codex dada84cf51

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

fix(workplans): migrate active workplans off the retired RAILIANCE-WP prefix

RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix
registry already lists it retired). Three repositories independently used one
number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here,
a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This
repository also carried two files both numbered 0016.

Active workplans move to the successor prefix and are renumbered from 0001 in
historical order. Archived workplans keep their historical identifiers.

Projection UUIDs are re-derived from the new canonical ids. Records already
registered under the old identifiers leave orphaned hub rows behind; that debt
is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands.

Refs CUST-WP-0068-T03

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006

2026-08-25 22:58:36 +02:00

3.3 KiB

Raw Blame History

type

title

domain

repo

status

owner

topic_slug

created

updated

state_hub_workstream_id

RAPPS-WP-0003

workplan

Bind and deploy the permanent policy surface

financials

railiance-apps

finished

the-custodian

railiance

2026-08-18

POLICY-NEXUS-WP-0001

RAPP-POLICY-NEXUS-WP-0001

REEF-RAILIANCE-WP-0004

668fbb2e-1060-57dd-b499-ff2e1a265a23

RAPPS-WP-0003 — policy-nexus production binding

Goal

Bind an immutable policy-nexus release to reef-railiance and deploy it at https://policy.coulomb.social without duplicating policy content or its rApp chart in the S5 repository.

Establish the S5 release boundary

id: RAPPS-WP-0003-T01
status: done
priority: high
state_hub_task_id: "11e4292b-6c30-58bf-9478-2097063cbb57"

The production binding, guarded delegating Make targets, and runbook are present. policy-nexus owns content/image creation; rapp-policy-nexus owns deployment mechanics; this repo owns the exact release selection and production approval.

Record the first immutable release

id: RAPPS-WP-0003-T02
status: done
priority: high
state_hub_task_id: "54b23078-231a-5f99-8736-fe57b7f3c0cb"

Publish a clean-source image, resolve its registry OCI digest, record it and the publication-manifest digest in bindings/policy-nexus-production.json, and set the binding status to release-approved. The two values must be reviewed together.

Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records OCI digest sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7 and publication digest 1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6.

Release 2 was recorded from successful Forgejo Actions run 7 with four jointly reviewed identities: OCI image, publication manifest, source inventory, and deterministic source set. The production binding now selects that candidate.

Server-dry-run and deploy

id: RAPPS-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6327bc32-15f9-547b-a11c-8bc48eb6410e"

From an authorized operator workstation, run package checks and the Kubernetes server-side dry-run, then execute the guarded deployment target. The Forgejo image runner intentionally has no cluster-deploy authority. Capture the Helm revision and workload readiness.

Completed 2026-08-18. Real-digest server dry-runs passed for both chart generations. The guarded operator target installed revision 1 and upgraded to release 2 as revision 2 atomically. Following the rollback drill, release 2 is serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace policy-nexus; the certificate is Ready.

Verify the public surface and rollback path

id: RAPPS-WP-0003-T04
status: done
priority: high
state_hub_task_id: "97934187-e815-51f6-99cc-6f7240da0819"

HTTPS, current and immutable document paths, permanent legacy redirect, certificate readiness, deployed OCI digest, publication digest, source inventory, and source set all passed for release 2. The drill rolled back to release 1, verified its original image and publication identities, then restored release 2 and repeated the four-identity smoke successfully. Evidence is held by rapp-policy-nexus at evidence/live/2026-08-18-railiance01-release2-rollback.json.

3.3 KiB Raw Blame History