tegwick
debc54b02b
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
114 lines
4.3 KiB
Markdown
114 lines
4.3 KiB
Markdown
---
|
|
id: RAPPS-WP-0003
|
|
type: workplan
|
|
title: "Bind and deploy the permanent policy surface"
|
|
domain: financials
|
|
repo: railiance-apps
|
|
status: finished
|
|
owner: the-custodian
|
|
topic_slug: railiance
|
|
created: "2026-08-18"
|
|
updated: "2026-09-01"
|
|
related:
|
|
- POLICY-NEXUS-WP-0001
|
|
- RAPP-POLICY-NEXUS-WP-0001
|
|
- REEF-RAILIANCE-WP-0004
|
|
state_hub_workstream_id: "668fbb2e-1060-57dd-b499-ff2e1a265a23"
|
|
---
|
|
|
|
# RAPPS-WP-0003 — policy-nexus production binding
|
|
|
|
## Goal
|
|
|
|
Bind an immutable `policy-nexus` release to `reef-railiance` and deploy it at
|
|
`https://policy.coulomb.social` without duplicating policy content or its rApp
|
|
chart in the S5 repository.
|
|
|
|
## Establish the S5 release boundary
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "11e4292b-6c30-58bf-9478-2097063cbb57"
|
|
```
|
|
|
|
The production binding, guarded delegating Make targets, and runbook are
|
|
present. `policy-nexus` owns content/image creation;
|
|
`rapp-policy-nexus` owns deployment mechanics; this repo owns the exact release
|
|
selection and production approval.
|
|
|
|
## Record the first immutable release
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "54b23078-231a-5f99-8736-fe57b7f3c0cb"
|
|
```
|
|
|
|
Publish a clean-source image, resolve its registry OCI digest, record it and the
|
|
publication-manifest digest in `bindings/policy-nexus-production.json`, and set
|
|
the binding status to `release-approved`. The two values must be reviewed
|
|
together.
|
|
|
|
Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records
|
|
OCI digest `sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7`
|
|
and publication digest
|
|
`1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6`.
|
|
|
|
Release 2 was recorded from successful Forgejo Actions run 7 with four jointly
|
|
reviewed identities: OCI image, publication manifest, source inventory, and
|
|
deterministic source set. The production binding now selects that candidate.
|
|
|
|
## Server-dry-run and deploy
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6327bc32-15f9-547b-a11c-8bc48eb6410e"
|
|
```
|
|
|
|
From an authorized operator workstation, run package checks and the Kubernetes
|
|
server-side dry-run, then execute the guarded deployment target.
|
|
The Forgejo image runner intentionally has no cluster-deploy authority. Capture
|
|
the Helm revision and workload readiness.
|
|
|
|
Completed 2026-08-18. Real-digest server dry-runs passed for both chart
|
|
generations. The guarded operator target installed revision 1 and upgraded to
|
|
release 2 as revision 2 atomically. Following the rollback drill, release 2 is
|
|
serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace
|
|
`policy-nexus`; the certificate is Ready.
|
|
|
|
## Verify the public surface and rollback path
|
|
|
|
```task
|
|
id: RAPPS-WP-0003-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "97934187-e815-51f6-99cc-6f7240da0819"
|
|
```
|
|
|
|
HTTPS, current and immutable document paths, permanent legacy redirect,
|
|
certificate readiness, deployed OCI digest, publication digest, source
|
|
inventory, and source set all passed for release 2. The drill rolled back to
|
|
release 1, verified its original image and publication identities, then restored
|
|
release 2 and repeated the four-identity smoke successfully. Evidence is held by
|
|
`rapp-policy-nexus` at
|
|
`evidence/live/2026-08-18-railiance01-release2-rollback.json`.
|
|
|
|
Follow-up 2026-09-01: the S5 binding approved Policy Nexus Actions run 32 as
|
|
the four-identity production release. Package, registry, render, and server-side
|
|
admission gates passed before the guarded target upgraded the release atomically
|
|
to Helm revision 7. The post-deploy smoke matched the approved OCI, publication
|
|
manifest, source inventory, and source-set digests and passed HTTPS, TLS,
|
|
canonical/immutable page, and legacy redirect checks. The rApp evidence is
|
|
`evidence/live/2026-09-01-railiance01-governed-source-release.json`.
|
|
|
|
Follow-up 2026-09-01: the S5 binding approved the `RISK-WP-0002` publication
|
|
batch at OCI digest `sha256:23df0ab3dc80d2a92b8058eeb572c222ceb05d17434f173a24142b2450ab3cea`.
|
|
The guarded target deployed Helm revision 8 atomically and retained revision 7
|
|
as the rollback baseline. The four immutable identities and all seven Risk
|
|
Nexus canonical and revision addresses verified live. The rApp evidence is
|
|
`evidence/live/2026-09-01-railiance01-risk-nexus-publication.json`.
|