most recent
 apps-pg backup successful at 2026-09-11T02:15:11Z. This establishes the declared
 database/backup metadata; no customer data was read, selected for reuse or
-modified. The tenant/data choice remains open.
+modified. The user subsequently selected a new demo-company workspace; the
+prepared binding explicitly uses a fresh database and leaves historical data
+untouched.

helm/vergabe-demo-company-values.proposed.yaml

@@ -0,0 +1,27 @@
+# Proposed binding only; see docs/vergabe-demo-company-binding.md.
+# Native tenant, database/Secret, DNS/TLS and edge admission are still pending.
+# Release vergabe-teilnahme; namespace vergabe-demo-company.
+pilot:
+  enabled: true
+image:
+  digest: sha256:963240ef4180a01e5b8af7fbeb88be27e56203a45da8ecd633326b4c6d262005
+replicaCount: 1
+resources:
+  requests:
+    cpu: 60m
+    memory: 256Mi
+  limits:
+    cpu: 1000m
+    memory: 1Gi
+envSecretName: vergabe-demo-env
+env:
+  DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
+  ALLOWED_HOSTS: demo-vergabe.coulomb.social,localhost
+  CSRF_TRUSTED_ORIGINS: https://demo-vergabe.coulomb.social
+probes:
+  hostHeader: demo-vergabe.coulomb.social
+persistence:
+  media:
+    enabled: true
+  appState:
+    enabled: true

workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

@@ -45,8 +45,8 @@ state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897"
 
 Consume VERGABE-WP-0019-T02's login-protected release after live CI/publication.
 Record exact image/chart revision, company, user count, host/TLS, dedicated
-namespace, database/role, both PVCs and admitted runtime Secret custody. Obtain
+namespace, database/role, both PVCs and admitted runtime Secret custody. The
-the user's empty-vs-existing-data disposition. Existing vergabe_db is not test
+user now selects a fresh demo-company workspace (2026-09-11). Existing vergabe_db is not test
 data. Resolve target inventory before using historical runbook names: the
 checked Railiance cluster has no vergabe-teilnahme namespace or matching
 Deployment on 2026-09-11. Do not infer data loss or authorization to recreate it.
@@ -73,8 +73,23 @@ Use `docs/vergabe-teilnahme-pilot.md` for the review packet. Secret creation,
 operator access and placement consume existing platform lanes; they do not
 create a parallel identity framework. The public edge needs an admitted login
 abuse-control policy and TLS; Django's authentication gate alone is not a rate
-limiter. Keep `/media/` behind the app gate. Exact customer identity/host/data
+limiter. Keep `/media/` behind the app gate.
-selection is pending user input; source preparation can proceed meanwhile.
+
+The user requests a new `demo-company` tenant with `demo-user1`, etc. Apply
+NetKingdom ADR-0013 as `tenant:trial:demo-company` and start with two ordinary
+demo users. Fresh data is selected; no historical customer import is authorized.
+The exact prepared namespace/database/release and proposed hostname are in
+`docs/vergabe-demo-company-binding.md` and
+`helm/vergabe-demo-company-values.proposed.yaml`. The suggested hostname is
+`demo-vergabe.coulomb.social`; user preference is pending. Its observed DNS
+target is not Railiance01 and must be corrected through the edge owner.
+
+Tenant Engine creation must use the authenticated User Engine operator portal.
+An isolated native KeyCape login window has been opened; operator login,
+tenant creation/readback, memberships and app account provisioning are not yet
+confirmed. Do not substitute a trusted service actor to bypass a denial.
+Platform registration does not add SSO to the Django pilot. Continue execution
+on T02; company/data choice is no longer missing input.
 
 ## Demonstrate restart, isolated restore, rollback and operating ownership