# SCOPE

## One-liner

Package and operate the `canned-prompts` hosted registry and index on
Railiance, without moving product ownership into an operations repository.

## In Scope

- `declarations/rapp.yaml` — the managed-workload declaration: composition,
  image pin, rollout, smoke and rollback contracts.
- `manifests/` — namespace, external secrets, migration Job, and the runtime
  Deployment, Service, ServiceAccount and NetworkPolicies.
- `tools/smoke.sh` — deployment-level verification, delegating the
  service-level half to `canned-prompts`.
- Rollout, rollback and the network posture.

## Out of Scope

- What a valid prompt package is, what any endpoint means, the schema and its
  migrations, and image publication — all `canned-prompts`.
- PostgreSQL topology, isolation, backups, credential issuance — `rapp-postgres`
  and the platform credential broker.
- Who may publish. The service's identity is a single shared token proving
  "the operator"; per-publisher identity is an open question upstream, and this
  repo must not imply finer control than exists.

## Current State

**Verified and running** on railiance01 as of 2026-09-08. Image
`sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf`
(tag 0.1.4), schema at alembic `0002`, all deployment and service-level smoke
checks passing. Evidence in `docs/evidence/`.

The service is **read-only by design**: `creds/canned-prompts-publish` was
deliberately not issued, so `POST /packages` returns 503 explaining why. That is
the intended posture until per-publisher identity exists upstream — not a
misconfiguration. Do not "fix" it by minting a credential.

`workplans/RCP-WP-0002-first-deployment.md` records how it got there.

## Verification

This repo builds nothing.

```bash
for f in manifests/*.yaml; do python3 -c "import yaml,sys; list(yaml.safe_load_all(open('$f')))"; done
bash -n tools/smoke.sh
NS=canned-prompts ./tools/smoke.sh        # against a live deployment
```

## Getting Oriented

- Intent and boundaries: `INTENT.md`
- The declaration: `declarations/rapp.yaml`
- What the service is: `canned-prompts/service/README.md`
- Deployment guide: `repo-manager/docs/RailianceAppDeploymentGuide.md`