From 85e35b1a7ca36d877e685a8e897dcf46f5a1915b Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 29 Jul 2026 23:13:35 +0200
Subject: [PATCH] Promote Qonto reef binding to verified

---
 WORK-RECORDS.md                                     |  2 +-
 bindings/rapps.yaml                                 |  5 +++--
 ...RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 13 +++++++++++--
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index e63dc44..e0d34be 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -23,5 +23,5 @@
 | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md |
 | task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
-| task | REEF-RAILIANCE-WP-0003-T03 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
+| task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
 | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md |
diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml
index 0c84a6c..851e001 100644
--- a/bindings/rapps.yaml
+++ b/bindings/rapps.yaml
@@ -2,9 +2,10 @@ reef_id: reef-railiance
 bound_rapps:
   - rapp_id: rapp-qonto
     rail_id: rail-knative
-    readiness_state: declared
+    readiness_state: verified
     evidence:
       - ../rapp-qonto/docs/security-and-reliability-gates.md
+      - ../rapp-qonto/evidence/live/2026-07-29-railiance01.json
 notes:
-  - The Qonto binding is topology-only until admission evidence supports promotion.
+  - The Qonto binding is verified for non-production operation; production approval remains separate.
   - Add or promote bindings only when the substrate decision is explicit and source-backed.
diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
index ddecebe..c64ab27 100644
--- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
+++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: railiance
 created: "2026-07-26"
-updated: "2026-07-27"
+updated: "2026-07-29"
 state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
 ---
 
@@ -76,7 +76,7 @@ runtime Kustomization and T02 is complete.
 
 ```task
 id: REEF-RAILIANCE-WP-0003-T03
-status: progress
+status: done
 priority: high
 state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad"
 ```
@@ -90,6 +90,15 @@ passed through the cluster-local Knative service. Full failure, revocation,
 idempotency, timing, and rollback evidence is still required before T03 can
 close.
 
+2026-07-29: The reversible `rapp-qonto/tools/verify_live.sh` gate produced
+machine-readable, secret-free evidence for scale-to-zero, 7.384443-second cold
+activation, repeat health, ExternalSecret readiness, fail-closed dependency
+loss, recovery, missing-secret denial, secret restoration, previous-revision
+rollback, and latest-traffic restoration. The `qonto-assistant` owner suite
+passes 80 tests covering domain-level audit, idempotency, authorization, and
+redaction behavior. The reef binding is now `verified`, not
+`production-approved`.
+
 ## T04 - Reassess production failure-domain risk
 
 ```task