95 lines
3 KiB
Markdown
95 lines
3 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0018
|
|
type: workplan
|
|
title: "Bind and deploy the permanent policy surface"
|
|
domain: financials
|
|
repo: railiance-apps
|
|
status: active
|
|
owner: the-custodian
|
|
topic_slug: railiance
|
|
created: "2026-08-18"
|
|
updated: "2026-08-18"
|
|
related:
|
|
- POLICY-NEXUS-WP-0001
|
|
- RAPP-POLICY-NEXUS-WP-0001
|
|
- REEF-RAILIANCE-WP-0004
|
|
state_hub_workstream_id: "801197d8-d387-4fcf-9a38-b4e7457847e6"
|
|
---
|
|
|
|
# RAILIANCE-WP-0018 — policy-nexus production binding
|
|
|
|
## Goal
|
|
|
|
Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
|
|
`https://policy.coulomb.social` without duplicating policy content or its rApp
|
|
chart in the S5 repository.
|
|
|
|
## Establish the S5 release boundary
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0018-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "537639f3-2078-4560-8bd0-4ac7d13f8131"
|
|
```
|
|
|
|
The production binding, guarded delegating Make targets, and runbook are
|
|
present. `policy-nexus` owns content/image creation;
|
|
`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
|
|
selection and production approval.
|
|
|
|
## Record the first immutable release
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0018-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "44a2e61e-e4a6-46ab-baf2-c81fb020a68e"
|
|
```
|
|
|
|
Publish a clean-source image, resolve its registry OCI digest, record it and the
|
|
publication-manifest digest in `bindings/policy-nexus-production.json`, and set
|
|
the binding status to `release-approved`. The two values must be reviewed
|
|
together.
|
|
|
|
Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
|
|
OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
|
|
and publication digest
|
|
`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.
|
|
|
|
## Server-dry-run and deploy
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0018-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "d78dbaf0-1df5-4498-b1e4-9aeb6804831b"
|
|
```
|
|
|
|
From an authorized operator workstation, run package checks and the Kubernetes
|
|
server-side dry-run, then execute the guarded deployment target.
|
|
The Forgejo image runner intentionally has no cluster-deploy authority. Capture
|
|
the Helm revision and workload readiness.
|
|
|
|
Completed 2026-08-18. The real-digest server dry-run passed, and the guarded
|
|
operator target installed Helm revision 1 atomically. Deployment and pod are
|
|
1/1 Ready in namespace `policy-nexus`; the certificate is Ready.
|
|
|
|
## Verify the public surface and rollback path
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0018-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "438b9016-9a11-4905-aa24-a7a3c622a033"
|
|
```
|
|
|
|
Blocked by T03. Prove HTTPS, current and immutable document paths, permanent
|
|
legacy redirect, certificate readiness, deployed OCI digest, and publication
|
|
digest. Record the previous Helm revision and exercise rollback when a safe
|
|
preceding release exists.
|
|
|
|
All public, certificate, image, publication, and provenance checks passed on
|
|
2026-08-18. Evidence is held by `rapp-policy-nexus` at
|
|
`evidence/live/2026-08-18-railiance01.json`. This remains in progress only
|
|
because the initial Helm revision has no predecessor to exercise safely.
|