Record deployed Vergabe pilot chart and company sign-in evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

charts/vergabe-teilnahme/Chart.yaml

@@ -4,7 +4,7 @@ description: |
   Vergabe Teilnahme — internal Django tender/bid management web app.
   Single-instance v1 deployment; HA and canary are deferred.
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "0.1.0"
 keywords:
   - django

charts/vergabe-teilnahme/templates/deployment.yaml

@@ -21,7 +21,25 @@ spec:
     metadata:
       labels: {{- include "vergabe.selectorLabels" . | nindent 8 }}
     spec:
+      automountServiceAccountToken: false
       securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- if .Values.migrations.enabled }}
+      initContainers:
+        - name: migrate
+          image: {{ include "vergabe.image" . | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ["python", "manage.py", "migrate", "--noinput"]
+          securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
+          envFrom:
+            - secretRef:
+                name: {{ .Values.envSecretName | quote }}
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+          resources: {{- toYaml .Values.resources | nindent 12 }}
+      {{- end }}
       containers:
         - name: app
           image: {{ include "vergabe.image" . | quote }}

charts/vergabe-teilnahme/values.yaml

@@ -4,6 +4,10 @@ image:
   digest: ""          # preferred; takes precedence over tag
   pullPolicy: IfNotPresent
 
+# Opt in after reviewing migrations; runs before serving traffic, within the same pod request.
+migrations:
+  enabled: false
+
 replicaCount: 1       # v1 is single-instance; HA is deferred (RAILIANCE-WP-0002 Notes)
 
 # An invited company pilot requires an immutable image and both data volumes.

docs/evidence/2026-09-12-demo-company-deployment.md

@@ -0,0 +1,36 @@
+# Demo-company deployment receipt
+
+2026-09-12 deployment evidence: the operator added A records for
+vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS
+and recursive readback both return 92.205.62.239. Both cert-manager certificates
+are Ready. The portal now uses https://users.coulomb.social/login; its legacy
+nip.io address redirects to the canonical hostname. The exact new callback is
+registered alongside the rollback callback; scopes, public client type and PKCE
+remain unchanged. Canonical authorization succeeds; unapproved callback and
+missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.
+
+Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company,
+chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
+Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init
+migration completed before the web process; both phases share the same 60m CPU /
+256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder
+matches the accepted prototype allocation. No unrelated resource requests changed.
+
+RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and
+runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection
+confirms that exact database/role. The role is non-superuser, cannot create roles
+or databases, has a 20-connection ceiling and 15-second timeouts, and cannot
+CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated
+PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected
+or overwritten; no credentials are recorded here.
+
+Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped
+CSRF cookie, anonymous login gate and media refusal, private operational path
+refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and
+missing-CSRF POST denial. Migration/app initialization also proves consumer
+connectivity. The empty product has zero accounts, including zero staff accounts.
+The current login is still the interim Django login, not NetKingdom SSO. Native
+recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06.
+RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore;
+the latest existing apps-pg base backup predates this new database. No pilot-user
+acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.

docs/evidence/2026-09-12-demo-company-sso-live.md

@@ -0,0 +1,27 @@
+# Demo-company sign-in live rollout
+
+Recorded 2026-09-12T01:09:00.835106+00:00
+
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
+
+| Component | Deployed digest |
+| --- | --- |
+| Vergabe | sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e |
+| KeyCape | sha256:5f10f36a5da23ce1aaf3df9b84a8ff98d7926f34ceaa19e63bd3356adb68e01a |
+| Password setup | sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6 |
+
+Cluster UID: a553c742-0115-43d4-99a4-a5ca56fe0786. The operator explicitly approved the prepared attended rollout. Shared issuer startup is proven; authenticated recipient token/account acceptance remains pending.

docs/vergabe-demo-company-binding.md

@@ -1,95 +1,96 @@
 # Vergabe demo-company deployment binding
 
-Prepared 2026-09-11 under RAPPS-WP-0014-T02 and VERGABE-WP-0019-T03/T04.
+Updated 2026-09-12 under RAPPS-WP-0014 and VERGABE-WP-0019.
-Native tenant, user and password setup are verified; application placement and product onboarding remain pending.
+Application placement is live; native product sign-in and recovery acceptance remain open.
 
