coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read the issue-core pin from the Application for the ESO pre-check.

Browse source 
The 2026-11-07 founder pre-check stopped at expected_revision because verify-live still required the 2026-10-20 pin 186c817. Live issue-core is Synced and Healthy at the current Application targetRevision. The attended script and runbook now take that revision from the Application file. T06 stays waiting on the founder re-run.

Assistant: grok
Assistant-Session: 01a1b732-21dc-7ab3-b857-8436973c43a3
This commit is contained in:
codex 2026-11-07 19:37:03 +01:00
parent d64557e0cf
commit 46b456c27b
3 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/runbooks/rpf-wp-0044-t06-eso-adoption.md
View file

@ -52,7 +52,8 @@ The manual sections below remain the reference for what the script does.
cd ~/railiance-platform && git pull --ff-only
D=docs/evidence/2026-10-21-eso-adoption-prep
# a) fresh predecessor proofs (gate window is 300 s, so run all three back to back)
( cd ~/rapp-issue-core && make -s verify-live VERIFY_ARGS="--expected-revision 186c817b67d3919a64acdddbd3889e539841f946 --expected-source-url ssh://git@forgejo.coulomb.social:30022/coulomb/rapp-issue-core.git --smoke" ) > $D/issue-core-proof.json
REV=$(python3 -c "import yaml; print(yaml.safe_load(open('argocd/railiance01/applications/issue-core.application.yaml'))['spec']['source']['targetRevision'])")
( cd ~/rapp-issue-core && make -s verify-live VERIFY_ARGS="--expected-revision $REV --expected-source-url ssh://git@forgejo.coulomb.social:30022/coulomb/rapp-issue-core.git --smoke" ) > $D/issue-core-proof.json
python3 scripts/workload_adoption_proof.py --live --source-root ~/target-revenue --observation $D/target-revenue-observation.json --receipt $D/target-revenue-proof.json
python3 scripts/eso_adoption_readiness.py --draft argocd/railiance01/drafts/external-secrets.application.yaml --issue-core-proof $D/issue-core-proof.json --target-revenue-proof $D/target-revenue-proof.json | tee $D/readiness-r2.json
# must print "ready_for_fresh_native_render_diff": true

5
scripts/rpf_wp_0044_t06_attended.sh
View file

@ -37,7 +37,8 @@ DRAFT="$ROOT/argocd/railiance01/drafts/external-secrets.application.yaml"
STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
EVID="$ROOT/docs/evidence/2026-10-21-eso-adoption-prep/attended-$STAMP"
CHECK=(python3 "$ROOT/scripts/eso_attended_checks.py")
ISSUE_REV=186c817b67d3919a64acdddbd3889e539841f946
ISSUE_APP="$ROOT/argocd/railiance01/applications/issue-core.application.yaml"
ISSUE_REV="$(python3 -c 'import sys,yaml; print(yaml.safe_load(open(sys.argv[1]))["spec"]["source"]["targetRevision"])' "$ISSUE_APP")"
ISSUE_URL=ssh://git@forgejo.coulomb.social:30022/coulomb/rapp-issue-core.git
SYNC_JSON='{"operation":{"initiatedBy":{"username":"rpf-wp-0044-t06"},"sync":{"revision":"0.16.1","prune":false,"syncOptions":["ServerSideApply=true"],"syncStrategy":{"apply":{"force":false}}}}}'
@ -74,7 +75,7 @@ EOF
[ "$DRY" = 1 ] || mkdir -p "$EVID"
WORK="$(mktemp -d)"; chmod 700 "$WORK"; trap 'rm -rf "$WORK"' EXIT
say "route=$KUBECTL_ROUTE dry_run=$DRY evidence=$EVID"
say "route=$KUBECTL_ROUTE dry_run=$DRY evidence=$EVID issue-core=$ISSUE_REV"
step kube get nodes -o name
say "1/6 fresh predecessor proofs (300 s window starts now)"

4
workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: railiance-platform
topic_slug: railiance
created: "2026-09-21"
updated: "2026-10-11"
updated: "2026-11-07"
related: [RPF-WP-0043, RPF-WP-0022]
state_hub_workstream_id: "98140775-3b9a-5cf9-9af6-722502d487dc"
---
@ -350,6 +350,8 @@ state_hub_task_id: "4ca54868-c31f-5e3d-b7d3-a15b84c15f80"
2026-10-11: requalified after founder decision D2 (ArgoCD owns production) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
2026-11-07 pre-check no-go: `verify-live` reached `expected_revision` only. Live issue-core is Synced and Healthy at `11af3cbf359ba850c8a807d7cc8b369c037862df`, the current Application pin. The script still required the 2026-10-20 pin `186c817`. Nothing was changed. The script now reads the Application `targetRevision`.
**Authorized by D2; waits on predecessor automated proof, not another founder go.**
The draft already carries CRD prune/delete protection (verified preparation
2026-09-27; 39 objects, 20 protected CRDs, metadata-only diff). That historical