Reconcile reef bindings and evidence

workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md

@@ -0,0 +1,90 @@
+---
+id: REEF-RAILIANCE-WP-0005
+type: workplan
+title: "Reconcile reef bindings and refresh rail evidence"
+domain: financials
+repo: reef-railiance
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-08-21"
+updated: "2026-08-21"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-21"
+quality_dod_by: codex
+quality_dod_note: "Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit."
+related:
+  - REEF-RAILIANCE-WP-0002
+  - REEF-RAILIANCE-WP-0003
+  - ADR-0006
+  - ADR-0007
+state_hub_workstream_id: "99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9"
+---
+
+# REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation
+
+## Goal
+
+Remove drift between the reef-local binding surfaces, family declarations,
+and current secret-free runtime evidence without promoting any workload beyond
+its proven reef admission state.
+
+## T01 — Refresh hosted-rail evidence
+
+```task
+id: REEF-RAILIANCE-WP-0005-T01
+status: done
+priority: high
+state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c"
+```
+
+Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative
+runtime evidence, and reconcile both hosted rails to `verified`.
+
+Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of
+one nodes Ready, all five Knative control-plane deployments available, Kourier
+as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or
+values were read. The one-node control-plane/etcd failure-domain check remains
+failed, so neither the rail nor Qonto gained production approval.
+
+## T02 — Reconcile the rApp binding projection
+
+```task
+id: REEF-RAILIANCE-WP-0005-T02
+status: done
+priority: high
+state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa"
+```
+
+Project every family rApp whose declaration names `reef-railiance`, while
+keeping package readiness distinct from reef binding admission. Add a check
+that fails when the local relation files diverge from sibling declarations.
+
+Completed 2026-08-21. `bindings/rapps.yaml` now covers `rapp-issue-core`,
+`rapp-openbao`, `rapp-policy-nexus`, `rapp-postgres`, `rapp-qonto`, and
+`rapp-user-engine`. Only Policy Nexus is `production-approved`; Qonto remains
+`verified`, and User Engine remains `declared` at the reef binding.
+
+## T03 — Close documentation and quality drift
+
+```task
+id: REEF-RAILIANCE-WP-0005-T03
+status: done
+priority: medium
+state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1"
+```
+
+Correct the renamed ThreePhoenix dependency, state the current blocker in the
+orientation docs, and retrospectively assess the completed WP-0001 and WP-0002
+records against the current workplan Definition of Done.
+
+Completed 2026-08-21. References now use `RCLUSTER-WP-0007`; the README and
+scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok.
+
+## Outcome
+
+The reef-local relationship files are current and mechanically checked. Rail
+evidence is fresh and secret-free. `REEF-RAILIANCE-WP-0003` remains correctly
+blocked until ThreePhoenix produces independent-failure-domain evidence and
+Qonto is reverified during loss of Railiance01, or the founder explicitly
+accepts the single-node availability risk.