From 8dc6257d93d863ec5dd1471498cb3943f6758eef Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 7 Sep 2026 08:43:35 +0200 Subject: [PATCH] Publish the image, pin it by digest, and request the database RCP-WP-0002-T01 done. Published forgejo.coulomb.social/coulomb/canned-prompts:0.1.0 and pinned sha256:e0ded3c7fe25... in declarations/rapp.yaml and both manifests. Pinned by digest rather than tag: a tag can be moved, and live-image-digest-match would then pass against something that is no longer what this repo reviewed. Verified after the push by fetching the manifest back by digest rather than trusting the push output. readiness_state draft -> declared. Not deployed, so not `deployed`. T02 requested rather than performed. rapp-postgres now carries consumers/canned-prompts.yaml against its documented PostgresConsumer shape, and its agent has the request. `make provision-consumers`, which mints the OpenBao credentials, was deliberately not run: credential issuance belongs to that repo's operator, and running it from the consuming side would take a decision that is not this repo's, however available the script is. T03 and T04 move to wait behind it. Also corrected a check of my own: I briefly read the cluster list as lacking platform-pg-2 and suspected the manifests targeted a host that does not exist. That was my own truncated output. platform-pg-2 is present and healthy, and the postgres-client label matches what sbom-nexus actually carries in the cluster rather than only what its repo says. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502 --- SCOPE.md | 15 ++++---- declarations/rapp.yaml | 13 +++---- manifests/migration.yaml | 3 +- manifests/runtime.yaml | 3 +- workplans/RCP-WP-0002-first-deployment.md | 47 ++++++++++++++++++----- 5 files changed, 52 insertions(+), 29 deletions(-) diff --git a/SCOPE.md b/SCOPE.md index 425c42a..80f2648 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -27,16 +27,15 @@ Railiance, without moving product ownership into an operations repository. ## Current State -**Draft.** The package is written and its manifests parse, but nothing is -deployed and `readiness_state` is `draft`. Two things block a first rollout, -both operator actions rather than authoring ones: +**Declared.** The image is published and pinned by digest +(`sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123`), the manifests parse, and +`readiness_state` is `declared`. Nothing is deployed yet. -- the image has never been published, so no registry digest exists to pin - (`declarations/rapp.yaml` says `pending-publication` rather than carrying a - placeholder that could be mistaken for something deployable); -- database roles and OpenBao credentials are not provisioned. +One thing blocks a first rollout: the database and its roles do not exist. +`rapp-postgres` has the request as `consumers/canned-prompts.yaml`; minting the +OpenBao credentials is its operator's step, not this repo's. -`workplans/RCP-WP-0002-first-deployment.md` carries both. +`workplans/RCP-WP-0002-first-deployment.md` carries the remaining sequence. ## Verification diff --git a/declarations/rapp.yaml b/declarations/rapp.yaml index 9153f7a..2c7433a 100644 --- a/declarations/rapp.yaml +++ b/declarations/rapp.yaml @@ -4,7 +4,7 @@ rapp_id: rapp-canned-prompts repo: rapp-canned-prompts ownership_repo: canned-prompts contract_version: 1.0.0 -readiness_state: draft +readiness_state: declared workload_identity: name: canned-prompts package_type: manifest-managed-platform-service @@ -34,12 +34,11 @@ composition: upstream_components: - name: canned-prompts source: forgejo.coulomb.social/coulomb/canned-prompts - # NOT YET PUBLISHED. The image builds and was verified locally - # (CANP-WP-0006-T06), but has never been pushed, so no registry digest - # exists to pin. A placeholder shaped like a digest would be worse than - # this sentinel: it could be mistaken for something deployable. - # RCP-WP-0001-T01 replaces this with the real digest. - version: pending-publication + # Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.0. + # Pinned by digest rather than tag: a tag can be moved, and + # live-image-digest-match would then pass against something that is no + # longer what this repo reviewed. + version: sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123 rollout_contract: default_mode: kubectl-server-side-apply smoke_contract: diff --git a/manifests/migration.yaml b/manifests/migration.yaml index 8b771db..846df10 100644 --- a/manifests/migration.yaml +++ b/manifests/migration.yaml @@ -29,8 +29,7 @@ spec: type: RuntimeDefault containers: - name: migrate - # REPLACE on first publication — see declarations/rapp.yaml. - image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication + image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123 command: ["alembic"] args: ["upgrade", "head"] workingDir: /app diff --git a/manifests/runtime.yaml b/manifests/runtime.yaml index 83b8bf9..3bb3ab9 100644 --- a/manifests/runtime.yaml +++ b/manifests/runtime.yaml @@ -27,8 +27,7 @@ spec: type: RuntimeDefault containers: - name: canned-prompts - # REPLACE on first publication — see declarations/rapp.yaml. - image: forgejo.coulomb.social/coulomb/canned-prompts:pending-publication + image: forgejo.coulomb.social/coulomb/canned-prompts@sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123 imagePullPolicy: IfNotPresent ports: - name: http diff --git a/workplans/RCP-WP-0002-first-deployment.md b/workplans/RCP-WP-0002-first-deployment.md index 1917c8b..c4c2b58 100644 --- a/workplans/RCP-WP-0002-first-deployment.md +++ b/workplans/RCP-WP-0002-first-deployment.md @@ -4,7 +4,7 @@ type: workplan title: "First deployment of canned-prompts on Railiance" domain: agents repo: rapp-canned-prompts -status: proposed +status: active owner: codex topic_slug: practice created: "2026-09-06" @@ -25,7 +25,7 @@ it deployed. ```task id: RCP-WP-0002-T01 -status: todo +status: done priority: high state_hub_task_id: "3e7faf50-8fe9-5ef3-8a75-1d9e586d6c0f" ``` @@ -41,17 +41,28 @@ The image builds and was verified locally in `canned-prompts` pass against the running container, and the reference CLI installs a package from it over HTTP. -What remains is publication to `forgejo.coulomb.social/coulomb/canned-prompts`, -which needs registry credentials. Then replace `pending-publication` in -`declarations/rapp.yaml`, `manifests/runtime.yaml` and `manifests/migration.yaml` -with the `@sha256:` digest — the same digest in all three, since -`live-image-digest-match` compares them. +**Done, 2026-09-07.** Published as +`forgejo.coulomb.social/coulomb/canned-prompts:0.1.0` and pinned by **digest** +in the declaration and both manifests: + +``` +sha256:e0ded3c7fe2548c910445deaa31ec42e84f129a92aa324841e231a53fee1f123 +``` + +Pinned by digest rather than tag deliberately: a tag can be moved, and +`live-image-digest-match` would then pass against something that is no longer +what this repo reviewed. + +Verified before pushing — the image resolves a file-mounted credential, carries +the reference validator, and ships the migration scripts — and verified after, +by fetching the manifest back **by digest** rather than trusting the push +output. `readiness_state` moved `draft` → `declared`. ## Provision database roles and credentials ```task id: RCP-WP-0002-T02 -status: todo +status: wait priority: high state_hub_task_id: "61f5cbd7-8fcf-5156-87da-57239ae55d8f" ``` @@ -71,17 +82,33 @@ Needed from `rapp-postgres` and the credential broker: read-only, which is the correct posture until per-publisher identity exists — not a misconfiguration to be worked around. +**Requested, 2026-09-07.** `rapp-postgres` now carries +`consumers/canned-prompts.yaml`, authored against its documented +`PostgresConsumer` shape, and its agent has the request in its inbox. + +The declaration only. `make provision-consumers` — the step that actually mints +OpenBao credentials — was deliberately **not** run: credential issuance is +`rapp-postgres`' to perform, and running it from the consuming side would take a +decision that is not this repo's, however available the script happens to be. + +Blocked here until those credentials exist. T03 and T04 are blocked behind it. + ## Apply and migrate ```task id: RCP-WP-0002-T03 -status: todo +status: wait priority: high state_hub_task_id: "0b8d206e-bd28-5950-abf7-d824015c09a4" ``` Order matters, and the ordering is the point rather than a convenience: +Verified against the live cluster before writing: `platform-pg-2` exists and is +healthy, and the `railiance.io/postgres-client: platform-pg-2` label matches +what `sbom-nexus` actually carries in the cluster rather than only what its repo +says. + 1. `manifests/00-namespace.yaml` — the `railiance.io/postgres-client` label is what lets the database namespace accept traffic; 2. `manifests/database-secrets.yaml`, then wait for the secrets to materialize; @@ -97,7 +124,7 @@ other. ```task id: RCP-WP-0002-T04 -status: todo +status: wait priority: high state_hub_task_id: "6d9eb97c-57e2-5b74-b6eb-455076713417" ```