Add gated Knative substrate preflight

WORK-RECORDS.md

@@ -14,6 +14,7 @@
 | workplan | RAIL-BS-WP-0010 | finished | — | workplans/RAIL-BS-WP-0010-weekly-legacy-meter-review-rollout.md |
 | workplan | RAIL-BS-WP-0011 | finished | — | workplans/RAIL-BS-WP-0011-legacy-meter-8h-capture-image-reconcile.md |
 | workplan | RAIL-BS-WP-0012 | finished | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md |
+| workplan | RAIL-BS-WP-0013 | active | — | workplans/RAIL-BS-WP-0013-knative-substrate.md |
 | task | RAIL-BS-WP-0007-T01 | todo | — | workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md |
 | task | RAIL-BS-WP-0007-T02 | todo | — | workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md |
 | task | RAIL-BS-WP-0007-T03 | todo | — | workplans/RAIL-BS-WP-0007-threephoenix-ha-cluster.md |
@@ -40,3 +41,7 @@
 | task | RAIL-BS-WP-0012-T02 | done | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md |
 | task | RAIL-BS-WP-0012-T03 | done | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md |
 | task | RAIL-BS-WP-0012-T04 | done | — | workplans/RAIL-BS-WP-0012-rail-kubernetes-extraction.md |
+| task | RAIL-BS-WP-0013-T01 | done | — | workplans/RAIL-BS-WP-0013-knative-substrate.md |
+| task | RAIL-BS-WP-0013-T02 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md |
+| task | RAIL-BS-WP-0013-T03 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md |
+| task | RAIL-BS-WP-0013-T04 | wait | — | workplans/RAIL-BS-WP-0013-knative-substrate.md |

tools/knative-preflight.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Read-only substrate probe. It never reads Secret resources.
+context="$(kubectl config current-context)"
+kubectl auth can-i get nodes >/dev/null
+server_version="$(kubectl version -o json | jq -r '.serverVersion.gitVersion')"
+node_count="$(kubectl get nodes -o json | jq '.items | length')"
+ready_nodes="$(kubectl get nodes -o json | jq '[.items[] | select(any(.status.conditions[]; .type == "Ready" and .status == "True"))] | length')"
+knative_crds="$(kubectl get crd -o name | grep -c 'knative.dev' || true)"
+ingress_classes="$(kubectl get ingressclass -o json | jq '[.items[].metadata.name]')"
+storage_classes="$(kubectl get storageclass -o json | jq '[.items[].metadata.name]')"
+
+jq -n \
+  --arg context "$context" \
+  --arg server_version "$server_version" \
+  --argjson node_count "$node_count" \
+  --argjson ready_nodes "$ready_nodes" \
+  --argjson knative_crds "$knative_crds" \
+  --argjson ingress_classes "$ingress_classes" \
+  --argjson storage_classes "$storage_classes" \
+  '{
+    schema_version: "railiance.knative-preflight/v1",
+    collected_at: (now | todateiso8601),
+    collector: "railiance-cluster/tools/knative-preflight.sh",
+    context: $context,
+    kubernetes_server_version: $server_version,
+    nodes: {total: $node_count, ready: $ready_nodes},
+    knative_crd_count: $knative_crds,
+    ingress_classes: $ingress_classes,
+    storage_classes: $storage_classes,
+    secret_values_collected: false
+  }'

workplans/RAIL-BS-WP-0013-knative-substrate.md

@@ -0,0 +1,65 @@
+---
+id: RAIL-BS-WP-0013
+type: workplan
+title: "Install and operate the Knative substrate capability"
+domain: financials
+repo: railiance-cluster
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-07-26"
+updated: "2026-07-26"
+state_hub_workstream_id: "552e55be-4b14-47cc-8680-8bf1ab97f15b"
+---
+
+# RAIL-BS-WP-0013 - Knative substrate
+
+## T01 - Automate the read-only preflight
+
+```task
+id: RAIL-BS-WP-0013-T01
+status: done
+priority: high
+state_hub_task_id: "ba2e40b0-ae9f-4917-91f8-d50735510581"
+```
+
+Collect version, node readiness, CRD, ingress, and storage facts without
+reading secrets. Emit JSON suitable for reef admission evidence.
+
+## T02 - Restore or establish agent-reachable API access
+
+```task
+id: RAIL-BS-WP-0013-T02
+status: wait
+priority: high
+state_hub_task_id: "764de270-321e-4b51-a6ce-5fe1d19dd2d9"
+```
+
+The configured API endpoint `92.205.62.239:6443` timed out on 2026-07-26.
+Resolve reachability through the sanctioned ops-bridge route and rerun T01.
+
+## T03 - Pin and install Knative Serving
+
+```task
+id: RAIL-BS-WP-0013-T03
+status: wait
+priority: high
+state_hub_task_id: "89e55bf6-d73d-454c-b6e8-bb1c5c5df7dd"
+```
+
+Select a version compatible with the observed Kubernetes server, pin upstream
+artifacts by digest, install idempotently, and retain uninstall/rollback state.
+Do not begin until T01 passes.
+
+## T04 - Verify lifecycle and publish reef evidence
+
+```task
+id: RAIL-BS-WP-0013-T04
+status: wait
+priority: high
+state_hub_task_id: "170c2524-dd4d-41ec-aafa-e48100a410f6"
+```
+
+Exercise scale-to-zero, cold start, revision traffic, rollback, private
+visibility, metrics, and failure behavior. Publish versioned evidence to
+`reef-railiance`; never infer readiness from successful apply alone.