coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement S3 service assurance and admission checks
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 11:43:55 +02:00
parent 8f828c7609
commit 234b1b559f
21 changed files with 1728 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

15
SCOPE.md
View file

@ -22,7 +22,7 @@ or authorization authority. See [ADR-0001](docs/adr/ADR-0001-s3-platform-service
| Service | Implemented / evidenced | Limit and authority |
| --- | --- | --- |
| `apps-pg` | CNPG source, per-consumer database ACLs, 20-connection allowances, 15-second timeouts; daily backup, continuous WAL and 30-day retention; 56-second scratch restore and 14/14 boundary probes on 2026-08-20 | One instance; restart recovery, no HA or measured latency SLO. Ceiling 3, overflow `apps-pg-2` provisionable but demand-gated. S3 owns this CR and its controls. |
| `platform-pg` | Package-operated CNPG service, governed dynamic credentials, backup/restore evidence, Core Hub admission and private shadow evidence | `rapp-postgres` owns CR/provisioning/restore. S3 owns custody, placement policy and consumer disclosure. Published ceiling 4 declarations, counting the probe; reconcile current occupancy before admission. One instance is not HA. |
| `platform-pg` | Package-operated CNPG service, governed dynamic credentials, backup/restore evidence, Core Hub admission and private shadow evidence | `rapp-postgres` owns CR/provisioning/restore. S3 owns custody, placement policy and consumer disclosure. Ceiling 4 declarations, counting the probe; platform-pg is 4/4 and the deployed platform-pg-2 hosts sbom-nexus at 1/4. One instance is not HA. |
| OpenBao and credential delivery | CCR validation, policy/grant boundaries, approved apply interfaces, runtime KV/ESO and short-lived database lanes, ephemeral custody lifecycle | Package assets belong to `rapp-openbao`; custody/policy remains here. Existing helpers are not authority to mint arbitrary credentials. Operator-only access cutover and incident residuals remain open. |
| Backup storage consumption | Governed off-cluster S3 backup destination and credential lane used by CNPG; encrypted upload tooling for other backup consumers | Resource procurement belongs to `resource-control`/`reef-storage`. This does not establish a general S3 service or deployed MinIO. One successful restore does not establish a recurring recovery guarantee. |
| Cache / general object storage / messaging | Valkey deployment is gated; no supported consumer interface or deployed shared broker/general in-cluster object store is established by this review | Demand, reuse, ownership, service contract and recovery design must precede deployment. No engine/provider choice is made here. |
@ -69,7 +69,8 @@ records every reviewed plan and the consolidation mapping.
| Next | Numeric availability/recovery promises, evidence freshness, recurring drills, emission and admission drift lack a complete S3 acceptance loop | RPF-WP-0036-T02–T05 |
| Next | Compatibility ownership, stale Hub aliases, and undeployed capability demand need explicit disposition | RPF-WP-0036-T06/T07 |
The ready work in RPF-WP-0036 can proceed while attended operations wait.
RPF-WP-0036 now provides local assurance/admission checks and explicit service
disclosures; its remaining tasks wait for live proof and owner acceptance.
It must define achievable promises for the existing single-node substrate,
not declare HA through documentation. Any stronger availability target needs
an S1/S2 dependency and a package-level failover proof. Fleet-wide Q3 ownership
@ -112,3 +113,13 @@ Read [AGENTS.md](AGENTS.md), [INTENT.md](INTENT.md), then
`workplans/archived/`; [WORK-RECORDS.md](WORK-RECORDS.md) is the generated current
index (archives omitted). Routine sync follows AGENTS.md. The dated `.custodian-brief.md` and Hub
legacy aliases are not additional authoritative obligations.
## Assurance implementation — 2026-09-05
`make assurance-admission` checks package-native capacity/retention and source
disclosure drift. `make assurance-capture` pins the cluster and collects only
status metadata; `make assurance-check` fails on incomplete/stale/failed evidence.
The first live run found all three database cells Ready with same-day backups
and archiving, but three failing ESO resources. Recurring restore acceptance,
validated restore adapters and Q2 delivery remain open. See
[service assurance](docs/service-assurance.md) and RPF-WP-0036.