coulomb/railiance-apps
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close Vergabe binding and record remaining recovery blockers
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e3b3-11fe-7ba0-a4a3-92331aab0ba1
This commit is contained in:
tegwick 2026-09-27 18:34:05 +02:00
parent 1839c0ba42
commit cfbc95e11d
6 changed files with 136 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

6
WORK-RECORDS.md
View file

@ -11,7 +11,7 @@
| workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | workplan | RAPPS-WP-0001 | finished | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
| workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md | | workplan | RAPPS-WP-0002 | finished | — | workplans/RAPPS-WP-0002-railiance01-activity-core-backup-automation.md |
| workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | workplan | RAPPS-WP-0003 | finished | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
| workplan | RAPPS-WP-0014 | active | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | workplan | RAPPS-WP-0014 | blocked | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
| task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T01 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
| task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T02 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
| task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md | | task | RAPPS-WP-0001-T03 | done | — | workplans/RAPPS-WP-0001-cnpg-backup-scheduledbackup-coverage.md |
@ -29,5 +29,5 @@
| task | RAPPS-WP-0003-T03 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | task | RAPPS-WP-0003-T03 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
| task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md | | task | RAPPS-WP-0003-T04 | done | — | workplans/RAPPS-WP-0003-policy-nexus-production-binding.md |
| task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0014-T01 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
| task | RAPPS-WP-0014-T02 | progress | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0014-T02 | done | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |
| task | RAPPS-WP-0014-T03 | progress | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md | | task | RAPPS-WP-0014-T03 | wait | — | workplans/RAPPS-WP-0014-vergabe-invited-pilot.md |

26
docs/app-data-backup-restore-handoff.md
View file

@ -6,13 +6,16 @@ backup ownership into `railiance-apps`.
## Current App Data ## Current App Data
`vergabe-teilnahme` stores relational app data in `vergabe_db` on the shared The live invited pilot uses `vergabe_demo_company` on `databases/apps-pg`,
CloudNativePG cluster `apps-pg` in the `databases` namespace. The cluster is an with runtime Secret reference `vergabe-demo-company/vergabe-demo-env`. It has
S3 platform service owned by `railiance-platform`; see separate Bound local-path claims for media (5Gi) and issue state (1Gi). See
`/home/worsch/railiance-platform/docs/apps-pg.md`. [the current binding](vergabe-demo-company-binding.md). Historical `vergabe_db`
and July backup receipts below do not establish this new company's recovery.
The app currently has no durable media PVC enabled. `persistence.media.enabled` RAPPS-WP-0014-T03 remains waiting: the September 25 rehearsal proved database
is `false`, so uploaded media is deferred rather than an S5 durability promise. restore and restart, with empty file stores and no off-host upload. A populated,
coherent three-store recovery point and restored workflow are still required.
The CNPG/storage backup mechanisms remain owned by `railiance-platform`.
## Ownership Matrix ## Ownership Matrix
@ -45,7 +48,7 @@ If this gate is missing, the app can still be used for smoke, development, or
migration validation, but promotion beyond that should create or link a migration validation, but promotion beyond that should create or link a
`railiance-platform` workplan. `railiance-platform` workplan.
## Production cluster inventory (2026-07-10) ## Historical production cluster inventory (2026-07-10)
Custodian delivery-lane snapshot Custodian delivery-lane snapshot
(`the-custodian/docs/evidence/vergabe-teilnahme-delivery-lane-20260710.json`) (`the-custodian/docs/evidence/vergabe-teilnahme-delivery-lane-20260710.json`)
@ -76,8 +79,9 @@ make cnpg-logical-backup # immediate / daily workstation run
make cnpg-backup-status make cnpg-backup-status
``` ```
**Unattended schedule (primary):** workstation cron (cluster pods lack egress to **Historical workstation schedule (superseded):** RAPPS-WP-0002 records the
install `age`; in-cluster CronJobs ship suspended until a prebuilt image exists): July 22 move to in-cluster CronJobs on CoulombCore and activity-core on
Railiance01. This old workstation example is not a current pilot backup receipt:
```cron ```cron
# Daily 02:30 UTC — Option A multi-cluster logical backup (RPO 24h) # Daily 02:30 UTC — Option A multi-cluster logical backup (RPO 24h)
@ -87,7 +91,7 @@ install `age`; in-cluster CronJobs ship suspended until a prebuilt image exists)
Barman `ObjectStore` / CNPG `ScheduledBackup` remain deferred (Phase 2 stubs in Barman `ObjectStore` / CNPG `ScheduledBackup` remain deferred (Phase 2 stubs in
`manifests/cnpg-backup-readiness.yaml`). `manifests/cnpg-backup-readiness.yaml`).
## `vergabe-teilnahme` Gate ## Historical `vergabe_db` gate
Current posture (2026-07-12): Current posture (2026-07-12):
@ -145,7 +149,7 @@ When the missing durability item is not local to S5:
1. Keep the S5 task focused on the app release impact. 1. Keep the S5 task focused on the app release impact.
2. Create or link the platform/forge workplan that owns the missing mechanism. 2. Create or link the platform/forge workplan that owns the missing mechanism.
3. Mark the S5 task `blocked` only when the app release cannot safely continue 3. Mark the S5 task `wait` and its workplan `blocked` when the app release cannot safely continue
without that upstream evidence. without that upstream evidence.
4. Record the State Hub workstream/task id in the app runbook or workplan. 4. Record the State Hub workstream/task id in the app runbook or workplan.
5. Revisit the S5 promotion gate after upstream evidence exists. 5. Revisit the S5 promotion gate after upstream evidence exists.

