Add gated Knative substrate preflight

workplans/RAIL-BS-WP-0013-knative-substrate.md

@@ -0,0 +1,65 @@
+---
+id: RAIL-BS-WP-0013
+type: workplan
+title: "Install and operate the Knative substrate capability"
+domain: financials
+repo: railiance-cluster
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-07-26"
+updated: "2026-07-26"
+state_hub_workstream_id: "552e55be-4b14-47cc-8680-8bf1ab97f15b"
+---
+
+# RAIL-BS-WP-0013 - Knative substrate
+
+## T01 - Automate the read-only preflight
+
+```task
+id: RAIL-BS-WP-0013-T01
+status: done
+priority: high
+state_hub_task_id: "ba2e40b0-ae9f-4917-91f8-d50735510581"
+```
+
+Collect version, node readiness, CRD, ingress, and storage facts without
+reading secrets. Emit JSON suitable for reef admission evidence.
+
+## T02 - Restore or establish agent-reachable API access
+
+```task
+id: RAIL-BS-WP-0013-T02
+status: wait
+priority: high
+state_hub_task_id: "764de270-321e-4b51-a6ce-5fe1d19dd2d9"
+```
+
+The configured API endpoint `92.205.62.239:6443` timed out on 2026-07-26.
+Resolve reachability through the sanctioned ops-bridge route and rerun T01.
+
+## T03 - Pin and install Knative Serving
+
+```task
+id: RAIL-BS-WP-0013-T03
+status: wait
+priority: high
+state_hub_task_id: "89e55bf6-d73d-454c-b6e8-bb1c5c5df7dd"
+```
+
+Select a version compatible with the observed Kubernetes server, pin upstream
+artifacts by digest, install idempotently, and retain uninstall/rollback state.
+Do not begin until T01 passes.
+
+## T04 - Verify lifecycle and publish reef evidence
+
+```task
+id: RAIL-BS-WP-0013-T04
+status: wait
+priority: high
+state_hub_task_id: "170c2524-dd4d-41ec-aafa-e48100a410f6"
+```
+
+Exercise scale-to-zero, cold start, revision traffic, rollback, private
+visibility, metrics, and failure behavior. Publish versioned evidence to
+`reef-railiance`; never infer readiness from successful apply alone.