-| Item | Binding / execution status |
+| Item | Current binding |
 | --- | --- |
-| Tenant | `tenant:trial:demo-company`; display `demo-company`; active, version 1; native operator create/readback verified |
+| Tenant | tenant:trial:demo-company, active/version 1; three native memberships and one linked directory identity |
-| Purpose / data | New demo workspace; synthetic data only; no existing data import |
+| Data | Fresh synthetic demo workspace; no historical import |
-| Initial accounts | Three native memberships; one linked identity with operator-confirmed password setup. Remaining identities, actual login-name mapping and product accounts still require verification |
+| Portal | https://users.coulomb.social/login |
-| Operator / acceptance | Bernd Worsch via authenticated existing operator path |
+| Product | https://vergabe-teilnahme.coulomb.social/demo-company/ |
-| Cluster | Railiance01, kube-system UID `a553c742-0115-43d4-99a4-a5ca56fe0786` |
+| DNS / TLS | Both hostnames resolve to 92.205.62.239; certificates Ready |
-| Proposed namespace | `vergabe-demo-company`; create separately from historical installations |
+| Cluster | Railiance01, kube-system UID a553c742-0115-43d4-99a4-a5ca56fe0786 |
-| Helm release | `vergabe-teilnahme` within that namespace |
+| Namespace / release | vergabe-demo-company / vergabe-teilnahme, revision 2 |
-| Image source | Tenant-path source `9345a1bb1a92ac0ee3b2dc6443a3d299e6754e70`; CI smoke 43 / publication 44 passed |
+| Source / image | 8be281025bf57a7aefd1fe98a7e060f2173df5ef; image 51 / acceptance 52 / smoke 53; sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e |
-| Image digest | `forgejo.coulomb.social/coulomb/vergabe-teilnahme@sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68` |
+| Chart / rollout | 0.2.1; one Recreate replica; init migration before serving; Ready 1/1 |
-| Chart baseline | 0.2.0 at railiance-apps `9491744e5adab4464070c164d7172a7392ae1e15` |
+| Resources | 60m CPU / 256Mi memory request; 1000m CPU / 1Gi memory limit |
-| Resources | One Recreate replica, CPU request 60m / limit 1000m, memory request 256Mi / limit 1Gi |
+| Database / role | Fresh vergabe_demo_company / vergabe_demo_company, databases/apps-pg |
-| Selected URL | `https://vergabe-teilnahme.coulomb.social/demo-company/`; one product host, exact tenant path |
+| Runtime custody | vergabe-demo-company/vergabe-demo-env; platform helper receipt in RPF-WP-0039 |
-| Public edge | DNS, TLS and login abuse-control configuration pending; expected target 92.205.62.239 |
+| Media / issue state | Separate Bound local-path PVCs, 5Gi / 1Gi; UID/GID/fsGroup 999 |
-| Proposed database / role | Fresh `vergabe_demo_company` / `vergabe_demo_company` on `databases/apps-pg`; platform provisioning/custody pending |
+| Authentication | NetKingdom company welcome and OIDC deployed; initial readback zero accounts. Actual recipient login/MFA pending |
-| Runtime Secret | `vergabe-demo-env` in the dedicated namespace; platform delivery pending, no secret values in this packet |
+| Remaining handoffs | VERGABE-WP-0019-T06 welcome/SSO; RAPPS-WP-0014-T03 recovery; VERGABE-WP-0019-T04 pilot acceptance |
-| Media / app state | Separate `vergabe-teilnahme-media` 5Gi and `vergabe-teilnahme-app-state` 1Gi PVCs, local-path; native creation pending |
-| Recovery / support | Existing RAPPS-WP-0014-T03 retains off-host recovery point, isolated restore, rollback and operating responsibility evidence |
 
-The target database is a proposed new consumer, not permission to reuse or
+## Current SSO rollout
-overwrite `vergabe_db`. Refresh managed-consumer count, placement and migration
-demand before applying. Tenant creation itself does not depend on this hostname.
 
