coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0043-T03: record read-only policy-nexus adoption precheck (steps 1 and 3)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
This commit is contained in:
codex 2026-10-11 21:08:20 +02:00
parent 3d19215801
commit bd8931f92a
3 changed files with 32 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json Normal file
View file

@ -0,0 +1,27 @@
{
"task": "RPF-WP-0043-T03",
"collected_at": "2026-10-11T19:05Z",
"collected_by": "claude-code (agt-claude-railiance01 via k3s-api-railiance01 tunnel), read-only",
"cluster_node": "239.62.205.92.host.secureserver.net (railiance01)",
"step1_helm": {
"release": "policy-nexus", "namespace": "policy-nexus", "chart": "policy-nexus-0.2.0",
"deployed_revision": 9, "deployed_at": "2026-10-11T01:23:33",
"rollback_target_revision": 9,
"image_repository": "forgejo.coulomb.social/coulomb/policy-nexus",
"image_digest": "sha256:4e0db6a57eb00f577159aa6ee10f910dd67b03fd0541c6ce849f5426fdb99d06",
"publicationManifestDigest": "ba53cc4900e6bb9ab8aa4bac4e58cb5fe7a03d656bafb3f9cb3d9c8ebff7843a",
"sourceInventoryDigest": "40d9e8852fe4c9e75b71f371d0fdae38664b068e7498711b0ac5671d0f41efb5",
"sourceSetDigest": "15bda2e332285afc862df8974cf29de403737df5073fa362adfc6d203cf2f256"
},
"step2_render_diff": {
"status": "not-run",
"reason": "railiance-apps values path/revision not yet supplied (RAPP-POLICY-NEXUS-WP-0002-T02)"
},
"step3_objects": {
"listed_kinds": ["Deployment", "Service", "ConfigMap", "Ingress", "NetworkPolicy", "ServiceAccount", "PersistentVolumeClaim"],
"objects": ["Deployment/policy-nexus", "Service/policy-nexus", "ConfigMap/kube-root-ca.crt", "Ingress/policy-nexus-http", "Ingress/policy-nexus-https", "NetworkPolicy/policy-nexus-acme-solver", "NetworkPolicy/policy-nexus-default-deny", "NetworkPolicy/policy-nexus-traefik", "ServiceAccount/default", "ServiceAccount/policy-nexus"],
"argocd_tracking_label_or_annotation_present": false,
"secrets": "not listed (agent guard forbids Secret reads); Helm release Secrets carry no ArgoCD tracking label by construction",
"stop_conditions_hit": false
}
}

6
workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md
View file

@ -134,13 +134,15 @@ are placeholders and must be filled from the attended read.
```task
id: RPF-WP-0043-T03
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster."
blocking_reason: "Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel."
priority: high
depends_on: [RAPP-POLICY-NEXUS-WP-0002-T02]
state_hub_task_id: "2afb1aac-66dd-5e1e-92e1-fc020a59a927"
```
2026-10-11: read-only checks are agent-runnable (k3s-api-railiance01 tunnel); no longer an attended item.
Draft the Application under `docs/`, **not** under `argocd/applications/` on
`main`. The single-source sketch is superseded by the tenant's multi-source
shape. The draft is `docs/drafts/policy-nexus-application.yaml`: chart

2
workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
View file

@ -347,7 +347,7 @@ id: RPF-WP-0044-T08
status: wait
needs_human: true
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
blocking_reason: "Operator read-only check of coulombcore ArgoCD; item on the attended-window checklist (D1 standing rule), not a decision."
blocking_reason: "Founder runs read-only: ssh coulombcore 'sudo k3s kubectl get applications -n argocd' (agent identity has no kube rights on coulombcore)."
priority: low
state_hub_task_id: "55d1382f-5862-5321-a1c9-96767764ba43"
```