Record scoped signer source reviews and align canonical workplan examples

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

AGENTS.md

@@ -7,7 +7,7 @@
 **Domain:** financials
 **Repo slug:** railiance-cluster
 **Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
-**Workplan prefix:** `RAIL-BS-WP-`
+**Workplan prefix:** `RCLUSTER-WP-`
 
 ---
 
@@ -184,7 +184,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 
 ```yaml
 ---
-id: RAIL-BS-WP-NNNN
+id: RCLUSTER-WP-NNNN
 type: workplan
 title: "..."
 domain: financials
@@ -208,7 +208,7 @@ derived health labels, not frontmatter statuses.
 ## Task Title
 
 ` ` `task
-id: RAIL-BS-WP-NNNN-T01
+id: RCLUSTER-WP-NNNN-T01
 status: wait | todo | progress | done | cancel
 priority: high | medium | low
 state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit

workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Review NetKingdom signer runtime and node-local storage readiness"
 domain: financials
 repo: railiance-cluster
-status: proposed
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-10-16"
@@ -16,11 +16,12 @@ related:
   - RPF-WP-0035
   - RCLUSTER-WP-0014
   - RAIL-BS-WP-0014
+state_hub_workstream_id: "f383557d-c8a8-553e-adcd-9f82ff9c2929"
 ---
 
 # RCLUSTER-WP-0017 — NetKingdom runtime/storage review
 
-This proposed record is limited to railiance-cluster INTENT: verified healthy
+This source-review work record is limited to railiance-cluster INTENT: verified healthy
 runtime, scheduling headroom, admission/storage constraints and node-local
 failure-domain facts for the retained flex-auth signer successor. It does not
 own the Access workload, chart, Helm values or release; Platform OpenBao/ESO or
@@ -40,8 +41,9 @@ reviews remain necessary before every live action.
 
 ```task
 id: RCLUSTER-WP-0017-T01
-status: todo
+status: done
 priority: high
+state_hub_task_id: "6ee408cd-c055-532d-bc80-f64c9bdf143b"
 ```
 
 Read exact successor source/CCR/rollout/custody revisions against this repo's
@@ -56,12 +58,59 @@ Preparation evidence: Custodian
 Those observations are dated and must be refreshed at the actual native window.
 No formal review or native result is backfilled from this preparation.
 
+2026-10-16 formal source review completed from this ownrepo checkout under
+RCLUSTER-WP-0017-T01 after canonical record creation. Reviewer for each entry:
+railiance-cluster-owner (agent railiance-cluster, codex), decision approved for
+the exact bounded source scope only, based on INTENT Runtime Not Workloads and
+Healthy by Verification:
+
+- Platform R5 owner-boundary correction, Platform Git revision
+  84c529f239c81e6d3ca337015700b03e3a862f53, manifest
+  sha256:78003b1b4da481ce20b194062ddde10fa94147dbffc4c8e74a42850bf1dacfe0.
+  Precise cluster-runtime-storage-owner replaces the conflated role; six source
+  hashes match. R5 typed public metadata preserves R4 executor/tests independently
+  checked by54 focused tests. Platform Applications/freeze and Access workload/
+  Helm remain independently owned; cluster does not review for either role.
+- Access rollout R2 runtime/storage and maintenance source proposal, manifest
+  sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59.
+  Chart Git revision dc042022f7c30671cf0a7605cf43ef6d96d04242;
+  image source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0.
+  Exact archived retained/stopped/ready Helm renders independently reproduced;
+  full Deployment differs only replicas0/1 and encoded source projection matches.
+  Source hooks absent; unsafe replica inputs refused. Stop uses reset-values/
+  no-hooks, wait=false/no atomic: WaitForFirstConsumer may leave the claim Pending
+  and automatic rollback to the running predecessor would break the intended
+  fence. Ready atomic requires the exact newly established stopped revision be
+  authenticated as rollback target. Command success and source projection are
+  insufficient to prove actual generation/pod exclusion or admitted projection.
+- Platform custody packet P4 source-selection/ownership join, manifest
+  sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3.
+  All packet hashes, exact Git source bundle/plan, execution-bundle digest and
+  rollout R2 projection join verified. Eight disposable assembler tests passed.
+  P4 corrects frozen P3 controller-ownership prose; no predecessor is rewritten.
+  Workload/Helm rollback remains Access-owned, Application freeze/restoration
+  Platform-owned, consumer/trust Secrets-owned and runtime/storage/PV retention
+  cluster-owned. Actual held window/fence, founder entity, absolute expiry,
+  approved/binding-confirmed CCR and native dispositions remain absent.
+
+Full bounded reviews and verification:
+`the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/`
+formal-platform-r5-source-review.json, formal-rollout-r2-source-review.json,
+formal-packet-p4-source-review.json and rollout-r2-independent-verification.json.
+These source entries cannot fill the completed native-scope review slot or be
+recorded as CCR/read-lane/custody approval, founder decision or another owner's
+assent. T01 is done for exact source review only; the active plan retains T02/T03
+for fresh native preflight/held window/exclusion and approved actual binding/PV
+Retain verification. Dated18:02UTC observations remain historical. No live action
+occurred and no source review promotes native readiness or spend/risk authority.
+
 ## Review the bounded native preflight and storage action
 
 ```task
 id: RCLUSTER-WP-0017-T02
 status: todo
 priority: high
+state_hub_task_id: "7f4320c6-8bb5-598e-9b9a-65565091276f"
 ```
 
 Given actual exact successor owner dispositions and window, independently review
@@ -79,6 +128,7 @@ records unresolved gates; it does not grant execute authority.
 id: RCLUSTER-WP-0017-T03
 status: todo
 priority: high
+state_hub_task_id: "747a8d77-5c02-5b26-ba9c-385f75f3ac1c"
 ```
 
 Only after separately approved native action, verify the actual bound1Gi PVC