-## Native tenant and identity execution
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
 
-Use the existing User Engine portal at `https://users.92-205-62-239.nip.io`.
+## Initial deployment verification
-Its `/login` uses KeyCape and the registered native callback. The authenticated
-platform form creates `tenant:trial:demo-company` through Tenant Engine. Record
-the response and read back the exact tenant before creating memberships. Do not
-substitute a service actor, fabricate verified claims, or bypass policy on denial.
-Native login and operator creation succeeded at 19:03:18 UTC. Tenant Engine
-confirms demo-company active/version 1; User Engine contains the first
-administrator with invited status. A subsequent Create login failed with an
-LLDAP service-login 401. The operator completed NK-WP-0036-T04's attended
-credential-reference repair: provider and consumer login now pass, independently
-verified with a directory read; the provider password and image are unchanged.
-The operator confirms successful user password setup on 2026-09-12. Independent
-read-only User Engine evidence shows three memberships and one linked identity.
-USER-WP-0025 also delivered operator navigation, logout and tenant-name selection.
-Remaining identity and product access are verified separately.
 
-Create two ordinary memberships through User Engine. Confirm how the identity
+2026-09-12 deployment evidence: the operator added A records for
-provisioner assigns login names before provisioning the requested demo names;
+vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS
-do not invent deliverable email addresses or send invitations to third parties.
+and recursive readback both return 92.205.62.239. Both cert-manager certificates
-The current product uses separately provisioned Django accounts, with no staff
+are Ready. The portal now uses https://users.coulomb.social/login; its legacy
-or superuser flags. Preserve the mapping to this tenant's isolated deployment.
+nip.io address redirects to the canonical hostname. The exact new callback is
-This establishes a platform tenant and a bounded app pilot, not completed SSO.
+registered alongside the rollback callback; scopes, public client type and PKCE
+remain unchanged. Canonical authorization succeeds; unapproved callback and
+missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.
 
-## Hostname and deployment execution
+Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company,
+chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
+Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init
+migration completed before the web process; both phases share the same 60m CPU /
+256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder
+matches the accepted prototype allocation. No unrelated resource requests changed.
 
-`helm/vergabe-demo-company-values.proposed.yaml` retains 60m resources and the
+RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and
-selected product host, APP_BASE_PATH=/demo-company and published immutable
+runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection
-digest. The chart does not create ingress or DNS.
+confirms that exact database/role. The role is non-superuser, cannot create roles
-The edge must match exactly /demo-company or /demo-company/, canonicalize the
+or databases, has a 20-connection ceiling and 15-second timeouts, and cannot
-bare path and strip the prefix. It must keep private media on the app route and
+CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated
-apply TLS and the admitted abuse-control policy. Do not route neighboring paths
+PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected
-to this instance. Company/data separation remains the dedicated database and
+or overwritten; no credentials are recorded here.
-volumes, not a forwarded header or browser path.
 
-On 2026-09-11 the selected product hostname resolves to 80.158.43.29; Railiance01
+Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped
-is 92.205.62.239. No DNS changes have been made. A single product DNS/certificate
+CSRF cookie, anonymous login gate and media refusal, private operational path
-serves this arrangement; tenants do not need their own subdomains.
+refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and
+missing-CSRF POST denial. Migration/app initialization also proves consumer
+connectivity. The empty product has zero accounts, including zero staff accounts.
+The current login is still the interim Django login, not NetKingdom SSO. Native
+recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06.
+RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore;
+the latest existing apps-pg base backup predates this new database. No pilot-user
+acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.
 
-Complete platform database/Secret provisioning and the source-backed namespace,
+## Source and rollback
-network and public edge manifests before deployment. Then migrate the fresh
-database, deploy, provision the demo app accounts, and perform the two-user
-workflow plus restart/isolated-restore checks in the existing owner tasks.
-Only then record the demo environment as available for use.
 
-Validation on 2026-09-11: Helm lint passed. Rendering the proposed values
+`helm/vergabe-demo-company-foundation.yaml` owns namespace/network policies and
-produced the pinned digest, one Recreate replica, 60m CPU request, matching
+certificate. `helm/vergabe-demo-company-ingress.yaml` owns the exact host and
-Django/probe hosts, and two distinct retained PVCs. This is local manifest
+company-prefix route, canonical slash, prefix stripping, headers and rate limit
-verification; it is not native deployment or tenant-creation evidence.
+(60 requests/minute/IP, burst 20). Private media stays behind Django. The
+existing proposed-values filename now records the admitted binding.
 
