tegwick
4d5af7698d
RCP-WP-0002 T02-T04 done, readiness_state verified with evidence attached rather than ahead of it. rapp-postgres provisioned canned_prompts on platform-pg-2 and sent a database-owner receipt with 12 checks proven live. creds/canned-prompts-publish was deliberately not issued, so the service runs read-only and POST /packages returns 503 explaining why — the intended posture, not a gap. Four defects surfaced that only a real rollout could expose, two of them silent: - SET ROLE opened an implicit transaction that Alembic nested inside rather than owning, so every revision logged as applied and was rolled back. Alembic reported success against an empty database. - The egress NetworkPolicy selected app.kubernetes.io/name, which the migration Job does not carry. The Job matched only the default-deny and succeeded exactly once, because it ran before the policies existed; the next migration would have failed on DNS. Now selects part-of, with ingress split into its own policy so the Job is never reachable. - env.py read database_url rather than resolved_database_url, so the migration could never run where the credential is a mounted file. - live-image-digest-match extracted the pin with a line-offset grep, which returned empty once comments were added above `version:`. The check degraded to reporting "not pinned yet" while a digest was pinned — it could not have passed for any pin. Now parsed as YAML. A verification step that cannot fail is worth less than none, because it is trusted. Evidence: docs/evidence/RCP-WP-0002-T04-first-deployment-2026-09-08.md Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM Assistant: claude-code Assistant-Model: opus Assistant-Process: 388925@bnt-lap001 Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502
64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
kind: managed-workload-package
|
|
repo_family: rapp
|
|
rapp_id: rapp-canned-prompts
|
|
repo: rapp-canned-prompts
|
|
ownership_repo: canned-prompts
|
|
contract_version: 1.0.0
|
|
readiness_state: verified
|
|
workload_identity:
|
|
name: canned-prompts
|
|
package_type: manifest-managed-platform-service
|
|
data_classification: internal
|
|
criticality: medium
|
|
primary_rail: rail-kubernetes
|
|
supported_rails:
|
|
- rail-kubernetes
|
|
bound_reefs:
|
|
- reef-railiance
|
|
runtime_dependencies:
|
|
- kubernetes-api
|
|
- openbao-database-secrets-engine
|
|
composition:
|
|
purpose: >-
|
|
Package and operate the canned-prompts hosted registry and index on
|
|
Railiance. Format semantics, package validation, API compatibility, the
|
|
schema and its migrations, and image publication remain owned by
|
|
canned-prompts. PostgreSQL topology, database isolation, backups and
|
|
credential issuance remain owned by rapp-postgres and the platform
|
|
credential broker.
|
|
member_repos:
|
|
- repo: rapp-canned-prompts
|
|
role: managed runtime package
|
|
deployables:
|
|
- canned-prompts
|
|
upstream_components:
|
|
- name: canned-prompts
|
|
source: forgejo.coulomb.social/coulomb/canned-prompts
|
|
# Published 2026-09-07 from canned-prompts service/Dockerfile, tag 0.1.4.
|
|
# Pinned by digest rather than tag: a tag can be moved, and
|
|
# live-image-digest-match would then pass against something that is no
|
|
# longer what this repo reviewed.
|
|
version: sha256:2fbac3c0d1609a76d9478e540ae5450c5425e8c04e0565cccc6a4eb0180ebcaf
|
|
rollout_contract:
|
|
default_mode: kubectl-server-side-apply
|
|
smoke_contract:
|
|
required:
|
|
- state-health-ok
|
|
- migration-at-head
|
|
- external-secrets-ready
|
|
- private-service-only
|
|
- networkpolicies-present
|
|
- live-image-digest-match
|
|
rollback_contract:
|
|
order:
|
|
- previous-immutable-image-digest
|
|
- apply-reviewed-git-revision
|
|
source_documents:
|
|
- repo: canned-prompts
|
|
path: CannedPromptFormat.md
|
|
- repo: canned-prompts
|
|
path: service/README.md
|
|
- repo: canned-prompts
|
|
path: workplans/CANP-WP-0006-hosted-registry-service.md
|
|
- repo: repo-manager
|
|
path: docs/RailianceAppDeploymentGuide.md
|