Finish architecture-cleanup RAILIANCE-WP-0016 T05

Item 13 is the restore RESOURCE-WP-0002 already proved. Item 14 retires
the dead Bitnami postgresql-ha deploy path and gates Valkey until a
consumer exists. Item 17 publishes the versioned S3 consumer-interface
index.

docs/evidence/RAILIANCE-WP-0016-item13-restore-2026-08-15.md

@@ -0,0 +1,29 @@
+# Item 13 — restore proven end to end
+
+Work record: architecture-cleanup `RAILIANCE-WP-0016` item 13
+Date: 2026-08-15
+Status: **done** (unblocked by `RESOURCE-WP-0002` finish)
+
+The blocker was decision `9c21c0e0` / `RESOURCE-WP-0002`. That workplan is
+finished. The restore this item asked for was executed as
+`RESOURCE-WP-0002-T05` on 2026-08-14 and is still true on the live cluster.
+
+## Production path (railiance01 `platform-pg`)
+
+| Fact | Value |
+| --- | --- |
+| Destination | `s3://railiance-platform-pg-backup/platform-pg/` |
+| Endpoint | `https://s3.nl-ams.scw.cloud` |
+| Credential Secret | `databases/platform-pg-backup-s3` (keys present, values not read) |
+| ScheduledBackup | `platform-pg-daily` (02:15 UTC) |
+| Completed Backups | `platform-pg-daily-20260814181421`, `platform-pg-daily-20260815021500` |
+
+Full restore 65s (`audit_core.events` 30=30). PITR 65s (`keep` present,
+`destroy` absent). Evidence:
+`resource-control/docs/evidence/RESOURCE-WP-0002-T05-restore-2026-08-14.md`.
+Logical offsite copy: `RESOURCE-WP-0002-T06`.
+
+This item is the S3-owned *proof*, not a second restore program. `apps-pg`
+is still local-path only (RAILIANCE-WP-0016 apps-pg evidence T02). Covering
+that cluster is a later consumer of the same bucket, not a re-opening of
+item 13.

docs/postgresql-ha.md

@@ -1,9 +1,16 @@
-# PostgreSQL HA — Platform Service
+# PostgreSQL HA — retired
 
-**Chart:** `bitnami/postgresql-ha`
-**Namespace:** `platform`
-**Managed by:** `railiance-platform` (S3)
-**Workplan:** `RAIL-PL-WP-0001`
+**Status:** retired 2026-08-15 (`RAILIANCE-WP-0016` item 14)  
+**Superseded by:** CloudNativePG clusters in `databases` (`apps-pg`,
+`forgejo-db`, `platform-pg`, and the other CNPG instances).  
+**Do not deploy.** `make pg-deploy` is fail-closed.
+
+The Bitnami `postgresql-ha` (repmgr + pgpool) stack never ran as a live
+S3 service on railiance01. There is no `platform` namespace and no
+matching pods. Gitea’s historical subchart in S2 was replaced by
+`forgejo-db`. Keep this file as the retirement record and the
+pgpool-password incident note. New databases go through `docs/apps-pg.md`
+or `rapp-postgres`.
 
 ---
 

docs/s3-consumer-interfaces.md

@@ -0,0 +1,53 @@
+# S3 consumer service interfaces
+
+Work record: `RAILIANCE-WP-0016` item 17  
+Date: 2026-08-15  
+Contract version of this index: `1.0.0`
+
+Consumers bind to these contracts, not to Helm chart names or pod topology.
+Changing an engine behind a versioned interface does not bump the interface
+unless the consumer-visible fields change.
+
+| Interface | Version | Who it is for | Authority |
+| --- | --- | --- | --- |
+| Shared application database | `apps-pg.v1` | S5 apps that need an isolated database on `apps-pg` | `docs/apps-pg.md` |
+| Isolated platform database | `rapp-postgres.v1` | Platform services that need a CNPG consumer on `platform-pg` | `rapp-postgres/declarations/rapp.yaml` `consumer_contract` |
+| Standing runtime secret | `ccr-workload-kv.v1` | Workloads that need a KV path via External Secrets | `schemas/credential-change-request.schema.yaml` |
+| Short-lived lease | `credential-grant.v1` | Operators/agents and dynamic DB roles | `credential-grants/catalog.yaml` |
+| Rapp credential bind | `rapp-lane.v1` | How a rapp names the two lanes above | `docs/rapp-credential-lane-binding.md` |
+
+## Compatibility rules
+
+- A `vN` document may add optional fields. Removing or renaming a
+  required field is `vN+1`.
+- Values never appear in an interface document. Paths, grant ids, CCR
+  ids, and role names are the contract.
+- `make pg-deploy` / Bitnami DSN
+  `postgresql-ha-pgpool.platform.svc.cluster.local` is **not** an
+  interface. That stack is retired.
+
+## `apps-pg.v1`
+
+Consumer supplies: app name, namespace, database name, role name. Platform
+provisions the role and CNPG `Database`, labels the namespace
+`railiance.io/postgres-client=apps-pg`, and publishes a runtime Secret.
+RW endpoint: `apps-pg-rw.databases.svc.cluster.local:5432`. Bootstrap
+role `apps_admin` is not a consumer credential.
+
+## `rapp-postgres.v1`
+
+Consumer is a `consumers[].declaration`. Boundary unit is
+`database-per-consumer`. Credential type is
+`openbao-dynamic-database-credential` via grant
+`rapp-postgres/<consumer>-<role>`. Tenant identifiers are opaque.
+
+## `ccr-workload-kv.v1` and `credential-grant.v1`
+
+Unchanged semantics from `docs/credential-change-approval.md` and
+`docs/credential-broker.md`. The version name exists so a rapp can cite
+the lane without restating TTL, delivery, or revocation rules.
+
+## Not yet an interface
+
+Valkey and in-cluster MinIO have capability blocks in `SCOPE.md` and no
+live service. They do not receive a `v1` until a consumer exists.