+`railiance-platform/tools/provision-vergabe-demo.py` owns the fixed fresh
+credential/database lane. It captures all child output and passes values only
+on stdin; the durable credential copies are the two exact Kubernetes Secrets.
+OpenBao automation remains a later owner improvement. Never rerun historical
+bootstrap helpers or substitute apps_admin credentials.
 
-The next product handoff is VERGABE-WP-0019-T06: preserve the invited tenant and
+This is the first release in the fresh namespace; there is no previously
-recipient through an allow-listed password-setup return and land on the admitted
+accepted application image to roll back to. On a failed next upgrade, stop public
-demo-company welcome/sign-in path. Product authentication must validate its own
+traffic and reconcile schema/image compatibility before reverting. Retain the
-NetKingdom identity and tenant; it must not reuse the operator's portal session
+claims and database; namespace deletion is not rollback. Pod replacement and
-or silently grant staff privileges. No application SSO is implemented yet.
+isolated restore must still be proven with matched PostgreSQL/media/SQLite data.
-
-
-Latest DNS evidence, 2026-09-12: both the recursive resolver and authoritative
-ns1047.ui-dns.biz return NXDOMAIN for the product hostname (A and AAAA queried
-recursively). This supersedes the earlier 80.158.43.29 observation for current
-execution. The zone is served by IONOS ui-dns nameservers. The operator was asked
-to add only A vergabe-teilnahme.coulomb.social → 92.205.62.239, TTL 300 or default.
-No DNS credentials were requested or retrieved; native record readback and TLS
-remain pending. Tenant paths continue sharing this one product hostname.

docs/vergabe-demo-company-sso-rollout.md

@@ -1,9 +1,12 @@
-# Demo-company sign-in: prepared attended rollout
+# Demo-company sign-in: executed attended rollout
 
 2026-09-12, VERGABE-WP-0019-T06 / KEY-WP-0033 / NK-WP-0037.
-Source, release images and server dry runs are complete. This packet has not
+The operator approved and the prepared rollout was applied on 2026-09-12.
-been applied to the running services. The existing application still serves
+All three services are Ready; Helm revision 2 serves the company welcome and
-its interim local login.
+NetKingdom sign-in. Native invited-user/MFA acceptance remains pending.
+See docs/evidence/2026-09-12-demo-company-sso-live.md.
+
+The preparation and rollback record follows.
 
 | Component | Source | Published digest |
 | --- | --- | --- |
@@ -84,3 +87,19 @@ bootstrap commands. Preserve data and the approved client configuration.
 This release's native recipient/MFA acceptance is still open. RAPPS-WP-0014-T03
 retains the coherent backup/isolated restore and pod-replacement proof;
 VERGABE-WP-0019-T04 retains two-user collaboration and pilot acceptance.
+
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.

