---
id: RAIL-BS-WP-0013
type: workplan
title: "Install and operate the Knative substrate capability"
domain: financials
repo: railiance-cluster
status: finished
owner: codex
topic_slug: railiance
created: "2026-07-26"
updated: "2026-07-26"
state_hub_workstream_id: "23a12d6d-4be8-5a60-a0d3-06114715b32c"
---

# RAIL-BS-WP-0013 - Knative substrate

## T01 - Automate the read-only preflight

```task
id: RAIL-BS-WP-0013-T01
status: done
priority: high
state_hub_task_id: "193c1a73-2e3d-588f-afb1-c963e9f4ea1a"
```

Collect version, node readiness, CRD, ingress, and storage facts without
reading secrets. Emit JSON suitable for reef admission evidence.

## T02 - Restore or establish agent-reachable API access

```task
id: RAIL-BS-WP-0013-T02
status: done
priority: high
state_hub_task_id: "a0d784e5-6d35-5257-b41d-1a1ae45b630b"
```

The configured API endpoint `92.205.62.239:6443` timed out on 2026-07-26.
Resolve reachability through the sanctioned ops-bridge route and rerun T01.

2026-07-26: Direct API access still timed out, but the configured agent SSH
lane reached the cluster-local API and completed the preflight.

## T03 - Pin and install Knative Serving

```task
id: RAIL-BS-WP-0013-T03
status: done
priority: high
state_hub_task_id: "0154dd92-64fe-5146-9790-d0991b52d672"
```

Select a version compatible with the observed Kubernetes server, pin upstream
artifacts by digest, install idempotently, and retain uninstall/rollback state.
Do not begin until T01 passes.

2026-07-26: Installed Serving and net-kourier v1.22.0 from checksum-locked
assets. Kubernetes v1.35.1 satisfies the release minimum of v1.34. Kourier is
ClusterIP-only and the idempotent installer/verifier are repository-owned.

## T04 - Verify lifecycle and publish reef evidence

```task
id: RAIL-BS-WP-0013-T04
status: done
priority: high
state_hub_task_id: "fd762c62-c362-556d-8718-f6d37d484638"
```

Exercise scale-to-zero, cold start, revision traffic, rollback, private
visibility, metrics, and failure behavior. Publish versioned evidence to
`reef-railiance`; never infer readiness from successful apply alone.

2026-07-26: Verified private readiness, scale-to-zero, 6276 ms cold activation,
second revision readiness, and rollback. Published reef evidence; production
approval remains blocked by workload and failure-domain gates.