Land RPF-WP-0039 third apps-pg consumer source.

Admit vergabe_demo_company as the third declared consumer, track
the bounded provisioner and scoped controls, and refresh admission
occupancy to 3/3. Overflow remains apps-pg-2 before any fourth.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a

docs/apps-pg.md

@@ -23,7 +23,8 @@ it as a consumer credential.
 **Two reachable clusters each carry a CNPG `Cluster` named `apps-pg` in a
 namespace named `databases`.** The one this document describes is
 **railiance01** (k3s v1.35.1) — it also carries `platform-pg` and `forgejo-db`,
-and holds both apps-pg consumers (`vergabe_db`, `coulomb_social_db`). The other
+and holds the three apps-pg consumers (`vergabe_db`, `coulomb_social_db`,
+`vergabe_demo_company`). The other
 cluster carries `gitea-db` and only one apps-pg consumer.
 
 Selecting the right one by kubeconfig filename is not safe: `KUBECONFIG` is an
@@ -115,6 +116,7 @@ the standard PostgreSQL, instance manager, and metrics ports.
 | --- | --- | --- | --- | --- |
 | vergabe-teilnahme | `vergabe` | `vergabe_db` | `vergabe-app-credentials` | `vergabe-teilnahme` |
 | coulomb-social | `coulomb_social` | `coulomb_social_db` | `coulomb-social-app-credentials` | `coulomb-social` |
+| vergabe-demo-company | `vergabe_demo_company` | `vergabe_demo_company` | `vergabe-demo-company-credentials` | `vergabe-demo-company` |
 
 Bootstrapped 2026-08-09 on railiance01: cluster healthy; both Database CRs
 applied; coulomb-social connectivity smoke from labeled consumer ns OK.
@@ -152,3 +154,23 @@ labor, allocation drivers) is published under
 isolation evidence captured on 2026-08-20 is in
 `docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md` and
 `docs/evidence/RPF-WP-0019-isolation-2026-08-20.md`.
+
+
+## Fresh Vergabe demo consumer — 2026-09-12
+
+RPF-WP-0039 admits the third consumer, vergabe_demo_company, in namespace
+vergabe-demo-company. Database and role both use that name; the provider Secret
+is databases/vergabe-demo-company-credentials and the exact consumer runtime
+bundle is vergabe-demo-company/vergabe-demo-env. The existing vergabe_db remains
+separate. No bootstrap or other consumer credentials are reused.
+
+`tools/provision-vergabe-demo.py inspect` returns metadata only. The dry-run/apply
+modes require the observed cluster resourceVersion, append only the fixed third
+role, and refuse conflicting existing state. Credentials are generated in memory
+and delivered through captured child stdin/stdout, never arguments or files.
+This is the documented interim platform-administered Kubernetes/CNPG custody
+lane; it does not claim OpenBao lifecycle automation. Source declarations are
+helm/vergabe-demo-company-{role,database}.yaml; scoped role/database controls are
+helm/vergabe-demo-company-controls.sql. Do not apply historical consumer SQL to
+accomplish this onboarding. See RAPPS-WP-0014 for live deployment and remaining
+coherent recovery acceptance. The declared cell is now full at three consumers.

docs/placement-policy.md

@@ -83,6 +83,7 @@ triggers. It is not the same role as the operator of the cluster.
 | `forgejo` | `forgejo-db` | P2 | this repo | — | single consumer |
 | `vergabe` | `apps-pg` | P1 | `vergabe-teilnahme` | this repo | 14 live boundary/control probes |
 | `coulomb_social` | `apps-pg` | P1 | `coulomb-social` | this repo | 14 live boundary/control probes |
+| `vergabe_demo_company` | `apps-pg` | P1 | `vergabe-demo-company` | this repo | RPF-WP-0039 provisioning and SQL isolation readback |
 
 ### 3.1 The two apps-pg P1 levels are now evidenced
 
@@ -110,7 +111,7 @@ artifact. Saturating `coulomb_social` bound at 20 and rejected an excess
 connection while five `vergabe` queries remained available. Five-query
 operator-path wall time rose from 5,285ms to 8,146ms (54.1%).
 
