Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.
Accept the workplan home and tighten scope: exposure sits
beside ADR-0006 as ADR-0008, public keys off binding
admission, T04 is a reef-railiance snapshot, enforcement
is routed, and Q7 / provider APIs stay out.
Draft family workplan for review. Default reefs, rails, and rapps stay
off the public internet until production-approved plus an explicit
grant. Implementation is routed, not done here.
Park the OpenBao migration workplan as blocked and T08 as wait. Retention,
the post-cutover disaster-recovery drill, and explicit destructive-deletion
approval are all still closed; do not reopen before 2026-08-17.
Plan a storage reef for Scaleway object storage, distinct from
reef-railiance. Backup attributes will live there; the reef schema
must allow a substrate with no compute rail.
Rename RAILIANCE-WP-0017..0021 to RMASTER-WP-* so railiance-master
IDs no longer collide with railiance-platform's RAILIANCE-WP series.
Hub UUIDs are unchanged.
Add rail and reef schemas, derive reef bound_rapps from rapp.bound_reefs,
and ship a standalone family-declaration validator with an inventory-fed
coverage check. Point the bootstrap contract at the schemas, record the
dimension and cardinality decisions in ADR-0007, correct the first-wave
candidates document, and release the shape to downstream repos.
schemas/rapp.schema.json defines one normative shape for the rollout, smoke and
rollback contracts in place of the three mutually unreadable variants found
across the live rapps, promotes contract_version, readiness_state,
data_classification and criticality to required, and forbids the rapp- prefix
on workload_identity.name.
composition replaces the flat members list per amendment f88f938d: purpose,
member_repos with deployables, and pinned upstream_components. Repos are
many:many with rapps; deployables are 1:1, which is what makes the T06 coverage
check well-formed.
ownership_repo left permissive pending an architecture-owner call; the tighter
alternative is written up in schemas/README.md.
Validated against all three live declarations: openbao 10 errors, postgres 10,
qonto 4 — precisely the reported drift and nothing else.
Also found: three further rapp-* repos (secrets-engine, tenant-engine,
user-engine) carry no declarations at all, which the routed survey missed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
railiance-platform surveyed the four-axis model against the live cluster and
all six family repos and routed the findings here (messages 04c776c4 and
f88f938d): rapp.yaml has no schema and has drifted three ways, reef bound_rapps
is a stale hand-maintained list, and ~17 live workloads sit against 3 rapps.
Takes ownership of the schema, the composition block with its two cardinalities
(repos many:many with rapps, deployables 1:1), and a validator over all three
family declaration files. Migration stays with the owning repos.
T01 done: both messages acknowledged, ownership confirmed to railiance-platform.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
