First deployment: verified on railiance01

RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached
rather than ahead of it.

rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a
database-owner receipt with 12 checks proven live. creds/canned-prompts-publish
was deliberately not issued, so the service runs read-only and POST /packages
returns 503 explaining why — the intended posture, not a gap.

Four defects surfaced that only a real rollout could expose, two of them
silent:

- SET ROLE opened an implicit transaction that Alembic nested inside rather
  than owning, so every revision logged as applied and was rolled back.
  Alembic reported success against an empty database.
- The egress NetworkPolicy selected app.kubernetes.io/name, which the
  migration Job does not carry. The Job matched only the default-deny and
  succeeded exactly once, because it ran before the policies existed; the next
  migration would have failed on DNS. Now selects part-of, with ingress split
  into its own policy so the Job is never reachable.
- env.py read database_url rather than resolved_database_url, so the migration
  could never run where the credential is a mounted file.
- live-image-digest-match extracted the pin with a line-offset grep, which
  returned empty once comments were added above `version:`. The check degraded
  to reporting "not pinned yet" while a digest was pinned — it could not have
  passed for any pin. Now parsed as YAML. A verification step that cannot fail
  is worth less than none, because it is trusted.

Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

manifests/database-secrets.yaml

@@ -69,22 +69,19 @@ spec:
     - extract:
         key: creds/canned-prompts-migration
 ---
-# The publish token. Absent, the service is read-only — which is the correct
-# posture until per-publisher identity exists (canned-prompts service/auth.py).
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: canned-prompts-publish-token
-  namespace: canned-prompts
-spec:
-  refreshInterval: 15m
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: openbao-canned-prompts-database
-  target:
-    name: canned-prompts-publish-token
-    creationPolicy: Owner
-    deletionPolicy: Retain
-  dataFrom:
-    - extract:
-        key: creds/canned-prompts-publish
+# The publish token is deliberately NOT declared as an ExternalSecret.
+#
+# rapp-postgres confirmed on 2026-09-08 that `creds/canned-prompts-publish`
+# does not exist and is not being created, at our request. An ExternalSecret
+# pointing at it would sit permanently unresolved — indistinguishable from a
+# broken deployment, and an invitation for the next operator to "fix" it by
+# minting a credential nobody decided to issue.
+#
+# Without the secret the service runs READ-ONLY, which is the intended posture
+# until per-publisher identity exists upstream (RCP-WP-0002-T05). The runtime
+# Deployment mounts the secret `optional: true`, so it starts cleanly without it
+# and picks the token up if one is ever added.
+#
+# To enable publishing later: have rapp-postgres issue
+# `creds/canned-prompts-publish`, add the ExternalSecret here, and revisit the
+# NetworkPolicy ingress rule, which currently admits any namespace.

manifests/migration.yaml

@@ -17,6 +17,10 @@ spec:
     metadata:
       labels:
         app.kubernetes.io/name: canned-prompts-migration
+        # Carries part-of so the egress NetworkPolicy selects this Job too.
+        # Without it the Job matches only the default-deny and cannot reach
+        # PostgreSQL or DNS.
+        app.kubernetes.io/part-of: canned-prompts
     spec:
       automountServiceAccountToken: false
       restartPolicy: Never
@@ -29,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
+          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
           command: ["alembic"]
           args: ["upgrade", "head"]
           workingDir: /app
@@ -37,6 +41,12 @@ spec:
             # The migration role owns the schema; the runtime role does not.
             - name: CANNED_PROMPTS_DATABASE_URL_FILE
               value: /var/run/secrets/postgres-migration/url
+            # Authenticate as the leased migration login, then SET ROLE to the
+            # durable owner before creating anything. Leases are revoked; an
+            # object owned by a dead login has to be normalized afterwards.
+            # Required by the rapp-postgres database-owner boundary.
+            - name: CANNED_PROMPTS_MIGRATION_ROLE
+              value: canned_prompts_owner
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

manifests/runtime.yaml

@@ -27,7 +27,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: canned-prompts
-          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
+          image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
@@ -134,19 +134,36 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: canned-prompts-runtime
+  name: canned-prompts-ingress
   namespace: canned-prompts
 spec:
+  # Ingress is for the serving pods only. The migration Job serves nothing and
+  # must not be reachable.
   podSelector:
     matchLabels:
       app.kubernetes.io/name: canned-prompts
-  policyTypes: [Ingress, Egress]
+  policyTypes: [Ingress]
   ingress:
     - from:
         - namespaceSelector: {}
       ports:
         - protocol: TCP
           port: 8000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: canned-prompts-egress
+  namespace: canned-prompts
+spec:
+  # Selects on part-of, not name, so it covers the migration Job as well as the
+  # serving pods. Selecting only `name: canned-prompts` left the Job matched by
+  # nothing but the default-deny — it succeeded once purely because it ran
+  # before these policies existed, and the next migration would have failed.
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: canned-prompts
+  policyTypes: [Egress]
   egress:
     # PostgreSQL and DNS only. The service fetches nothing: a package arrives
     # by publish, never by the registry reaching out, so it needs no egress to