diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e3893f6..c2e563f 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md | | workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | -| workplan | RAPPS-WP-0014 | active | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | +| workplan | RAPPS-WP-0014 | blocked | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | @@ -29,5 +29,5 @@ | task | RAPPS-WP-0003-T03 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | -| task | RAPPS-WP-0014-T02 | progress | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | -| task | RAPPS-WP-0014-T03 | progress | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | +| task | RAPPS-WP-0014-T02 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | +| task | RAPPS-WP-0014-T03 | wait | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | diff --git a/docs/app-data-backup-restore-handoff.md b/docs/app-data-backup-restore-handoff.md index 4763afe..2ad6bbc 100644 --- a/docs/app-data-backup-restore-handoff.md +++ b/docs/app-data-backup-restore-handoff.md @@ -6,13 +6,16 @@ backup ownership into `railiance-apps`. ## Current App Data -`vergabe-teilnahme` stores relational app data in `vergabe_db` on the shared -CloudNativePG cluster `apps-pg` in the `databases` namespace. The cluster is an -S3 platform service owned by `railiance-platform`; see -`/home/worsch/railiance-platform/docs/apps-pg.md`. +The live invited pilot uses `vergabe_demo_company` on `databases/apps-pg`, +with runtime Secret reference `vergabe-demo-company/vergabe-demo-env`. It has +separate Bound local-path claims for media (5Gi) and issue state (1Gi). See +[the current binding](vergabe-demo-company-binding.md). Historical `vergabe_db` +and July backup receipts below do not establish this new company's recovery. -The app currently has no durable media PVC enabled. `persistence.media.enabled` -is `false`, so uploaded media is deferred rather than an S5 durability promise. +RAPPS-WP-0014-T03 remains waiting: the September 25 rehearsal proved database +restore and restart, with empty file stores and no off-host upload. A populated, +coherent three-store recovery point and restored workflow are still required. +The CNPG/storage backup mechanisms remain owned by `railiance-platform`. ## Ownership Matrix @@ -45,7 +48,7 @@ If this gate is missing, the app can still be used for smoke, development, or migration validation, but promotion beyond that should create or link a `railiance-platform` workplan. -## Production cluster inventory (2026-07-10) +## Historical production cluster inventory (2026-07-10) Custodian delivery-lane snapshot (`the-custodian/docs/evidence/vergabe-teilnahme-delivery-lane-20260710.json`) @@ -76,8 +79,9 @@ make cnpg-logical-backup # immediate / daily workstation run make cnpg-backup-status ``` -**Unattended schedule (primary):** workstation cron (cluster pods lack egress to -install `age`; in-cluster CronJobs ship suspended until a prebuilt image exists): +**Historical workstation schedule (superseded):** RAPPS-WP-0002 records the +July 22 move to in-cluster CronJobs on CoulombCore and activity-core on +Railiance01. This old workstation example is not a current pilot backup receipt: ```cron # Daily 02:30 UTC — Option A multi-cluster logical backup (RPO 24h) @@ -87,7 +91,7 @@ install `age`; in-cluster CronJobs ship suspended until a prebuilt image exists) Barman `ObjectStore` / CNPG `ScheduledBackup` remain deferred (Phase 2 stubs in `manifests/cnpg-backup-readiness.yaml`). -## `vergabe-teilnahme` Gate +## Historical `vergabe_db` gate Current posture (2026-07-12): @@ -145,7 +149,7 @@ When the missing durability item is not local to S5: 1. Keep the S5 task focused on the app release impact. 2. Create or link the platform/forge workplan that owns the missing mechanism. -3. Mark the S5 task `blocked` only when the app release cannot safely continue +3. Mark the S5 task `wait` and its workplan `blocked` when the app release cannot safely continue without that upstream evidence. 4. Record the State Hub workstream/task id in the app runbook or workplan. 