30 lines
1.4 KiB
Markdown
30 lines
1.4 KiB
Markdown
|
# Intent — rapp-canned-prompts
|
||
|
|
|
||
|
|
Package and operate the `canned-prompts` hosted registry and index on
|
||
|
|
Railiance, without moving product ownership into an operations repository.
|
||
|
|
|
||
|
|
This package makes deployment reproducible: an immutable image pin, a private
|
||
|
|
ClusterIP Service, credentials mounted as files from the platform broker, a
|
||
|
|
one-shot schema migration under a separate owner role, least-privilege
|
||
|
|
NetworkPolicies, live verification, and digest rollback.
|
||
|
|
|
||
|
|
Format semantics, package validation, API compatibility, the schema and its
|
||
|
|
migrations, and image publication remain owned by `canned-prompts`. PostgreSQL
|
||
|
|
topology, database isolation, backups and credential issuance remain owned by
|
||
|
|
`rapp-postgres` and the platform credential broker.
|
||
|
|
|
||
|
|
## What this repo decides
|
||
|
|
|
||
|
|
- how the workload is composed, pinned, rolled out and rolled back;
|
||
|
|
- what "healthy" means at the cluster level, and how it is verified;
|
||
|
|
- the network posture: what may reach the service, and what it may reach.
|
||
|
|
|
||
|
|
## What it does not decide
|
||
|
|
|
||
|
|
- what a valid prompt package is, or what any endpoint means — `canned-prompts`;
|
||
|
|
- database topology, backup or credential rotation — `rapp-postgres` and the broker;
|
||
|
|
- who may publish. The service's identity model is a single shared token
|
||
|
|
proving "the operator". Per-publisher identity is an open question in
|
||
|
|
`canned-prompts`, and this repo must not paper over it with cluster
|
||
|
|
configuration that implies finer control than exists.
|