docs/vergabe-teilnahme-pilot.md

@@ -160,3 +160,41 @@ custody, placement and recovery. VERGABE-WP-0019-T06 now explicitly tracks the
 requested tenant welcome and connection to the new NetKingdom identity. The
 earlier manually provisioned Django account path remains an interim capability;
 it does not make the directory password a product credential or implement SSO.
+
+
+## Live demo placement — 2026-09-12
+
+2026-09-12 deployment evidence: the operator added A records for
+vergabe-teilnahme.coulomb.social and users.coulomb.social. Authoritative IONOS
+and recursive readback both return 92.205.62.239. Both cert-manager certificates
+are Ready. The portal now uses https://users.coulomb.social/login; its legacy
+nip.io address redirects to the canonical hostname. The exact new callback is
+registered alongside the rollback callback; scopes, public client type and PKCE
+remain unchanged. Canonical authorization succeeds; unapproved callback and
+missing PKCE fail. This supersedes earlier DNS and portal-hostname blockers.
+
+Helm release vergabe-teilnahme revision 1 is deployed in vergabe-demo-company,
+chart 0.2.1, pinned product digest cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68.
+Deployment UID 2152014d-a020-4c5e-a3b0-9575e9f21c44 is Ready 1/1. Its init
+migration completed before the web process; both phases share the same 60m CPU /
+256Mi memory request. Node requests now total 3965m of 4000m; the 35m remainder
+matches the accepted prototype allocation. No unrelated resource requests changed.
+
+RPF-WP-0039 delivered fresh vergabe_demo_company database/role on apps-pg and
+runtime Secret vergabe-demo-company/vergabe-demo-env. The app's own connection
+confirms that exact database/role. The role is non-superuser, cannot create roles
+or databases, has a 20-connection ceiling and 15-second timeouts, and cannot
+CONNECT to historical vergabe_db, coulomb_social_db or apps_meta. Both dedicated
+PVCs are Bound: 5Gi media and 1Gi issue state. Historical data was not selected
+or overwritten; no credentials are recorded here.
+
+Thirteen live Chromium/HTTP checks pass: page and assets, secure tenant-scoped
+CSRF cookie, anonymous login gate and media refusal, private operational path
+refusal, neighboring/root path refusal, canonical slash, HTTPS redirect and
+missing-CSRF POST denial. Migration/app initialization also proves consumer
+connectivity. The empty product has zero accounts, including zero staff accounts.
+The current login is still the interim Django login, not NetKingdom SSO. Native
+recipient login, company welcome and account mapping remain VERGABE-WP-0019-T06.
+RAPPS-WP-0014-T03 retains restart and coherent off-host backup/isolated restore;
+the latest existing apps-pg base backup predates this new database. No pilot-user
+acceptance, shared tenancy, MFA completion or natural factory-worker trace is claimed.

helm/vergabe-demo-company-foundation.yaml

@@ -0,0 +1,94 @@
+# RAPPS-WP-0014: admitted empty demo workspace; no credentials or database data.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vergabe-demo-company
+  labels:
+    railiance.io/workload-class: application
+    railiance.io/postgres-client: apps-pg
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny
+  namespace: vergabe-demo-company
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: vergabe-runtime
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: vergabe-teilnahme
+      app.kubernetes.io/instance: vergabe-teilnahme
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8000
+  egress:
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: databases
+      podSelector:
+        matchLabels:
+          cnpg.io/cluster: apps-pg
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-acme-http01
+  namespace: vergabe-demo-company
+spec:
+  podSelector:
+    matchLabels:
+      acme.cert-manager.io/http01-solver: 'true'
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: kube-system
+    ports:
+    - protocol: TCP
+      port: 8089
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vergabe-demo-tls
+  namespace: vergabe-demo-company
+spec:
+  secretName: vergabe-demo-tls
+  dnsNames:
+  - vergabe-teilnahme.coulomb.social
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod

helm/vergabe-demo-company-ingress.yaml

@@ -0,0 +1,116 @@
+# Exact product hostname and isolated company path. Private media stays in Django.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-security
+  namespace: vergabe-demo-company
+spec:
+  chain:
+    middlewares:
+    - name: vergabe-rate-limit
+    - name: vergabe-headers
+    - name: vergabe-canonical-path
+    - name: vergabe-strip-tenant
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-rate-limit
+  namespace: vergabe-demo-company
+spec:
+  rateLimit:
+    average: 60
+    period: 1m
+    burst: 20
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-headers
+  namespace: vergabe-demo-company
+spec:
+  headers:
+    stsSeconds: 31536000
+    contentTypeNosniff: true
+    frameDeny: true
+    referrerPolicy: same-origin
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-canonical-path
+  namespace: vergabe-demo-company
+spec:
+  redirectRegex:
+    regex: ^(https?://vergabe-teilnahme\.coulomb\.social/demo-company)(\?.*)?$
+    replacement: ${1}/${2}
+    permanent: false
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-strip-tenant
+  namespace: vergabe-demo-company
+spec:
+  stripPrefix:
+    prefixes:
+    - /demo-company
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: vergabe-https
+  namespace: vergabe-demo-company
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vergabe-demo-company
+  namespace: vergabe-demo-company
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: 'true'
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-security@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - path: /demo-company
+        pathType: Prefix
+        backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+  tls:
+  - secretName: vergabe-demo-tls
+    hosts:
+    - vergabe-teilnahme.coulomb.social
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: vergabe-demo-company-vergabe-https@kubernetescrd
+  name: vergabe-demo-company-http
+  namespace: vergabe-demo-company
+spec:
+  ingressClassName: traefik
+  rules:
+  - host: vergabe-teilnahme.coulomb.social
+    http:
+      paths:
+      - backend:
+          service:
+            name: vergabe-teilnahme
+            port:
+              number: 80
+        path: /demo-company
+        pathType: Prefix

