rapp-playwright/docs/platform-admission.md

Managed admission review — release 0.1.0

Publication is complete. The remaining WP-0004-T01 decision is platform admission and a scoped consumer binding, owned by railiance-platform. This review packet does not claim approval or create a cluster workload.

Package to review

• Published immutable release, independently pulled on railiance01: sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441.
• Declaration and workload: namespace playwright, one Recreate replica, 100m CPU / 256Mi memory requests, 1 CPU / 1Gi limits, 2Gi local-path RWO artifact volume, one-hour retention.
• Pod loopback listener with Kubernetes port-forward; no public ingress. Deny-all incoming NetworkPolicy, DNS and public HTTPS outgoing rules, exact application origin grant https://onco.cc. The fixture is internal to the browser service. A workstation development server requires a separately reviewed preview or dedicated reverse-tunnel origin.
• Non-root, read-only filesystem, dropped capabilities, no service-account token. Chromium's OS sandbox is disabled for trusted-target jobs; hostile pages and mutually untrusted tenants are outside this release's boundary.
• Role playwright-consumer permits pod lookup, deployment lookup and creation of pod port-forwards. The package deliberately contains no RoleBinding.

Outstanding owner decisions

1. Confirm admission of this package on railiance01 and any required changes to its resource, storage, target or browser trust boundary.
2. Name the existing user/group eligible for the consumer RoleBinding and the supported Kubernetes access route. Do not send credentials in the reply.
3. Confirm whether the initial managed pilot uses the bundled fixture and public OnCo home page, or supply an approved reachable preview for another baseline.

The founder selected railiance-platform as lifecycle owner. That selection and the successful registry pull do not establish these decisions. Capacity must be read again immediately before activation; earlier capacity observations expire.

Execution after admission

Use the immutable reference in the release record with the commands in operations. First review current node identity and capacity, bootstrap the namespace with server dry-run/diff, then server-validate and diff the full package. Apply the reviewed manifest and owner-approved consumer binding.

Retain the admitted revision, Ready rollout, PVC binding, actual image digest, and consumer identity's successful port-forward. Run the documented trial from that consumer path, retrieve and hash screenshots, and exercise wrong-token, failed UI assertion and unreachable-target cases. Verify bounded cancellation, restart interruption and retrieval of completed artifacts after restart.

For this first release, reapplying the same digest establishes recovery only. An actual cross-version rollback requires a second reviewed compatible release; retain that distinction in the receipt. WP-0004-T01 stays open until its managed execution and recovery evidence is complete. Independent trial delegation was previously authorized by the founder; no new trial has been started while managed admission is pending.