Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3)

Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

registry/capabilities/capability.railiance.workload-deployment-tooling.md

@@ -0,0 +1,127 @@
+---
+id: capability.railiance.workload-deployment-tooling
+name: Railiance Application Workload Deployment Tooling
+summary: S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases,
+  Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.
+owner: railiance-apps
+status: draft
+domain: financials
+tags:
+- railiance
+- kubernetes
+- helm
+- deployment
+maturity:
+  discovery:
+    current: D3
+    target: D4
+    confidence: medium
+    rationale: SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to
+      application Helm releases, workload manifests, and operator runbooks for user-facing services such
+      as vergabe-teilnahme.
+  availability:
+    current: A2
+    target: A3
+    confidence: medium
+    rationale: No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh,
+      check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh,
+      smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already.
+external_evidence:
+  completeness:
+    level: C1
+    confidence: low
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+    - Helm charts and Kubernetes manifests for application workloads
+    - smoke-test and dry-run check scripts, including a forgejo-smoke.sh already ahead of the platform-wide
+      Forgejo transition
+    broken_expectations: []
+    out_of_scope_expectations: []
+  reliability:
+    level: R1
+    confidence: low
+    basis: consumer_quality_signals
+    known_reliability_risks:
+    - no top-level packaging; tooling is a collection of shell scripts under tools/
+discovery:
+  intent: 'Own the S5 layer of the Railiance OAS Stack: deploying and verifying user-facing application
+    workloads via Helm/Kubernetes with guardrails and operator runbooks.'
+  includes:
+  - application Helm releases and Kubernetes workload manifests
+  - deployment guardrails
+  - smoke-test and dry-run tooling (including forgejo-smoke.sh)
+  excludes:
+  - cluster/platform substrate (see railiance-cluster, railiance-platform)
+  - CI/CD enablement templates (see railiance-enablement)
+  assumptions: []
+  use_cases: []
+  research_memos: []
+availability:
+  current_level: A2
+  target_level: A3
+  current_artifacts:
+  - Helm charts
+  - Kubernetes manifests
+  - tools/*.sh smoke and check scripts
+  target_artifacts: []
+  consumption_modes:
+  - cli (shell scripts)
+  - helm/kubernetes deployment
+relations:
+  depends_on: []
+  supports: []
+  related_to: []
+evidence:
+  documentation:
+  - SCOPE.md
+  tests:
+  - tools/forgejo-smoke.sh
+  - tools/inter-hub-smoke.sh
+  - tools/k8s-server-dry-run.sh
+  consumer_feedback: []
+  bug_reports: []
+  incidents: []
+consumer_guidance:
+  recommended_for:
+  - operators deploying or verifying Railiance user-facing application workloads
+  not_recommended_for:
+  - needs at the cluster/platform substrate layer (see railiance-cluster, railiance-platform)
+  known_limitations:
+  - no unified packaging; tooling is a set of independent shell scripts
+promotion_history: []
+---
+
+# Railiance Application Workload Deployment Tooling
+
+## Overview
+
+`railiance-apps` is the S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack: Helm releases, Kubernetes workload manifests, deployment guardrails, and operator runbooks for user-facing services such as `vergabe-teilnahme`, including a `forgejo-smoke.sh` check already ahead of the platform-wide Gitea-to-Forgejo transition.
+
+## Assessment notes
+
+### Discovery
+
+SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to application Helm releases, workload manifests, and operator runbooks for user-facing services such as vergabe-teilnahme.
+
+### Availability
+
+No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh, check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh, smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already.
+
+### Completeness
+
+First-pass honest assessment from the REUSE-WP-0017 coverage campaign
+(reuse-surface). No external consumer feedback exists yet; levels reflect
+scope-vs-intent documentation quality, not internal code quality.
+
+### Reliability
+
+No production consumer telemetry exists yet; reliability level is
+intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
+
+## Promotion checklist
+
+- [x] ID follows `capability.<domain>.<name>` pattern
+- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
+- [x] `external_evidence` is populated separately from `maturity`
+- [ ] Relations reference valid capability IDs (none yet)
+- [x] Index entry added in `registry/indexes/capabilities.yaml`