codex
dada84cf51
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
99 lines
3.3 KiB
Markdown
99 lines
3.3 KiB
Markdown
---
|
|
id: RAPPS-WP-0003
|
|
type: workplan
|
|
title: "Bind and deploy the permanent policy surface"
|
|
domain: financials
|
|
repo: railiance-apps
|
|
status: finished
|
|
owner: the-custodian
|
|
topic_slug: railiance
|
|
created: "2026-08-18"
|
|
updated: "2026-08-18"
|
|
related:
|
|
- POLICY-NEXUS-WP-0001
|
|
- RAPP-POLICY-NEXUS-WP-0001
|
|
- REEF-RAILIANCE-WP-0004
|
|
state_hub_workstream_id: "668fbb2e-1060-57dd-b499-ff2e1a265a23"
|
|
---
|
|
|
|
# RAPPS-WP-0003 — policy-nexus production binding
|
|
|
|
## Goal
|
|
|
|
Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
|
|
`https://policy.coulomb.social` without duplicating policy content or its rApp
|
|
chart in the S5 repository.
|
|
|
|
## Establish the S5 release boundary
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "11e4292b-6c30-58bf-9478-2097063cbb57"
|
|
```
|
|
|
|
The production binding, guarded delegating Make targets, and runbook are
|
|
present. `policy-nexus` owns content/image creation;
|
|
`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
|
|
selection and production approval.
|
|
|
|
## Record the first immutable release
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "54b23078-231a-5f99-8736-fe57b7f3c0cb"
|
|
```
|
|
|
|
Publish a clean-source image, resolve its registry OCI digest, record it and the
|
|
publication-manifest digest in `bindings/policy-nexus-production.json`, and set
|
|
the binding status to `release-approved`. The two values must be reviewed
|
|
together.
|
|
|
|
Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
|
|
OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
|
|
and publication digest
|
|
`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.
|
|
|
|
Release 2 was recorded from successful Forgejo Actions run 7 with four jointly
|
|
reviewed identities: OCI image, publication manifest, source inventory, and
|
|
deterministic source set. The production binding now selects that candidate.
|
|
|
|
## Server-dry-run and deploy
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6327bc32-15f9-547b-a11c-8bc48eb6410e"
|
|
```
|
|
|
|
From an authorized operator workstation, run package checks and the Kubernetes
|
|
server-side dry-run, then execute the guarded deployment target.
|
|
The Forgejo image runner intentionally has no cluster-deploy authority. Capture
|
|
the Helm revision and workload readiness.
|
|
|
|
Completed 2026-08-18. Real-digest server dry-runs passed for both chart
|
|
generations. The guarded operator target installed revision 1 and upgraded to
|
|
release 2 as revision 2 atomically. Following the rollback drill, release 2 is
|
|
serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace
|
|
`policy-nexus`; the certificate is Ready.
|
|
|
|
## Verify the public surface and rollback path
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "97934187-e815-51f6-99cc-6f7240da0819"
|
|
```
|
|
|
|
HTTPS, current and immutable document paths, permanent legacy redirect,
|
|
certificate readiness, deployed OCI digest, publication digest, source
|
|
inventory, and source set all passed for release 2. The drill rolled back to
|
|
release 1, verified its original image and publication identities, then restored
|
|
release 2 and repeated the four-identity smoke successfully. Evidence is held by
|
|
`rapp-policy-nexus` at
|
|
`evidence/live/2026-08-18-railiance01-release2-rollback.json`.
|