railiance-cluster/workplans/RCLUSTER-WP-0017-netkingdom-signer-runtime-storage-review.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	related	state_hub_workstream_id
RCLUSTER-WP-0017	workplan	Review NetKingdom signer runtime and node-local storage readiness	financials	railiance-cluster	active	codex	railiance	2026-10-16	2026-10-16	implementation	CUST-WP-0080 FLEX-WP-0024 RPF-WP-0035 RCLUSTER-WP-0014 RAIL-BS-WP-0014	f383557d-c8a8-553e-adcd-9f82ff9c2929

RCLUSTER-WP-0017 — NetKingdom runtime/storage review

This source-review work record is limited to railiance-cluster INTENT: verified healthy runtime, scheduling headroom, admission/storage constraints and node-local failure-domain facts for the retained flex-auth signer successor. It does not own the Access workload, chart, Helm values or release; Platform OpenBao/ESO or ArgoCD Applications; Enablement ArgoCD installation; Secrets public trust; or founder approval. It neither reopens completed capacity work nor duplicates Access implementation. Current single-node storage remains a single failure domain; ThreePhoenix/Longhorn is not a prerequisite or current capability.

Origin: CUST-WP-0080 request for independent runtime/storage review of CCR-2026-0050 and the Access signer rollout. Custodian-side read-only preparation is historical input, not a prior formal owner disposition. The conflated legacy cluster-gitops-owner role cannot be accepted by this repo; review the precise successor source role independently. Founder human approval and distinct owner reviews remain necessary before every live action.

Review exact runtime and storage source boundary

id: RCLUSTER-WP-0017-T01
status: done
priority: high
state_hub_task_id: "6ee408cd-c055-532d-bc80-f64c9bdf143b"

Read exact successor source/CCR/rollout/custody revisions against this repo's INTENT; record a formal runtime/storage-only review under delegated-owner-review canon once this work record exists in the ownrepo checkout. Authenticate the actual Platform Applications and Access release responsibilities. Retain source hashes and current metadata evidence, and keep changes requested visible. A role rename alone does not supply native acceptance or another owner's assent.

Preparation evidence: Custodian docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/. Those observations are dated and must be refreshed at the actual native window. No formal review or native result is backfilled from this preparation.

2026-10-16 formal source review completed from this ownrepo checkout under RCLUSTER-WP-0017-T01 after canonical record creation. Reviewer for each entry: railiance-cluster-owner (agent railiance-cluster, codex), decision approved for the exact bounded source scope only, based on INTENT Runtime Not Workloads and Healthy by Verification:

• Platform R5 owner-boundary correction, Platform Git revision 84c529f239c81e6d3ca337015700b03e3a862f53, manifest sha256:78003b1b4da481ce20b194062ddde10fa94147dbffc4c8e74a42850bf1dacfe0. Precise cluster-runtime-storage-owner replaces the conflated role; six source hashes match. R5 typed public metadata preserves R4 executor/tests independently checked by54 focused tests. Platform Applications/freeze and Access workload/ Helm remain independently owned; cluster does not review for either role.
• Access rollout R2 runtime/storage and maintenance source proposal, manifest sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59. Chart Git revision dc042022f7c30671cf0a7605cf43ef6d96d04242; image source Git revision 84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0. Exact archived retained/stopped/ready Helm renders independently reproduced; full Deployment differs only replicas0/1 and encoded source projection matches. Source hooks absent; unsafe replica inputs refused. Stop uses reset-values/ no-hooks, wait=false/no atomic: WaitForFirstConsumer may leave the claim Pending and automatic rollback to the running predecessor would break the intended fence. Ready atomic requires the exact newly established stopped revision be authenticated as rollback target. Command success and source projection are insufficient to prove actual generation/pod exclusion or admitted projection.
• Platform custody packet P4 source-selection/ownership join, manifest sha256:9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3. All packet hashes, exact Git source bundle/plan, execution-bundle digest and rollout R2 projection join verified. Eight disposable assembler tests passed. P4 corrects frozen P3 controller-ownership prose; no predecessor is rewritten. Workload/Helm rollback remains Access-owned, Application freeze/restoration Platform-owned, consumer/trust Secrets-owned and runtime/storage/PV retention cluster-owned. Actual held window/fence, founder entity, absolute expiry, approved/binding-confirmed CCR and native dispositions remain absent.

Full bounded reviews and verification: the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-admission/cluster-review-r1/ formal-platform-r5-source-review.json, formal-rollout-r2-source-review.json, formal-packet-p4-source-review.json and rollout-r2-independent-verification.json. These source entries cannot fill the completed native-scope review slot or be recorded as CCR/read-lane/custody approval, founder decision or another owner's assent. T01 is done for exact source review only; the active plan retains T02/T03 for fresh native preflight/held window/exclusion and approved actual binding/PV Retain verification. Dated18:02UTC observations remain historical. No live action occurred and no source review promotes native readiness or spend/risk authority.

Review the bounded native preflight and storage action

id: RCLUSTER-WP-0017-T02
status: todo
priority: high
state_hub_task_id: "7f4320c6-8bb5-598e-9b9a-65565091276f"

Given actual exact successor owner dispositions and window, independently review cluster identity, node health/requested/observed headroom, quota/LimitRange, local-path behavior, admission-defaulted stopped projection and exclusion checks. Access owns workload stop/start and release rollback; Platform owns any Application writer freeze. Require exact caller/source/image/fence/expiry pins, Ready120seconds, recovery decision600seconds, founder abort ownership and explicit local-storage/outage/loss disposition. This task prepares review and records unresolved gates; it does not grant execute authority.

Verify the approved runtime and storage result

id: RCLUSTER-WP-0017-T03
status: todo
priority: high
state_hub_task_id: "747a8d77-5c02-5b26-ba9c-385f75f3ac1c"

Only after separately approved native action, verify the actual bound1Gi PVC UID, PV UID/name/claimRef/capacity/node affinity and exact Retain readback; refresh node health/headroom and non-overlap observations. Any runtime/storage mutation must have its own exact founder approval and scoped executor. The future bound PV cannot be selected or mutated in advance. Retain is not backup, node-loss protection or a filesystem quota. Preserve unknown outcomes and the original evidence; do not reset cursor/outbox, delete PVC/PV or remint custody.

If native action is not approved, keep this task open with its concrete unresolved gates. Do not imply rollout/custody/trust acceptance. Complete this workplan only after source review, bounded preflight disposition and actual approved runtime/storage result are evidenced, or explicit scope cancellation.