5. Revisit the S5 promotion gate after upstream evidence exists. diff --git a/docs/evidence/2026-09-27-vergabe-binding-review.md b/docs/evidence/2026-09-27-vergabe-binding-review.md new file mode 100644 index 0000000..2f8a184 --- /dev/null +++ b/docs/evidence/2026-09-27-vergabe-binding-review.md @@ -0,0 +1,58 @@ +# Vergabe binding and loose-end review — 2026-09-27 + +Reviewed every workplan, including archived files. RAPPS-WP-0014 is the only +unfinished workplan; all other task blocks are done. No ready or proposed +workplan remains. No new workplan or task was created. + +## Binding verification (read-only) + +| Check | Result | +| --- | --- | +| Node / cluster | Ready, 92.205.62.239; kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 | +| Helm | vergabe-demo-company / vergabe-teilnahme, deployed revision 3, chart 0.2.1 | +| Deployment | Ready 1/1; image sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91 | +| Requests / custody reference | 60m CPU, 256Mi memory; envFrom Secret reference vergabe-demo-env | +| Media / issue state | vergabe-teilnahme-media 5Gi and vergabe-teilnahme-app-state 1Gi, both Bound, local-path | +| TLS / health | vergabe-demo-tls Ready; HTTPS /demo-company/health/ returned 200 | +| Chart regression suite | 8 tests passed | +| Helm lint | Passed with admitted values plus SSO overlay | + +Commands: `kubectl get nodes -o wide`, explicit namespace/deployment field +queries, `kubectl -n vergabe-demo-company get deployment,pvc,certificate`, +`helm list -n vergabe-demo-company -o json`, HTTPS health request, +`python3 -m unittest discover -s tests -p 'test_vergabe_pilot_chart.py'`, and +`helm lint charts/vergabe-teilnahme -f helm/vergabe-demo-company-values.proposed.yaml +-f helm/vergabe-demo-company-sso.proposed.yaml`. + +The image/source/CI receipt is +[the revision 3 rollout](2026-09-12-account-recovery-live.md). +Database/role isolation and initial membership counts retain their dated +receipts in [the binding](../vergabe-demo-company-binding.md); no current user +list, database contents or Secret values were read for this review. +VERGABE-WP-0019 records the September 24 founder sign-in and still waits for +the fresh recipient journey and two-user acceptance. T02 can close on its +release-binding scope without claiming those separate gates passed. + +## Remaining recovery gate + +[September 25](2026-09-25-vergabe-demo-company-restore.md) proves a database +restore and pod restart only. File claims were empty and the encrypted database +artifact remained on the workstation. It does not prove populated media/issue +state recovery, off-host delivery, restored user workflow or safe rollback. + +`warden route find` and `warden route show railiance-backup-offsite-lane` +identify railiance-platform's OpenBao/Nextcloud lane. With the documented local +OpenBao tunnel explicitly selected, `tools/check-backup-lane-auth.sh` confirmed +OpenBao is unsealed but returned **no valid caller token**. Bernd Worsch's +attended authentication is required for this workstation upload path; no secret +was fetched. This does not establish the health of separate unattended jobs. + +RAPPS-WP-0014-T03 waits for the company workflow, a coherent off-host recovery +point for all three stores, isolated restored workflow, rollback evidence and +named support/incident ownership. The workplan is blocked. Existing product +owner tasks VERGABE-WP-0019-T04/T06 retain human acceptance. No runtime mutation, +substitute user login, backup upload or new recovery claim was made. + +The policy-nexus ArgoCD inbox proposal was read. It belongs to the existing +rApp/platform onboarding plans and supplies no unfinished task in this repo; +this review does not approve its live adoption or open another plan. diff --git a/docs/vergabe-demo-company-binding.md b/docs/vergabe-demo-company-binding.md index 865ee1e..a3f0027 100644 --- a/docs/vergabe-demo-company-binding.md +++ b/docs/vergabe-demo-company-binding.md @@ -1,7 +1,7 @@ # Vergabe demo-company deployment binding -Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019. -Application placement is live; native product sign-in and recovery acceptance remain open. +Updated 2026-09-27 under RAPPS-WP-0014 and VERGABE-WP-0019. +Release binding is complete (RAPPS-WP-0014-T02). Recovery and invited-recipient acceptance remain open. | Item | Current binding | | --- | --- | @@ -18,7 +18,7 @@ Application placement is live; native product sign-in and recovery acceptance re | Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg | | Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 | | Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 | -| Authentication | NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending | +| Authentication | NetKingdom company welcome and OIDC deployed; founder sign-in recorded September 24. Fresh recipient journey and two-user acceptance remain open | | Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance | ## Current SSO rollout @@ -89,10 +89,22 @@ on stdin; the durable credential copies are the two exact Kubernetes Secrets. OpenBao automation remains a later owner improvement. Never rerun historical bootstrap helpers or substitute apps_admin credentials. -This is the first release in the fresh namespace; there is no previously -accepted application image to roll back to. On a failed next upgrade, stop public -traffic and reconcile schema/image compatibility before reverting. Retain the +Revision 3 is the current binding; revisions 1 and 2 are historical deployment +receipts, not demonstrated safe rollback targets. On a failed next upgrade, +stop public traffic and reconcile schema/image compatibility before reverting. Retain the claims and database; namespace deletion is not rollback. Pod replacement and isolated restore must still be proven with matched PostgreSQL/media/SQLite data. Current recovery rollout: docs/evidence/2026-09-12-account-recovery-live.md. + + +## Binding review — 2026-09-27 + +Read-only deployment, Helm, claim, certificate and HTTPS checks match this +binding; see [the verification receipt](evidence/2026-09-27-vergabe-binding-review.md). +The September 25 database restore and pod restart passed, but populated media +and issue-state recovery, an off-host copy, restored two-user workflow and +rollback/support acceptance remain RAPPS-WP-0014-T03. That task is waiting and +the workplan is blocked. Earlier dated sections describe their original +snapshots; the current binding table and this review supersede their pending +DNS, deployment and first-login statements. diff --git a/docs/vergabe-teilnahme-pilot.md b/docs/vergabe-teilnahme-pilot.md index 0022dbf..abe8632 100644 --- a/docs/vergabe-teilnahme-pilot.md +++ b/docs/vergabe-teilnahme-pilot.md @@ -9,8 +9,9 @@ the historical deployment is still live. Before native admission, record the following non-secret values in the company binding. The user selects a fresh `demo-company` workspace; see -[its prepared binding](vergabe-demo-company-binding.md). Native tenant/user/password setup is verified; application hostname admission -and product placement remain pending. +[its prepared binding](vergabe-demo-company-binding.md). Native tenant/user/password setup, hostname admission and product placement are +verified. The binding task closed on 2026-09-27; recovery and recipient +acceptance remain blocked in the existing tasks. | Binding | Required evidence | | --- | --- | @@ -72,20 +73,21 @@ HA is not claimed. ## Manual onboarding and acceptance -Use the existing Django administration via the admitted operator path to create -ordinary active members. Keep staff/superuser access with the designated -operator. Supply initial credentials over the existing private human channel; -never paste them into Git, State Hub, command arguments or chat. Members can -change passwords in the UI; operators handle reset and deactivation manually. -Do not run `seed_dev` on a pilot/customer database. +The current demo-company release uses NetKingdom OIDC and the company welcome +flow. Provision ordinary members through the native User Engine journey and +have each invited recipient complete their own login/MFA and confirmation. +Do not substitute shared Django passwords or staff identities for this gate. +The founder's September 24 sign-in is recorded; a fresh recipient journey and +two-user acceptance remain VERGABE-WP-0019-T04/T06. Never place credentials or +setup links in work records, and do not run `seed_dev` on a pilot database. Before admitting the first users, verify HTTPS login, CSRF failure behavior, anonymous document refusal, two separate user sessions and deactivation of an already logged-in account. Complete the tender → lot → task/document → domain approval → submission workflow and feedback with the company contact. Customer support contact, incident routing and backup responsibility must be recorded. -Pricing, automated invitation email, SSO and shared tenancy can be considered -later; none is implied by this