Reconcile reef bindings and evidence
This commit is contained in:
codex
parent
721398125b
commit
3e98b10d81
15 changed files with 541 additions and 36 deletions
|
|
@ -8,7 +8,11 @@ status: finished
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-07-26"
|
||||
updated: "2026-07-26"
|
||||
updated: "2026-08-21"
|
||||
quality_dod: DoD-Ok
|
||||
quality_dod_at: "2026-08-21"
|
||||
quality_dod_by: codex
|
||||
quality_dod_note: "Retrospective assessment: all four tasks are done, the grouped boundary and handoff remain current, and repository checks pass."
|
||||
state_hub_workstream_id: "da64c718-68bf-4719-aa42-fcf26687ab23"
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,11 @@ status: finished
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-07-26"
|
||||
updated: "2026-07-26"
|
||||
updated: "2026-08-21"
|
||||
quality_dod: DoD-Ok
|
||||
quality_dod_at: "2026-08-21"
|
||||
quality_dod_by: codex
|
||||
quality_dod_note: "Retrospective assessment: completed and cancelled work is explicit, Qonto residual work transferred to WP-0003, and rail evidence checks pass."
|
||||
state_hub_workstream_id: "5b31c13e-ddc9-495f-8325-88fa770982c5"
|
||||
---
|
||||
|
||||
|
|
|
|||
|
|
@ -8,9 +8,9 @@ status: blocked
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-07-26"
|
||||
updated: "2026-08-15"
|
||||
updated: "2026-08-21"
|
||||
related:
|
||||
- RAIL-BS-WP-0007
|
||||
- RCLUSTER-WP-0007
|
||||
- RMASTER-WP-0023
|
||||
- ADR-0006
|
||||
- ADR-0008
|
||||
|
|
@ -21,7 +21,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
|
|||
|
||||
This reef records the `rapp-qonto` binding and refuses
|
||||
`production-approved` without ADR-0006 evidence. It does not implement
|
||||
HA (`RAIL-BS-WP-0007`), Knative packaging (`rapp-qonto`), or public
|
||||
HA (`RCLUSTER-WP-0007`), Knative packaging (`rapp-qonto`), or public
|
||||
listeners. Production approval does not make Qonto public (ADR-0008).
|
||||
New binds stay `private`. Exposure grants for already-public surfaces
|
||||
are `REEF-RAILIANCE-WP-0004`, not this file.
|
||||
|
|
@ -133,7 +133,7 @@ single-node production availability risk for Qonto. The current binding
|
|||
remains accurately `verified`, not `production-approved`.
|
||||
|
||||
2026-08-08 alignment: live inspection still reports one Ready node, which also
|
||||
owns the control-plane and etcd roles. `railiance-cluster/RAIL-BS-WP-0007` now
|
||||
owns the control-plane and etcd roles. `railiance-cluster/RCLUSTER-WP-0007` now
|
||||
owns the required three-server embedded-etcd topology, source-backed
|
||||
node-to-reef failure-domain map, and machine-readable one-server-loss S2
|
||||
drill. `state-hub/CUST-WP-0038` is a downstream stateful consumer and does not
|
||||
|
|
@ -144,6 +144,12 @@ dependency behavior, and restoration on the surviving cluster. The alternate
|
|||
closure remains explicit founder acceptance of the single-node production
|
||||
availability risk.
|
||||
|
||||
2026-08-21 evidence refresh: the read-only reef collector still observes one
|
||||
Ready Kubernetes node carrying both control-plane and etcd roles. All five
|
||||
Knative control-plane deployments and `rapp-qonto-00008` are Ready, and Kourier
|
||||
remains ClusterIP-only. `RCLUSTER-WP-0007` is still backlog, so this is fresh
|
||||
evidence for retaining the block, not grounds for production promotion.
|
||||
|
||||
This repo only updates `bindings/rapps.yaml` when those conditions hold.
|
||||
Do not implement the three-node topology here. Do not add an exposure
|
||||
grant for Qonto as a side effect of `production-approved`.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,90 @@
|
|||
---
|
||||
id: REEF-RAILIANCE-WP-0005
|
||||
type: workplan
|
||||
title: "Reconcile reef bindings and refresh rail evidence"
|
||||
domain: financials
|
||||
repo: reef-railiance
|
||||
status: finished
|
||||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-08-21"
|
||||
updated: "2026-08-21"
|
||||
quality_dod: DoD-Ok
|
||||
quality_dod_at: "2026-08-21"
|
||||
quality_dod_by: codex
|
||||
quality_dod_note: "Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit."
|
||||
related:
|
||||
- REEF-RAILIANCE-WP-0002
|
||||
- REEF-RAILIANCE-WP-0003
|
||||
- ADR-0006
|
||||
- ADR-0007
|
||||
state_hub_workstream_id: "99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9"
|
||||
---
|
||||
|
||||
# REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation
|
||||
|
||||
## Goal
|
||||
|
||||
Remove drift between the reef-local binding surfaces, family declarations,
|
||||
and current secret-free runtime evidence without promoting any workload beyond
|
||||
its proven reef admission state.
|
||||
|
||||
## T01 — Refresh hosted-rail evidence
|
||||
|
||||
```task
|
||||
id: REEF-RAILIANCE-WP-0005-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c"
|
||||
```
|
||||
|
||||
Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative
|
||||
runtime evidence, and reconcile both hosted rails to `verified`.
|
||||
|
||||
Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of
|
||||
one nodes Ready, all five Knative control-plane deployments available, Kourier
|
||||
as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or
|
||||
values were read. The one-node control-plane/etcd failure-domain check remains
|
||||
failed, so neither the rail nor Qonto gained production approval.
|
||||
|
||||
## T02 — Reconcile the rApp binding projection
|
||||
|
||||
```task
|
||||
id: REEF-RAILIANCE-WP-0005-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa"
|
||||
```
|
||||
|
||||
Project every family rApp whose declaration names `reef-railiance`, while
|
||||
keeping package readiness distinct from reef binding admission. Add a check
|
||||
that fails when the local relation files diverge from sibling declarations.
|
||||
|
||||
Completed 2026-08-21. `bindings/rapps.yaml` now covers `rapp-issue-core`,
|
||||
`rapp-openbao`, `rapp-policy-nexus`, `rapp-postgres`, `rapp-qonto`, and
|
||||
`rapp-user-engine`. Only Policy Nexus is `production-approved`; Qonto remains
|
||||
`verified`, and User Engine remains `declared` at the reef binding.
|
||||
|
||||
## T03 — Close documentation and quality drift
|
||||
|
||||
```task
|
||||
id: REEF-RAILIANCE-WP-0005-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1"
|
||||
```
|
||||
|
||||
Correct the renamed ThreePhoenix dependency, state the current blocker in the
|
||||
orientation docs, and retrospectively assess the completed WP-0001 and WP-0002
|
||||
records against the current workplan Definition of Done.
|
||||
|
||||
Completed 2026-08-21. References now use `RCLUSTER-WP-0007`; the README and
|
||||
scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok.
|
||||
|
||||
## Outcome
|
||||
|
||||
The reef-local relationship files are current and mechanically checked. Rail
|
||||
evidence is fresh and secret-free. `REEF-RAILIANCE-WP-0003` remains correctly
|
||||
blocked until ThreePhoenix produces independent-failure-domain evidence and
|
||||
Qonto is reverified during loss of Railiance01, or the founder explicitly
|
||||
accepts the single-node availability risk.
|
||||
Loading…
Add table
Add a link
Reference in a new issue