-Both consumers are `interactive`, but neither publishes a numeric database
+The three consumers are `interactive`, but none publishes a numeric database
 latency objective, and the measurement includes five separate `kubectl exec`
 and `psql` startups. The artifact therefore evidences P1 boundary and continued
 availability, not a latency SLO or CPU/memory fairness. That limit is part of
@@ -148,11 +149,11 @@ one". "Provision a second cluster" is an answer; "revisit at the time" is not.
 | --- | --- | --- | --- |
 | `platform-pg` | 4 declarations (package ADR-0004) | `platform-pg-2`, deployed | 4/4 including probe and Core Hub; fifth refused |
 | `platform-pg-2` | 4 declarations (same package validator) | No third cell approved | 1/4: sbom-nexus; owner admission and restore completed 2026-08-22 |
-| `apps-pg` | 3 consumers; 20 connections each, 1Gi memory binds first | `apps-pg-2` | 2/3; overflow must exist before a 4th |
+| `apps-pg` | 3 consumers; 20 connections each, 1Gi memory binds first | `apps-pg-2` | 3/3; overflow must exist before a 4th |
 | `forgejo-db` | n/a — single consumer | n/a | — |
 
-Source and live metadata reviewed 2026-09-05: platform-pg is full; apps-pg
-remains 2/3 and apps-pg-2 is still unapplied. The generated
+Source and live metadata reviewed 2026-09-15: platform-pg is full; apps-pg
+is 3/3 after RPF-WP-0039 and apps-pg-2 is still unapplied. The generated
 `assurance/admission-baseline.json` binds these disclosures to the actual owner
 validators/declarations. `make assurance-admission` refuses source drift.
 Package acceptance, rather than this table, authorizes consumer provisioning.

docs/s3-consumer-interfaces.md

@@ -62,7 +62,7 @@ before the corresponding live rollout:
 | Property | Value | Note |
 | --- | --- | --- |
 | `max_connections` | 100 | Explicit aggregate cap. Forty connections remain outside the declared three-consumer ceiling for operator/CNPG overhead. |
-| Per-consumer connections | 20 | CNPG `managed.roles[].connectionLimit`, for both current roles. |
+| Per-consumer connections | 20 | CNPG `managed.roles[].connectionLimit`, for all three current roles. |
 | `statement_timeout` | 15s | Per role; idempotent operator SQL because CNPG 1.28 has no managed-role settings field. |
 | `idle_in_transaction_session_timeout` | 15s | Per role, same enforcement path. |
 | Database boundary | own database only | `CONNECT` and `TEMPORARY` are revoked from `PUBLIC`; each consumer role receives them only on its own database. |
@@ -125,7 +125,7 @@ freshness budgets are not SLAs or approval to deploy schedules. Consumers that
 require stronger guarantees need a placement/recovery decision.
 
 Current source occupancy: platform-pg 4/4 including the isolation probe,
-platform-pg-2 1/4 for sbom-nexus, apps-pg 2/3, apps-pg-2 0/3 and unapplied.
+platform-pg-2 2/4 for sbom-nexus and canned-prompts, apps-pg 3/3, apps-pg-2 0/3 and unapplied.
 All three deployed cells declare one instance, 1Gi memory limit, 100 aggregate
 connections and 30-day retention; live metadata matched on 2026-09-05. The
 second platform cell's approved restore took 51 seconds on 2026-08-22; this

docs/service-assurance.md

@@ -92,8 +92,8 @@ between effective package retention and the actual CR. Hashes pin every
 consumed source artifact; changing package code or declarations requires review
 before refreshing the baseline. Do not blindly regenerate it in CI.
 
-Source occupancy: apps-pg 2/3, apps-pg-2 0/3 (not deployed), platform-pg 4/4
-including the probe, platform-pg-2 1/4 for sbom-nexus. Tenant-engine's PostgreSQL
+Source occupancy: apps-pg 3/3, apps-pg-2 0/3 (not deployed), platform-pg 4/4
+including the probe, platform-pg-2 2/4 for sbom-nexus and canned-prompts. Tenant-engine's PostgreSQL
 cutover completed 2026-08-21; its old SQLite-current claim was stale. Platform-pg-2
 was accepted and restored on 2026-08-22; it is no longer merely named overflow.
 Core Hub is latency-critical alongside audit-core batch work; no service-class