railiance-apps/workplans/RAPPS-WP-0003-policy-nexus-production-binding.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RAPPS-WP-0003	workplan	Bind and deploy the permanent policy surface	financials	railiance-apps	finished	the-custodian	railiance	2026-08-18	2026-09-01	POLICY-NEXUS-WP-0001 RAPP-POLICY-NEXUS-WP-0001 REEF-RAILIANCE-WP-0004	668fbb2e-1060-57dd-b499-ff2e1a265a23

RAPPS-WP-0003 — policy-nexus production binding

Goal

Bind an immutable policy-nexus release to reef-railiance and deploy it at https://policy.coulomb.social without duplicating policy content or its rApp chart in the S5 repository.

Establish the S5 release boundary

id: RAPPS-WP-0003-T01
status: done
priority: high
state_hub_task_id: "11e4292b-6c30-58bf-9478-2097063cbb57"

The production binding, guarded delegating Make targets, and runbook are present. policy-nexus owns content/image creation; rapp-policy-nexus owns deployment mechanics; this repo owns the exact release selection and production approval.

Record the first immutable release

id: RAPPS-WP-0003-T02
status: done
priority: high
state_hub_task_id: "54b23078-231a-5f99-8736-fe57b7f3c0cb"

Publish a clean-source image, resolve its registry OCI digest, record it and the publication-manifest digest in bindings/policy-nexus-production.json, and set the binding status to release-approved. The two values must be reviewed together.

Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records OCI digest sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7 and publication digest 1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6.

Release 2 was recorded from successful Forgejo Actions run 7 with four jointly reviewed identities: OCI image, publication manifest, source inventory, and deterministic source set. The production binding now selects that candidate.

Server-dry-run and deploy

id: RAPPS-WP-0003-T03
status: done
priority: high
state_hub_task_id: "6327bc32-15f9-547b-a11c-8bc48eb6410e"

From an authorized operator workstation, run package checks and the Kubernetes server-side dry-run, then execute the guarded deployment target. The Forgejo image runner intentionally has no cluster-deploy authority. Capture the Helm revision and workload readiness.

Completed 2026-08-18. Real-digest server dry-runs passed for both chart generations. The guarded operator target installed revision 1 and upgraded to release 2 as revision 2 atomically. Following the rollback drill, release 2 is serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace policy-nexus; the certificate is Ready.

Verify the public surface and rollback path

id: RAPPS-WP-0003-T04
status: done
priority: high
state_hub_task_id: "97934187-e815-51f6-99cc-6f7240da0819"

HTTPS, current and immutable document paths, permanent legacy redirect, certificate readiness, deployed OCI digest, publication digest, source inventory, and source set all passed for release 2. The drill rolled back to release 1, verified its original image and publication identities, then restored release 2 and repeated the four-identity smoke successfully. Evidence is held by rapp-policy-nexus at evidence/live/2026-08-18-railiance01-release2-rollback.json.

Follow-up 2026-09-01: the S5 binding approved Policy Nexus Actions run 32 as the four-identity production release. Package, registry, render, and server-side admission gates passed before the guarded target upgraded the release atomically to Helm revision 7. The post-deploy smoke matched the approved OCI, publication manifest, source inventory, and source-set digests and passed HTTPS, TLS, canonical/immutable page, and legacy redirect checks. The rApp evidence is evidence/live/2026-09-01-railiance01-governed-source-release.json.

Follow-up 2026-09-01: the S5 binding approved the RISK-WP-0002 publication batch at OCI digest sha256:23df0ab3dc80d2a92b8058eeb572c222ceb05d17434f173a24142b2450ab3cea. The guarded target deployed Helm revision 8 atomically and retained revision 7 as the rollback baseline. The four immutable identities and all seven Risk Nexus canonical and revision addresses verified live. The rApp evidence is evidence/live/2026-09-01-railiance01-risk-nexus-publication.json.