Prepare durable isolated Vergabe pilot deployment and recovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

@@ -0,0 +1,82 @@
+---
+id: RAPPS-WP-0014
+type: workplan
+title: "Deploy and recover the first invited Vergabe company pilot"
+domain: financials
+repo: railiance-apps
+status: active
+owner: the-custodian
+topic_slug: railiance
+created: "2026-09-11"
+updated: "2026-09-11"
+related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001]
+---
+
+# Invited Vergabe pilot on Railiance
+
+## Prepare a durable and immutable single-company chart
+
+```task
+id: RAPPS-WP-0014-T01
+status: done
+priority: high
+assignee: the-custodian
+```
+
+Extend the existing media PVC support with a distinct issue-facade state PVC,
+optional existing claims for restore, retained claims on Helm uninstall and
+Recreate rollout when persistent local state is mounted. Pilot mode requires
+one replica, both durable stores, distinct claims and a valid OCI image digest.
+The legacy opt-in behavior remains available for non-pilot installations.
+Seven render regression tests and Helm lint pass. Chart 0.2.0 and the review-only
+values template prepare the deployment; no live resources were changed.
+
+## Bind the exact company, release, placement, data and access
+
+```task
+id: RAPPS-WP-0014-T02
+status: progress
+priority: high
+assignee: the-custodian
+```
+
+Consume VERGABE-WP-0019-T02's login-protected release after live CI/publication.
+Record exact image/chart revision, company, user count, host/TLS, dedicated
+namespace, database/role, both PVCs and admitted runtime Secret custody. Obtain
+the user's empty-vs-existing-data disposition. Existing vergabe_db is not test
+data. Resolve target inventory before using historical runbook names: the
+checked Railiance cluster has no vergabe-teilnahme namespace or matching
+Deployment on 2026-09-11. Do not infer data loss or authorization to recreate it.
+
+Use `docs/vergabe-teilnahme-pilot.md` for the review packet. Secret creation,
+operator access and placement consume existing platform lanes; they do not
+create a parallel identity framework. The public edge needs an admitted login
+abuse-control policy and TLS; Django's authentication gate alone is not a rate
+limiter. Keep `/media/` behind the app gate. Exact customer identity/host/data
+selection is pending user input; source preparation can proceed meanwhile.
+
+## Demonstrate restart, isolated restore, rollback and operating ownership
+
+```task
+id: RAPPS-WP-0014-T03
+status: wait
+priority: high
+assignee: the-custodian
+depends_on: [RAPPS-WP-0014-T02]
+blocking_reason: "Await exact placement/release/data binding before native rehearsal and admission."
+```
+
+With synthetic fixture data on the admitted deployment, prove login and health,
+two-user collaboration, document upload/download and issue state across pod
+replacement. Establish a consistent recovery point for PostgreSQL, media and
+issue-facade SQLite; rehearse recovery into a separate database and separate
+claims, repeat the workflow, and record recovery time and checksums without
+customer content. Record backup owner/cadence/retention/off-host destination,
+restore command revision and monitoring/incident owner. Retained local-path
+PVCs are neither off-host backup nor node-failure protection.
+
+Review upgrade/migration effects and exact rollback image/data handling. A
+single-writer Recreate release has a short service interruption; do not promise
+HA. Return evidence to VERGABE-WP-0019-T03/T04 before customer invitations.
+Native factory-produced delivery remains VERGABE-WP-0018/HFACT-WP-0001's separate
+claim. Pricing and shared-app tenancy are outside this invited-pilot milestone.