Close policy nexus production rollout

WORK-RECORDS.md

@@ -10,7 +10,7 @@
 | --- | --- | --- | --- | --- |
 | workplan | RAILIANCE-WP-0015 | finished | — | workplans/RAILIANCE-WP-0015-cnpg-backup-scheduledbackup-coverage.md |
 | workplan | RAILIANCE-WP-0016 | finished | — | workplans/RAILIANCE-WP-0016-railiance01-activity-core-backup-automation.md |
-| workplan | RAILIANCE-WP-0018 | active | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
+| workplan | RAILIANCE-WP-0018 | finished | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
 | task | RAILIANCE-WP-0015-T01 | done | — | workplans/RAILIANCE-WP-0015-cnpg-backup-scheduledbackup-coverage.md |
 | task | RAILIANCE-WP-0015-T02 | done | — | workplans/RAILIANCE-WP-0015-cnpg-backup-scheduledbackup-coverage.md |
 | task | RAILIANCE-WP-0015-T03 | done | — | workplans/RAILIANCE-WP-0015-cnpg-backup-scheduledbackup-coverage.md |
@@ -26,4 +26,4 @@
 | task | RAILIANCE-WP-0018-T01 | done | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
 | task | RAILIANCE-WP-0018-T02 | done | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
 | task | RAILIANCE-WP-0018-T03 | done | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
-| task | RAILIANCE-WP-0018-T04 | progress | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |
+| task | RAILIANCE-WP-0018-T04 | done | — | workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md |

docs/policy-nexus-production.md

@@ -58,3 +58,9 @@ make policy-nexus-smoke
 After an emergency rollback, restore the binding file to the four immutable
 identities actually serving and capture the smoke output. The package promises
 restart recovery on the single-node reef, not multi-node high availability.
+
+The rollback path was exercised on 2026-08-18: release 2 deployed as Helm
+revision 2, rollback to release 1 created revision 3 and verified the prior
+image/publication identities, and restoring release 2 created deployed revision
+4 and passed all four current identity checks. Durable evidence is stored in
+`../rapp-policy-nexus/evidence/live/2026-08-18-railiance01-release2-rollback.json`.

workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bind and deploy the permanent policy surface"
 domain: financials
 repo: railiance-apps
-status: active
+status: finished
 owner: the-custodian
 topic_slug: railiance
 created: "2026-08-18"
@@ -57,6 +57,10 @@ OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf5
 and publication digest
 `1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.
 
+Release 2 was recorded from successful Forgejo Actions run 7 with four jointly
+reviewed identities: OCI image, publication manifest, source inventory, and
+deterministic source set. The production binding now selects that candidate.
+
 ## Server-dry-run and deploy
 
 ```task
@@ -71,25 +75,25 @@ server-side dry-run, then execute the guarded deployment target.
 The Forgejo image runner intentionally has no cluster-deploy authority. Capture
 the Helm revision and workload readiness.
 
-Completed 2026-08-18. The real-digest server dry-run passed, and the guarded
+Completed 2026-08-18. Real-digest server dry-runs passed for both chart
-operator target installed Helm revision 1 atomically. Deployment and pod are
+generations. The guarded operator target installed revision 1 and upgraded to
-1/1 Ready in namespace `policy-nexus`; the certificate is Ready.
+release 2 as revision 2 atomically. Following the rollback drill, release 2 is
+serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace
+`policy-nexus`; the certificate is Ready.
 
 ## Verify the public surface and rollback path
 
 ```task
 id: RAILIANCE-WP-0018-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "438b9016-9a11-4905-aa24-a7a3c622a033"
 ```
 
-Blocked by T03. Prove HTTPS, current and immutable document paths, permanent
+HTTPS, current and immutable document paths, permanent legacy redirect,
-legacy redirect, certificate readiness, deployed OCI digest, and publication
+certificate readiness, deployed OCI digest, publication digest, source
-digest. Record the previous Helm revision and exercise rollback when a safe
+inventory, and source set all passed for release 2. The drill rolled back to
-preceding release exists.
+release 1, verified its original image and publication identities, then restored
-
+release 2 and repeated the four-identity smoke successfully. Evidence is held by
-All public, certificate, image, publication, and provenance checks passed on
+`rapp-policy-nexus` at
-2026-08-18. Evidence is held by `rapp-policy-nexus` at
+`evidence/live/2026-08-18-railiance01-release2-rollback.json`.
-`evidence/live/2026-08-18-railiance01.json`. This remains in progress only
-because the initial Helm revision has no predecessor to exercise safely.