Intake RAIL-BS-IN-0001: Stage 2/3 CLI assumes Helm

Requested by tenant-engine TEN-WP-0008-T02. Schema allows kubectl/kustomize
workloads; deploy/promote --plan still require a Helm chart.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

intakes/intakes.md

@@ -0,0 +1,39 @@
+# Intake records
+
+## RAIL-BS-IN-0001 — Stage 2/3 CLI assumes Helm; schema allows kubectl/kustomize workloads
+
+```yaml
+id: RAIL-BS-IN-0001
+kind: intake
+title: 'Stage 2/3 CLI assumes Helm; schema allows kubectl/kustomize workloads'
+status: open
+origin: cross-repo
+origin_ref: TEN-WP-0008-T02
+priority: medium
+owner: railiance-bootstrap
+requested_by: tenant-engine
+description: >
+  tenant-engine onboarded to railiance.app.v1 (TEN-WP-0008). The schema
+  accepts command and kubernetes checks and freeform stage commands.
+  This repo's real apply path is kubectl apply -k deploy/ (plain
+  manifests wrapped in kustomize), the same small-service shape as
+  qonto-assistant.
+
+  bin/railiance deploy --stage 2 --plan and bin/railiance promote --plan
+  fail closed unless a Stage 2 helm check exists and
+  charts/<id> plus values/stage3-production.yaml are present. Evidence:
+  tenant-engine/docs/evidence/TEN-WP-0008-stage2-plan.json (blocked:
+  no Stage 2 helm check declared) and
+  TEN-WP-0008-stage3-plan.json (blocked: missing chart and values).
+  Stage 1 (bin/railiance run) passed. Rollback --plan passed because it
+  only checks rollback.strategy.
+
+  TEN-WP-0008 forbids papering this over with a dummy chart that would
+  never be applied. Requested: either teach deploy/promote to honour
+  command-type Stage 2/3 checks (kubectl/kustomize), or document that
+  those subcommands are Helm-only and kubectl workloads should keep
+  commands in app.toml and not call them. The schema currently implies
+  the first.
+created: '2026-08-29'
+updated: '2026-08-29'
+```