coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind policy nexus release 2 for production
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source
This commit is contained in:
tegwick 2026-08-18 13:59:28 +02:00
parent 234cdfa4bb
commit 7cfcf8b5d1
4 changed files with 34 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/policy-nexus-production.md
View file

@ -9,17 +9,21 @@ the chart.
## Binding a release
The source-controlled binding is
`bindings/policy-nexus-production.json`. Before deployment, replace both null
values and set `status` to `release-approved`:
`bindings/policy-nexus-production.json`. Before deployment, record all four
candidate identities and set `status` to `release-approved`:
- `image_digest`: the registry-resolved `sha256:...` digest of the image
published by `policy-nexus`;
- `publication_manifest_digest`: the 64-hex SHA-256 printed by the release
verifier for the exact `publication-manifest.json` in that image.
- `source_inventory_digest`: the 64-hex SHA-256 of the exact
`source-inventory.json` in that image;
- `source_set_digest`: the deterministic 64-hex digest of every upstream
repository revision audited for that candidate.
Tags are not accepted as production identity. The image digest and publication
digest must be reviewed in the same change; this binds runtime bytes to policy
source provenance without making this repository a second policy authority.
Tags are not accepted as production identity. All four identities must be
reviewed in the same change; this binds runtime bytes to policy source
provenance without making this repository a second policy authority.
## Preflight and deployment
@ -51,6 +55,6 @@ make policy-nexus-rollback POLICY_NEXUS_REVISION=<revision>
make policy-nexus-smoke
```
After an emergency rollback, restore the binding file to the two immutable
After an emergency rollback, restore the binding file to the four immutable
identities actually serving and capture the smoke output. The package promises
restart recovery on the single-node reef, not multi-node high availability.