railiance-apps/workplans/RAILIANCE-WP-0018-policy-nexus-production-binding.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
RAILIANCE-WP-0018	workplan	Bind and deploy the permanent policy surface	financials	railiance-apps	finished	the-custodian	railiance	2026-08-18	2026-08-18	POLICY-NEXUS-WP-0001 RAPP-POLICY-NEXUS-WP-0001 REEF-RAILIANCE-WP-0004	801197d8-d387-4fcf-9a38-b4e7457847e6

RAILIANCE-WP-0018 — policy-nexus production binding

Goal

Bind an immutable policy-nexus release to reef-railiance and deploy it at https://policy.coulomb.social without duplicating policy content or its rApp chart in the S5 repository.

Establish the S5 release boundary

id: RAILIANCE-WP-0018-T01
status: done
priority: high
state_hub_task_id: "537639f3-2078-4560-8bd0-4ac7d13f8131"

The production binding, guarded delegating Make targets, and runbook are present. policy-nexus owns content/image creation; rapp-policy-nexus owns deployment mechanics; this repo owns the exact release selection and production approval.

Record the first immutable release

id: RAILIANCE-WP-0018-T02
status: done
priority: high
state_hub_task_id: "44a2e61e-e4a6-46ab-baf2-c81fb020a68e"

Publish a clean-source image, resolve its registry OCI digest, record it and the publication-manifest digest in bindings/policy-nexus-production.json, and set the binding status to release-approved. The two values must be reviewed together.

Completed 2026-08-18 from successful Forgejo Actions run 1. The binding records OCI digest sha256:23318442d1b3a5bdced54f0b407fa5b32834020b80c60d72dea04c03bfbf51e7 and publication digest 1d8ae5cd683e385d82d29a78729948f7be95d902401a5fbdcfb5e8230cdbfee6.

Release 2 was recorded from successful Forgejo Actions run 7 with four jointly reviewed identities: OCI image, publication manifest, source inventory, and deterministic source set. The production binding now selects that candidate.

Server-dry-run and deploy

id: RAILIANCE-WP-0018-T03
status: done
priority: high
state_hub_task_id: "d78dbaf0-1df5-4498-b1e4-9aeb6804831b"

From an authorized operator workstation, run package checks and the Kubernetes server-side dry-run, then execute the guarded deployment target. The Forgejo image runner intentionally has no cluster-deploy authority. Capture the Helm revision and workload readiness.

Completed 2026-08-18. Real-digest server dry-runs passed for both chart generations. The guarded operator target installed revision 1 and upgraded to release 2 as revision 2 atomically. Following the rollback drill, release 2 is serving as deployed revision 4. Deployment and pod are 1/1 Ready in namespace policy-nexus; the certificate is Ready.

Verify the public surface and rollback path

id: RAILIANCE-WP-0018-T04
status: done
priority: high
state_hub_task_id: "438b9016-9a11-4905-aa24-a7a3c622a033"

HTTPS, current and immutable document paths, permanent legacy redirect, certificate readiness, deployed OCI digest, publication digest, source inventory, and source set all passed for release 2. The drill rolled back to release 1, verified its original image and publication identities, then restored release 2 and repeated the four-identity smoke successfully. Evidence is held by rapp-policy-nexus at evidence/live/2026-08-18-railiance01-release2-rollback.json.