58
docs/evidence/2026-09-27-vergabe-binding-review.md Normal file
View file

@ -0,0 +1,58 @@
# Vergabe binding and loose-end review — 2026-09-27
Reviewed every workplan, including archived files. RAPPS-WP-0014 is the only
unfinished workplan; all other task blocks are done. No ready or proposed
workplan remains. No new workplan or task was created.
## Binding verification (read-only)
| Check | Result |
| --- | --- |
| Node / cluster | Ready, 92.205.62.239; kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 |
| Helm | vergabe-demo-company / vergabe-teilnahme, deployed revision 3, chart 0.2.1 |
| Deployment | Ready 1/1; image sha256:a26444f59c259698159c69ccb96f73dc648a261ece4c86bb2037a9d977870d91 |
| Requests / custody reference | 60m CPU, 256Mi memory; envFrom Secret reference vergabe-demo-env |
| Media / issue state | vergabe-teilnahme-media 5Gi and vergabe-teilnahme-app-state 1Gi, both Bound, local-path |
| TLS / health | vergabe-demo-tls Ready; HTTPS /demo-company/health/ returned 200 |
| Chart regression suite | 8 tests passed |
| Helm lint | Passed with admitted values plus SSO overlay |
Commands: `kubectl get nodes -o wide`, explicit namespace/deployment field
queries, `kubectl -n vergabe-demo-company get deployment,pvc,certificate`,
`helm list -n vergabe-demo-company -o json`, HTTPS health request,
`python3 -m unittest discover -s tests -p 'test_vergabe_pilot_chart.py'`, and
`helm lint charts/vergabe-teilnahme -f helm/vergabe-demo-company-values.proposed.yaml
-f helm/vergabe-demo-company-sso.proposed.yaml`.
The image/source/CI receipt is
[the revision 3 rollout](2026-09-12-account-recovery-live.md).
Database/role isolation and initial membership counts retain their dated
receipts in [the binding](../vergabe-demo-company-binding.md); no current user
list, database contents or Secret values were read for this review.
VERGABE-WP-0019 records the September 24 founder sign-in and still waits for
the fresh recipient journey and two-user acceptance. T02 can close on its
release-binding scope without claiming those separate gates passed.
## Remaining recovery gate
[September 25](2026-09-25-vergabe-demo-company-restore.md) proves a database
restore and pod restart only. File claims were empty and the encrypted database
artifact remained on the workstation. It does not prove populated media/issue
state recovery, off-host delivery, restored user workflow or safe rollback.
`warden route find` and `warden route show railiance-backup-offsite-lane`
identify railiance-platform's OpenBao/Nextcloud lane. With the documented local
OpenBao tunnel explicitly selected, `tools/check-backup-lane-auth.sh` confirmed
OpenBao is unsealed but returned **no valid caller token**. Bernd Worsch's
attended authentication is required for this workstation upload path; no secret
was fetched. This does not establish the health of separate unattended jobs.
RAPPS-WP-0014-T03 waits for the company workflow, a coherent off-host recovery
point for all three stores, isolated restored workflow, rollback evidence and
named support/incident ownership. The workplan is blocked. Existing product
owner tasks VERGABE-WP-0019-T04/T06 retain human acceptance. No runtime mutation,
substitute user login, backup upload or new recovery claim was made.
The policy-nexus ArgoCD inbox proposal was read. It belongs to the existing
rApp/platform onboarding plans and supplies no unfinished task in this repo;
this review does not approve its live adoption or open another plan.