helm/vergabe-demo-company-values.proposed.yaml

@@ -1,10 +1,12 @@
-# Proposed binding only; see docs/vergabe-demo-company-binding.md.
+# Admitted demo binding; see docs/vergabe-demo-company-binding.md.
-# Tenant and published image are verified; database/Secret and DNS/TLS admission are pending.
+# Fresh database only. Init migration shares the application scheduling envelope.
 # Release vergabe-teilnahme; namespace vergabe-demo-company.
 pilot:
   enabled: true
 image:
-  digest: sha256:cebe8ca6218cc89f903e8a69e06ac50d3812526d4119cf4da485cc173f674b68
+  digest: sha256:2cb393608a82be2851adfc27f2bf4d8ef5d709f1b0038be5d0999e38c68b039e
+migrations:
+  enabled: true
 replicaCount: 1
 resources:
   requests:
@@ -15,6 +17,12 @@ resources:
     memory: 1Gi
 envSecretName: vergabe-demo-env
 env:
+  NETKINGDOM_ENABLED: "true"
+  NETKINGDOM_ISSUER: https://kc.coulomb.social
+  NETKINGDOM_CLIENT_ID: vergabe-demo-company
+  NETKINGDOM_CALLBACK: https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/
+  NETKINGDOM_TENANT: tenant:trial:demo-company
+  COMPANY_DISPLAY_NAME: Demo Company
   APP_BASE_PATH: /demo-company
   DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod
   ALLOWED_HOSTS: vergabe-teilnahme.coulomb.social,localhost

tests/test_vergabe_pilot_chart.py

@@ -59,6 +59,20 @@ class PilotChartTests(unittest.TestCase):
             self.assertEqual(claim['metadata']['annotations']['helm.sh/resource-policy'], 'keep')
         self.assertEqual(pod['securityContext']['fsGroup'], 999)
 
+    def test_migrations_finish_before_serving_with_same_identity_and_resource_request(self):
+        values = pilot()
+        values.update(migrations={'enabled': True}, resources={'requests': {'cpu': '60m'}})
+        deployment = next(o for o in self.objects(values) if o['kind'] == 'Deployment')
+        pod = deployment['spec']['template']['spec']
+        init, app = pod['initContainers'][0], pod['containers'][0]
+        self.assertEqual(init['command'], ['python', 'manage.py', 'migrate', '--noinput'])
+        for key in ('image', 'envFrom', 'env', 'resources', 'securityContext'):
+            self.assertEqual(init[key], app[key])
+        self.assertEqual(init['resources']['requests']['cpu'], '60m')
+        self.assertFalse(pod['automountServiceAccountToken'])
+        legacy = next(o for o in self.objects(pilot()) if o['kind'] == 'Deployment')
+        self.assertNotIn('initContainers', legacy['spec']['template']['spec'])
+
     def test_pilot_refuses_each_ephemeral_store(self):
         for store in ('media', 'appState'):
             with self.subTest(store=store):

workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

@@ -164,6 +164,22 @@ recipient/MFA and product acceptance stay with VERGABE-WP-0019-T06; recovery
 remains T03 here. No live runtime changes were made in this continuation.
 
 
+
+2026-09-12 attended rollout executed after explicit operator approval. KeyCape
+and password setup are Ready on the prepared digests; exact public client
+registration was CAS-applied (config resourceVersion 60123977) with unrelated
+config bytes/Secret data preserved. Existing portal and product client both
+pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks).
+Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain,
+and requests remain 60m CPU/256Mi memory. Eleven live product checks pass:
+company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only
+login start, native issuer redirect, private company/media protection and
+invalid callback/confirmation rejection. Initial readback showed zero accounts,
+identity mappings and staff accounts. Native invited-user sign-in/MFA and
+confirmation are now requested from the operator; no user credential was used
+by the agent. Recovery and two-user acceptance remain their existing tasks.
+Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.
+
 ## Demonstrate restart, isolated restore, rollback and operating ownership
 
 ```task