First deployment: verified on railiance01

RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached
rather than ahead of it.

rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a
database-owner receipt with 12 checks proven live. creds/canned-prompts-publish
was deliberately not issued, so the service runs read-only and POST /packages
returns 503 explaining why — the intended posture, not a gap.

Four defects surfaced that only a real rollout could expose, two of them
silent:

- SET ROLE opened an implicit transaction that Alembic nested inside rather
  than owning, so every revision logged as applied and was rolled back.
  Alembic reported success against an empty database.
- The egress NetworkPolicy selected app.kubernetes.io/name, which the
  migration Job does not carry. The Job matched only the default-deny and
  succeeded exactly once, because it ran before the policies existed; the next
  migration would have failed on DNS. Now selects part-of, with ingress split
  into its own policy so the Job is never reachable.
- env.py read database_url rather than resolved_database_url, so the migration
  could never run where the credential is a mounted file.
- live-image-digest-match extracted the pin with a line-offset grep, which
  returned empty once comments were added above `version:`. The check degraded
  to reporting "not pinned yet" while a digest was pinned — it could not have
  passed for any pin. Now parsed as YAML. A verification step that cannot fail
  is worth less than none, because it is trusted.

Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

SCOPE.md

@@ -27,15 +27,17 @@ Railiance, without moving product ownership into an operations repository.
 
 ## Current State
 
-**Declared.** The image is published and pinned by digest
-(`sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123`), the manifests parse, and
-`readiness_state` is `declared`. Nothing is deployed yet.
+**Verified and running** on railiance01 as of 2026-09-08. Image
+`sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf`
+(tag 0.1.4), schema at alembic `0002`, all deployment and service-level smoke
+checks passing. Evidence in `docs/evidence/`.
 
-One thing blocks a first rollout: the database and its roles do not exist.
-`rapp-postgres` has the request as `consumers/canned-prompts.yaml`; minting the
-OpenBao credentials is its operator's step, not this repo's.
+The service is **read-only by design**: `creds/canned-prompts-publish` was
+deliberately not issued, so `POST /packages` returns 503 explaining why. That is
+the intended posture until per-publisher identity exists upstream — not a
+misconfiguration. Do not "fix" it by minting a credential.
 
-`workplans/RCP-WP-0002-first-deployment.md` carries the remaining sequence.
+`workplans/RCP-WP-0002-first-deployment.md` records how it got there.
 
 ## Verification