initial pilot contract. +Pricing, automated invitation email and shared tenancy remain outside this +pilot contract. SSO is deployed; recipient acceptance remains a separate gate. ## Current inventory — 2026-09-11 diff --git a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md index 06e16d2..e1bd6ab 100644 --- a/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md +++ b/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md @@ -4,12 +4,12 @@ type: workplan title: "Deploy and recover the first invited Vergabe company pilot" domain: financials repo: railiance-apps -status: active +status: blocked flavor: implementation owner: the-custodian topic_slug: railiance created: "2026-09-11" -updated: "2026-09-25" +updated: "2026-09-27" related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001, CUST-WP-0071] state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57" --- @@ -38,9 +38,9 @@ values template prepare the deployment; no live resources were changed. ```task id: RAPPS-WP-0014-T02 -status: progress +status: done needs_human: false -intervention_note: "DNS, TLS and application placement are verified. Product SSO/welcome and pilot/recovery acceptance remain in the existing owner tasks." +intervention_note: "Binding complete: revision 3, immutable image, DNS/TLS, database custody and both PVCs verified. Recipient acceptance remains VERGABE-WP-0019-T04/T06; recovery remains T03." priority: high assignee: the-custodian state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897" @@ -181,15 +181,25 @@ confirmation are now requested from the operator; no user credential was used by the agent. Recovery and two-user acceptance remain their existing tasks. Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. +2026-09-27 closeout: T02 is done. Read-only verification confirms release +revision 3, chart 0.2.1 and the recorded `a26444f5…` image, Ready 1/1, +60m/256Mi requests, both Bound claims, Ready TLS and HTTP 200 health. The +September 24 founder sign-in resolves the former issuer-login wait. Exact +binding is complete; the invited recipient journey and two-user acceptance +remain VERGABE-WP-0019-T04/T06, and recovery remains T03. See +`docs/evidence/2026-09-27-vergabe-binding-review.md`. + ## Demonstrate restart, isolated restore, rollback and operating ownership ```task id: RAPPS-WP-0014-T03 -status: progress +status: wait +needs_human: true +intervention_note: "Bernd Worsch and the company contact must complete two-user/document acceptance; railiance-platform owns offsite access and storage backup delivery. Then complete the coherent isolated restore and rollback receipt under this task." priority: high assignee: the-custodian depends_on: [RAPPS-WP-0014-T02] -blocking_reason: "Database restore and app restart are proved. Two-user collaboration and a document round-trip are still open." +blocking_reason: "Await populated two-user/document workflow, coherent PostgreSQL/media/issue-state off-host recovery point, isolated restored workflow, rollback evidence and support ownership. September 25 proves database restore and restart only." state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" ``` @@ -218,3 +228,17 @@ The app pod was recreated and `/demo-company/health/` returned 200. The age file stayed on the workstation; the Nextcloud upload was not run. Two-user collaboration and a document round-trip remain. Evidence: `docs/evidence/2026-09-25-vergabe-demo-company-restore.md`. + + +2026-09-27 loose-end review: T03 now waits and this workplan is blocked. +The September 25 database-only drill and empty file claims do not satisfy the +three-store recovery contract. Complete the populated synthetic workflow with +Bernd Worsch and the company contact, obtain a matched off-host recovery point +through railiance-platform, restore into an isolated database and separate +claims, verify both users and document checksums, and record schema-compatible +rollback plus named incident/support ownership. Credential routing confirms +`railiance-backup-offsite-lane` belongs to railiance-platform; a resolvable route +alone is not an authenticated upload or a backup receipt. The safe auth check +confirmed OpenBao unsealed but no valid caller token, so the workstation upload +path needs Bernd Worsch's attended login. Existing tasks retain +all remaining work; no task or workplan was opened.