---
id: RAILIANCE-WP-0018
type: workplan
title: "Bind and deploy the permanent policy surface"
domain: financials
repo: railiance-apps
status: active
owner: the-custodian
topic_slug: railiance
created: "2026-08-18"
updated: "2026-08-18"
related:
  - POLICY-NEXUS-WP-0001
  - RAPP-POLICY-NEXUS-WP-0001
  - REEF-RAILIANCE-WP-0004
state_hub_workstream_id: "801197d8-d387-4fcf-9a38-b4e7457847e6"
---

# RAILIANCE-WP-0018 — policy-nexus production binding

## Goal

Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
`https://policy.coulomb.social` without duplicating policy content or its rApp
chart in the S5 repository.

## Establish the S5 release boundary

```task
id: RAILIANCE-WP-0018-T01
status: done
priority: high
state_hub_task_id: "537639f3-2078-4560-8bd0-4ac7d13f8131"
```

The production binding, guarded delegating Make targets, and runbook are
present. `policy-nexus` owns content/image creation;
`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
selection and production approval.

## Record the first immutable release

```task
id: RAILIANCE-WP-0018-T02
status: done
priority: high
state_hub_task_id: "44a2e61e-e4a6-46ab-baf2-c81fb020a68e"
```

Publish a clean-source image, resolve its registry OCI digest, record it and the
publication-manifest digest in `bindings/policy-nexus-production.json`, and set
the binding status to `release-approved`. The two values must be reviewed
together.

Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
and publication digest
`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.

## Server-dry-run and deploy

```task
id: RAILIANCE-WP-0018-T03
status: done
priority: high
state_hub_task_id: "d78dbaf0-1df5-4498-b1e4-9aeb6804831b"
```

From an authorized operator workstation, run package checks and the Kubernetes
server-side dry-run, then execute the guarded deployment target.
The Forgejo image runner intentionally has no cluster-deploy authority. Capture
the Helm revision and workload readiness.

Completed 2026-08-18. The real-digest server dry-run passed, and the guarded
operator target installed Helm revision 1 atomically. Deployment and pod are
1/1 Ready in namespace `policy-nexus`; the certificate is Ready.

## Verify the public surface and rollback path

```task
id: RAILIANCE-WP-0018-T04
status: wait
priority: high
state_hub_task_id: "438b9016-9a11-4905-aa24-a7a3c622a033"
```

Blocked by T03. Prove HTTPS, current and immutable document paths, permanent
legacy redirect, certificate readiness, deployed OCI digest, and publication
digest. Record the previous Helm revision and exercise rollback when a safe
preceding release exists.

All public, certificate, image, publication, and provenance checks passed on
2026-08-18. Evidence is held by `rapp-policy-nexus` at
`evidence/live/2026-08-18-railiance01.json`. This remains in progress only
because the initial Helm revision has no predecessor to exercise safely.