railiance-apps/workplans/RAPPS-WP-0014-vergabe-invited-pilot.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related
RAPPS-WP-0014	workplan	Deploy and recover the first invited Vergabe company pilot	financials	railiance-apps	active	the-custodian	railiance	2026-09-11	2026-09-11	VERGABE-WP-0019 VERGABE-WP-0018 HFACT-WP-0001

Invited Vergabe pilot on Railiance

Prepare a durable and immutable single-company chart

id: RAPPS-WP-0014-T01
status: done
priority: high
assignee: the-custodian

Extend the existing media PVC support with a distinct issue-facade state PVC, optional existing claims for restore, retained claims on Helm uninstall and Recreate rollout when persistent local state is mounted. Pilot mode requires one replica, both durable stores, distinct claims and a valid OCI image digest. The legacy opt-in behavior remains available for non-pilot installations. Seven render regression tests and Helm lint pass. Chart 0.2.0 and the review-only values template prepare the deployment; no live resources were changed.

Bind the exact company, release, placement, data and access

id: RAPPS-WP-0014-T02
status: progress
priority: high
assignee: the-custodian

Consume VERGABE-WP-0019-T02's login-protected release after live CI/publication. Record exact image/chart revision, company, user count, host/TLS, dedicated namespace, database/role, both PVCs and admitted runtime Secret custody. Obtain the user's empty-vs-existing-data disposition. Existing vergabe_db is not test data. Resolve target inventory before using historical runbook names: the checked Railiance cluster has no vergabe-teilnahme namespace or matching Deployment on 2026-09-11. Do not infer data loss or authorization to recreate it.

Use docs/vergabe-teilnahme-pilot.md for the review packet. Secret creation, operator access and placement consume existing platform lanes; they do not create a parallel identity framework. The public edge needs an admitted login abuse-control policy and TLS; Django's authentication gate alone is not a rate limiter. Keep /media/ behind the app gate. Exact customer identity/host/data selection is pending user input; source preparation can proceed meanwhile.

Demonstrate restart, isolated restore, rollback and operating ownership

id: RAPPS-WP-0014-T03
status: wait
priority: high
assignee: the-custodian
depends_on: [RAPPS-WP-0014-T02]
blocking_reason: "Await exact placement/release/data binding before native rehearsal and admission."

With synthetic fixture data on the admitted deployment, prove login and health, two-user collaboration, document upload/download and issue state across pod replacement. Establish a consistent recovery point for PostgreSQL, media and issue-facade SQLite; rehearse recovery into a separate database and separate claims, repeat the workflow, and record recovery time and checksums without customer content. Record backup owner/cadence/retention/off-host destination, restore command revision and monitoring/incident owner. Retained local-path PVCs are neither off-host backup nor node-failure protection.

Review upgrade/migration effects and exact rollback image/data handling. A single-writer Recreate release has a short service interruption; do not promise HA. Return evidence to VERGABE-WP-0019-T03/T04 before customer invitations. Native factory-produced delivery remains VERGABE-WP-0018/HFACT-WP-0001's separate claim. Pricing and shared-app tenancy are outside this invited-pilot milestone.