tegwick
4d5af7698d
RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached rather than ahead of it. rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a database-owner receipt with 12 checks proven live. creds/canned-prompts-publish was deliberately not issued, so the service runs read-only and POST /packages returns 503 explaining why — the intended posture, not a gap. Four defects surfaced that only a real rollout could expose, two of them silent: - SET ROLE opened an implicit transaction that Alembic nested inside rather than owning, so every revision logged as applied and was rolled back. Alembic reported success against an empty database. - The egress NetworkPolicy selected app.kubernetes.io/name, which the migration Job does not carry. The Job matched only the default-deny and succeeded exactly once, because it ran before the policies existed; the next migration would have failed on DNS. Now selects part-of, with ingress split into its own policy so the Job is never reachable. - env.py read database_url rather than resolved_database_url, so the migration could never run where the credential is a mounted file. - live-image-digest-match extracted the pin with a line-offset grep, which returned empty once comments were added above `version:`. The check degraded to reporting "not pinned yet" while a digest was pinned — it could not have passed for any pin. Now parsed as YAML. A verification step that cannot fail is worth less than none, because it is trusted. Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
2.2 KiB
2.2 KiB
SCOPE
One-liner
Package and operate the canned-prompts hosted registry and index on
Railiance, without moving product ownership into an operations repository.
In Scope
declarations/rapp.yaml— the managed-workload declaration: composition, image pin, rollout, smoke and rollback contracts.manifests/— namespace, external secrets, migration Job, and the runtime Deployment, Service, ServiceAccount and NetworkPolicies.tools/smoke.sh— deployment-level verification, delegating the service-level half tocanned-prompts.- Rollout, rollback and the network posture.
Out of Scope
- What a valid prompt package is, what any endpoint means, the schema and its
migrations, and image publication — all
canned-prompts. - PostgreSQL topology, isolation, backups, credential issuance —
rapp-postgresand the platform credential broker. - Who may publish. The service's identity is a single shared token proving "the operator"; per-publisher identity is an open question upstream, and this repo must not imply finer control than exists.
Current State
Verified and running on railiance01 as of 2026-09-08. Image
sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
(tag 0.1.4), schema at alembic 0002, all deployment and service-level smoke
checks passing. Evidence in docs/evidence/.
The service is read-only by design: creds/canned-prompts-publish was
deliberately not issued, so POST /packages returns 503 explaining why. That is
the intended posture until per-publisher identity exists upstream — not a
misconfiguration. Do not "fix" it by minting a credential.
workplans/RCP-WP-0002-first-deployment.md records how it got there.
Verification
This repo builds nothing.
for f in manifests/*.yaml; do python3 -c "import yaml,sys; list(yaml.safe_load_all(open('$f')))"; done
bash -n tools/smoke.sh
NS=canned-prompts ./tools/smoke.sh # against a live deployment
Getting Oriented
- Intent and boundaries:
INTENT.md - The declaration:
declarations/rapp.yaml - What the service is:
canned-prompts/service/README.md - Deployment guide:
repo-manager/docs/RailianceAppDeploymentGuide.md