24
docs/vergabe-demo-company-binding.md
View file

@ -1,7 +1,7 @@
# Vergabe demo-company deployment binding # Vergabe demo-company deployment binding
Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019. Updated 2026-09-27 under RAPPS-WP-0014 and VERGABE-WP-0019.
Application placement is live; native product sign-in and recovery acceptance remain open. Release binding is complete (RAPPS-WP-0014-T02). Recovery and invited-recipient acceptance remain open.
| Item | Current binding | | Item | Current binding |
| --- | --- | | --- | --- |
@ -18,7 +18,7 @@ Application placement is live; native product sign-in and recovery acceptance re
| Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg | | Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg |
| Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 | | Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 |
| Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 | | Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 |
| Authentication | NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending | | Authentication | NetKingdom company welcome and OIDC deployed; founder sign-in recorded September 24. Fresh recipient journey and two-user acceptance remain open |
| Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance | | Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance |
## Current SSO rollout ## Current SSO rollout
@ -89,10 +89,22 @@ on stdin; the durable credential copies are the two exact Kubernetes Secrets.
OpenBao automation remains a later owner improvement. Never rerun historical OpenBao automation remains a later owner improvement. Never rerun historical
bootstrap helpers or substitute apps_admin credentials. bootstrap helpers or substitute apps_admin credentials.
This is the first release in the fresh namespace; there is no previously Revision 3 is the current binding; revisions 1 and 2 are historical deployment
accepted application image to roll back to. On a failed next upgrade, stop public receipts, not demonstrated safe rollback targets. On a failed next upgrade,
traffic and reconcile schema/image compatibility before reverting. Retain the stop public traffic and reconcile schema/image compatibility before reverting. Retain the
claims and database; namespace deletion is not rollback. Pod replacement and claims and database; namespace deletion is not rollback. Pod replacement and
isolated restore must still be proven with matched PostgreSQL/media/SQLite data. isolated restore must still be proven with matched PostgreSQL/media/SQLite data.
Current recovery rollout: docs/evidence/2026-09-12-account-recovery-live.md. Current recovery rollout: docs/evidence/2026-09-12-account-recovery-live.md.
## Binding review — 2026-09-27
Read-only deployment, Helm, claim, certificate and HTTPS checks match this
binding; see [the verification receipt](evidence/2026-09-27-vergabe-binding-review.md).
The September 25 database restore and pod restart passed, but populated media
and issue-state recovery, an off-host copy, restored two-user workflow and
rollback/support acceptance remain RAPPS-WP-0014-T03. That task is waiting and
the workplan is blocked. Earlier dated sections describe their original
snapshots; the current binding table and this review supersede their pending
DNS, deployment and first-login statements.

22
docs/vergabe-teilnahme-pilot.md
View file

@ -9,8 +9,9 @@ the historical deployment is still live.
Before native admission, record the following non-secret values in the company Before native admission, record the following non-secret values in the company
binding. The user selects a fresh `demo-company` workspace; see binding. The user selects a fresh `demo-company` workspace; see
[its prepared binding](vergabe-demo-company-binding.md). Native tenant/user/password setup is verified; application hostname admission [its prepared binding](vergabe-demo-company-binding.md). Native tenant/user/password setup, hostname admission and product placement are
and product placement remain pending. verified. The binding task closed on 2026-09-27; recovery and recipient
acceptance remain blocked in the existing tasks.
| Binding | Required evidence | | Binding | Required evidence |
| --- | --- | | --- | --- |
@ -72,20 +73,21 @@ HA is not claimed.
## Manual onboarding and acceptance ## Manual onboarding and acceptance
Use the existing Django administration via the admitted operator path to create The current demo-company release uses NetKingdom OIDC and the company welcome
ordinary active members. Keep staff/superuser access with the designated flow. Provision ordinary members through the native User Engine journey and
operator. Supply initial credentials over the existing private human channel; have each invited recipient complete their own login/MFA and confirmation.
never paste them into Git, State Hub, command arguments or chat. Members can Do not substitute shared Django passwords or staff identities for this gate.
change passwords in the UI; operators handle reset and deactivation manually. The founder's September 24 sign-in is recorded; a fresh recipient journey and
Do not run `seed_dev` on a pilot/customer database. two-user acceptance remain VERGABE-WP-0019-T04/T06. Never place credentials or
setup links in work records, and do not run `seed_dev` on a pilot database.
Before admitting the first users, verify HTTPS login, CSRF failure behavior, Before admitting the first users, verify HTTPS login, CSRF failure behavior,
anonymous document refusal, two separate user sessions and deactivation of an anonymous document refusal, two separate user sessions and deactivation of an
already logged-in account. Complete the tender → lot → task/document → domain already logged-in account. Complete the tender → lot → task/document → domain
approval → submission workflow and feedback with the company contact. Customer approval → submission workflow and feedback with the company contact. Customer
support contact, incident routing and backup responsibility must be recorded. support contact, incident routing and backup responsibility must be recorded.
Pricing, automated invitation email, SSO and shared tenancy can be considered Pricing, automated invitation email and shared tenancy remain outside this
later; none is implied by this initial pilot contract. pilot contract. SSO is deployed; recipient acceptance remains a separate gate.
## Current inventory — 2026-09-11 ## Current inventory — 2026-09-11

