coulomb/rapp-canned-prompts
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish the image, pin it by digest, and request the database

Browse source 
RCP-WP-0002-T01 done. Published
forgejo.coulomb.social/coulomb/canned-prompts:0.1.0 and pinned
sha256:e0ded3c7fe25... in declarations/rapp.yaml and both manifests.

Pinned by digest rather than tag: a tag can be moved, and
live-image-digest-match would then pass against something that is no longer
what this repo reviewed. Verified after the push by fetching the manifest back
by digest rather than trusting the push output.

readiness_state draft -> declared. Not deployed, so not `deployed`.

T02 requested rather than performed. rapp-postgres now carries
consumers/canned-prompts.yaml against its documented PostgresConsumer shape,
and its agent has the request. `make provision-consumers`, which mints the
OpenBao credentials, was deliberately not run: credential issuance belongs to
that repo's operator, and running it from the consuming side would take a
decision that is not this repo's, however available the script is.

T03 and T04 move to wait behind it.

Also corrected a check of my own: I briefly read the cluster list as lacking
platform-pg-2 and suspected the manifests targeted a host that does not exist.
That was my own truncated output. platform-pg-2 is present and healthy, and the
postgres-client label matches what sbom-nexus actually carries in the cluster
rather than only what its repo says.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
This commit is contained in:
tegwick 2026-09-07 08:43:35 +02:00
parent f6f7390651
commit 8dc6257d93
5 changed files with 52 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

15
SCOPE.md
View file

@ -27,16 +27,15 @@ Railiance, without moving product ownership into an operations repository.
## Current State
**Draft.** The package is written and its manifests parse, but nothing is
deployed and `readiness_state` is `draft`. Two things block a first rollout,
both operator actions rather than authoring ones:
**Declared.** The image is published and pinned by digest
(`sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123`), the manifests parse, and
`readiness_state` is `declared`. Nothing is deployed yet.
- the image has never been published, so no registry digest exists to pin
(`declarations/rapp.yaml` says `pending-publication` rather than carrying a
placeholder that could be mistaken for something deployable);
- database roles and OpenBao credentials are not provisioned.
One thing blocks a first rollout: the database and its roles do not exist.
`rapp-postgres` has the request as `consumers/canned-prompts.yaml`; minting the
OpenBao credentials is its operator's step, not this repo's.
`workplans/RCP-WP-0002-first-deployment.md` carries both.
`workplans/RCP-WP-0002-first-deployment.md` carries the remaining sequence.
## Verification

13
declarations/rapp.yaml
View file

@ -4,7 +4,7 @@ rapp_id: rapp-canned-prompts
repo: rapp-canned-prompts
ownership_repo: canned-prompts
contract_version: 1.0.0
readiness_state: draft
readiness_state: declared
workload_identity:
name: canned-prompts
package_type: manifest-managed-platform-service
@ -34,12 +34,11 @@ composition:
upstream_components:
- name: canned-prompts
source: forgejo.coulomb.social/coulomb/canned-prompts
# NOT YET PUBLISHED. The image builds and was verified locally
# (CANP-WP-0006-T06), but has never been pushed, so no registry digest
# exists to pin. A placeholder shaped like a digest would be worse than
# this sentinel: it could be mistaken for something deployable.
# RCP-WP-0001-T01 replaces this with the real digest.
version: pending-publication
# Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.0.
# Pinned by digest rather than tag: a tag can be moved, and
# live-image-digest-match would then pass against something that is no
# longer what this repo reviewed.
version: sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
rollout_contract:
default_mode: kubectl-server-side-apply
smoke_contract:

3
manifests/migration.yaml
View file

@ -29,8 +29,7 @@ spec:
type: RuntimeDefault
containers:
- name: migrate
# REPLACE on first publication — see declarations/rapp.yaml.
image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication
image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
command: ["alembic"]
args: ["upgrade", "head"]
workingDir: /app

3
manifests/runtime.yaml
View file

@ -27,8 +27,7 @@ spec:
type: RuntimeDefault
containers:
- name: canned-prompts
# REPLACE on first publication — see declarations/rapp.yaml.
image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication
image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
imagePullPolicy: IfNotPresent
ports:
- name: http

47
workplans/RCP-WP-0002-first-deployment.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "First deployment of canned-prompts on Railiance"
domain: agents
repo: rapp-canned-prompts
status: proposed
status: active
owner: codex
topic_slug: practice
created: "2026-09-06"
@ -25,7 +25,7 @@ it deployed.
```task
id: RCP-WP-0002-T01
status: todo
status: done
priority: high
state_hub_task_id: "3e7faf50-8fe9-5ef3-8a75-1d9e586d6c0f"
```
@ -41,17 +41,28 @@ The image builds and was verified locally in `canned-prompts`
pass against the running container, and the reference CLI installs a package
from it over HTTP.
What remains is publication to `forgejo.coulomb.social/coulomb/canned-prompts`,
which needs registry credentials. Then replace `pending-publication` in
`declarations/rapp.yaml`, `manifests/runtime.yaml` and `manifests/migration.yaml`
with the `@sha256:` digest — the same digest in all three, since
`live-image-digest-match` compares them.
**Done, 2026-09-07.** Published as
`forgejo.coulomb.social/coulomb/canned-prompts:0.1.0` and pinned by **digest**
in the declaration and both manifests:
```
sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123
```
Pinned by digest rather than tag deliberately: a tag can be moved, and
`live-image-digest-match` would then pass against something that is no longer
what this repo reviewed.
Verified before pushing — the image resolves a file-mounted credential, carries
the reference validator, and ships the migration scripts — and verified after,
by fetching the manifest back **by digest** rather than trusting the push
output. `readiness_state` moved `draft` → `declared`.
## Provision database roles and credentials
```task
id: RCP-WP-0002-T02
status: todo
status: wait
priority: high
state_hub_task_id: "61f5cbd7-8fcf-5156-87da-57239ae55d8f"
```
@ -71,17 +82,33 @@ Needed from `rapp-postgres` and the credential broker:
read-only, which is the correct posture until per-publisher identity exists —
not a misconfiguration to be worked around.
**Requested, 2026-09-07.** `rapp-postgres` now carries
`consumers/canned-prompts.yaml`, authored against its documented
`PostgresConsumer` shape, and its agent has the request in its inbox.
The declaration only. `make provision-consumers` — the step that actually mints
OpenBao credentials — was deliberately **not** run: credential issuance is
`rapp-postgres`' to perform, and running it from the consuming side would take a
decision that is not this repo's, however available the script happens to be.
Blocked here until those credentials exist. T03 and T04 are blocked behind it.
## Apply and migrate
```task
id: RCP-WP-0002-T03
status: todo
status: wait
priority: high
state_hub_task_id: "0b8d206e-bd28-5950-abf7-d824015c09a4"
```
Order matters, and the ordering is the point rather than a convenience:
Verified against the live cluster before writing: `platform-pg-2` exists and is
healthy, and the `railiance.io/postgres-client: platform-pg-2` label matches
what `sbom-nexus` actually carries in the cluster rather than only what its repo
says.
1. `manifests/00-namespace.yaml` — the `railiance.io/postgres-client` label is
what lets the database namespace accept traffic;
2. `manifests/database-secrets.yaml`, then wait for the secrets to materialize;
@ -97,7 +124,7 @@ other.
```task
id: RCP-WP-0002-T04
status: todo
status: wait
priority: high
state_hub_task_id: "6d9eb97c-57e2-5b74-b6eb-455076713417"
```