36
workplans/RAPPS-WP-0014-vergabe-invited-pilot.md
View file

@ -4,12 +4,12 @@ type: workplan
title: "Deploy and recover the first invited Vergabe company pilot" title: "Deploy and recover the first invited Vergabe company pilot"
domain: financials domain: financials
repo: railiance-apps repo: railiance-apps
status: active status: blocked
flavor: implementation flavor: implementation
owner: the-custodian owner: the-custodian
topic_slug: railiance topic_slug: railiance
created: "2026-09-11" created: "2026-09-11"
updated: "2026-09-25" updated: "2026-09-27"
related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001, CUST-WP-0071] related: [VERGABE-WP-0019, VERGABE-WP-0018, HFACT-WP-0001, CUST-WP-0071]
state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57" state_hub_workstream_id: "c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57"
--- ---
@ -38,9 +38,9 @@ values template prepare the deployment; no live resources were changed.
```task ```task
id: RAPPS-WP-0014-T02 id: RAPPS-WP-0014-T02
status: progress status: done
needs_human: false needs_human: false
intervention_note: "DNS, TLS and application placement are verified. Product SSO/welcome and pilot/recovery acceptance remain in the existing owner tasks." intervention_note: "Binding complete: revision 3, immutable image, DNS/TLS, database custody and both PVCs verified. Recipient acceptance remains VERGABE-WP-0019-T04/T06; recovery remains T03."
priority: high priority: high
assignee: the-custodian assignee: the-custodian
state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897" state_hub_task_id: "b00958c8-1401-5ebf-bc22-c0252618d897"
@ -181,15 +181,25 @@ confirmation are now requested from the operator; no user credential was used
by the agent. Recovery and two-user acceptance remain their existing tasks. by the agent. Recovery and two-user acceptance remain their existing tasks.
Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md. Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
2026-09-27 closeout: T02 is done. Read-only verification confirms release
revision 3, chart 0.2.1 and the recorded `a26444f5…` image, Ready 1/1,
60m/256Mi requests, both Bound claims, Ready TLS and HTTP 200 health. The
September 24 founder sign-in resolves the former issuer-login wait. Exact
binding is complete; the invited recipient journey and two-user acceptance
remain VERGABE-WP-0019-T04/T06, and recovery remains T03. See
`docs/evidence/2026-09-27-vergabe-binding-review.md`.
## Demonstrate restart, isolated restore, rollback and operating ownership ## Demonstrate restart, isolated restore, rollback and operating ownership
```task ```task
id: RAPPS-WP-0014-T03 id: RAPPS-WP-0014-T03
status: progress status: wait
needs_human: true
intervention_note: "Bernd Worsch and the company contact must complete two-user/document acceptance; railiance-platform owns offsite access and storage backup delivery. Then complete the coherent isolated restore and rollback receipt under this task."
priority: high priority: high
assignee: the-custodian assignee: the-custodian
depends_on: [RAPPS-WP-0014-T02] depends_on: [RAPPS-WP-0014-T02]
blocking_reason: "Database restore and app restart are proved. Two-user collaboration and a document round-trip are still open." blocking_reason: "Await populated two-user/document workflow, coherent PostgreSQL/media/issue-state off-host recovery point, isolated restored workflow, rollback evidence and support ownership. September 25 proves database restore and restart only."
state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1" state_hub_task_id: "dd069c6d-fcc1-5bac-b233-976f2f0d5cd1"
``` ```
@ -218,3 +228,17 @@ The app pod was recreated and `/demo-company/health/` returned 200. The age
file stayed on the workstation; the Nextcloud upload was not run. Two-user file stayed on the workstation; the Nextcloud upload was not run. Two-user
collaboration and a document round-trip remain. Evidence: collaboration and a document round-trip remain. Evidence:
`docs/evidence/2026-09-25-vergabe-demo-company-restore.md`. `docs/evidence/2026-09-25-vergabe-demo-company-restore.md`.
2026-09-27 loose-end review: T03 now waits and this workplan is blocked.
The September 25 database-only drill and empty file claims do not satisfy the
three-store recovery contract. Complete the populated synthetic workflow with
Bernd Worsch and the company contact, obtain a matched off-host recovery point
through railiance-platform, restore into an isolated database and separate
claims, verify both users and document checksums, and record schema-compatible
rollback plus named incident/support ownership. Credential routing confirms
`railiance-backup-offsite-lane` belongs to railiance-platform; a resolvable route
alone is not an authenticated upload or a backup receipt. The safe auth check
confirmed OpenBao unsealed but no valid caller token, so the workstation upload
path needs Bernd Worsch's attended login. Existing tasks retain
all remaining work; no task or workplan was opened.