From 3f4897519122386488d7692e4c5f7302a8ba1cff Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 02:38:10 +0200 Subject: [PATCH 01/52] Bootstrap grouped home reef repo --- .repo-classification.yaml | 20 +++ AGENTS.md | 43 ++++++ CLAUDE.md | 4 + INTENT.md | 49 +++++++ LICENSE | 21 +++ README.md | 45 ++++++- SCOPE.md | 125 ++++++++++++++++++ bindings/rails.yaml | 6 + bindings/rapps.yaml | 5 + declarations/reef.yaml | 24 ++++ docs/README.md | 5 + docs/source-backed-substrate-facts.md | 33 +++++ docs/source-import-plan.md | 40 ++++++ docs/wave-1-contract.md | 57 ++++++++ substrate/identity.yaml | 16 +++ substrate/topology.yaml | 22 +++ ...ANCE-WP-0001-bootstrap-and-wave1-import.md | 107 +++++++++++++++ 17 files changed, 621 insertions(+), 1 deletion(-) create mode 100644 .repo-classification.yaml create mode 100644 AGENTS.md create mode 100644 CLAUDE.md create mode 100644 INTENT.md create mode 100644 LICENSE create mode 100644 SCOPE.md create mode 100644 bindings/rails.yaml create mode 100644 bindings/rapps.yaml create mode 100644 declarations/reef.yaml create mode 100644 docs/README.md create mode 100644 docs/source-backed-substrate-facts.md create mode 100644 docs/source-import-plan.md create mode 100644 docs/wave-1-contract.md create mode 100644 substrate/identity.yaml create mode 100644 substrate/topology.yaml create mode 100644 workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md diff --git a/.repo-classification.yaml b/.repo-classification.yaml new file mode 100644 index 0000000..9e4a6f1 --- /dev/null +++ b/.repo-classification.yaml @@ -0,0 +1,20 @@ +repo_classification: + standard: Repo Classification Standard + version: "1.0" + classified_at: "2026-07-26" + classified_by: agent + category: project + domain: financials + secondary_domains: + - infotech + capability_tags: + - platform + - operations + - configuration + - governance + business_stake: + - technology + - operations + business_mechanics: + - coordination + - operation diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..2802c86 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,43 @@ +# reef-railiance — Agent Instructions + +## Repo Identity + +**Purpose:** Grouped Railiance home reef for substrate-boundary identity and +binding facts. + +**Domain:** financials +**Repo slug:** reef-railiance +**Topic slug:** railiance +**Workplan prefix:** `REEF-RAILIANCE-WP-` + +--- + +## Session Protocol + +**Start:** +1. Read `README.md`, `INTENT.md`, and `SCOPE.md` +2. Review active work in `workplans/` +3. Re-read the current reef declaration in `declarations/reef.yaml` + +**During work:** +- Keep the boundary with `railiance-infra` explicit +- Keep grouped reef membership and topology facts source-backed +- Prefer reef-local declarations over implicit operator memory + +**Close:** +1. Update workplan files to reflect progress +2. Register or refresh the repo from `.repo-classification.yaml` when needed +3. Run `statehub fix-consistency` + +--- + +## Boundary Reminders + +- Do not move generic S1 inventory or provisioning ownership into this repo +- Do not normalize generic rail or platform behavior here +- Do not fall back to one-repo-per-machine duplication for grouped home + substrate members + +The canonical framework boundary lives in +`railiance-master/docs/reef-first-wave-rollout.md` and +`railiance-infra/docs/reef-first-wave-source-map.md`. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..f3dce45 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,4 @@ +# reef-railiance — Claude Code Instructions + +@SCOPE.md +@AGENTS.md diff --git a/INTENT.md b/INTENT.md new file mode 100644 index 0000000..417e1d3 --- /dev/null +++ b/INTENT.md @@ -0,0 +1,49 @@ +# INTENT + +## Why This Repo Exists + +`reef-railiance` exists so Railiance has a first-class home for the grouped +home substrate boundary rather than treating each current or future Railiance +server as a separate architectural repo by default. + +Before this repo, the relevant substrate facts lived only as source-backed S1 +inventory and runbook context in `railiance-infra`. That remains the canonical +S1 authority, but it is the wrong long-term home for reef-local identity, +bindings, and substrate-specific coordination. + +This repo establishes the durable answer to: + +- what the Railiance home substrate is called +- which current servers are members of that grouped reef +- which rails are hosted there by default +- which workload bindings and substrate-local notes belong to that reef + +## What This Repo Must Protect + +This repo must keep the first-wave home reef grouped and explicit. + +That means: + +- protect the distinction between grouped substrate identity and S1 ownership +- protect the distinction between reef-local bindings and generic rail behavior +- avoid one-repo-per-machine duplication when the grouped home substrate is the + real boundary +- keep future split criteria explicit if member servers later diverge + +## What This Repo Is Not + +This repo is not: + +- the canonical S1 inventory authority +- the ownership home for Kubernetes runtime behavior +- the ownership home for OpenBao, Forgejo, or any other single workload +- proof that every Railiance server belongs in one reef forever + +## Initial Operating Context + +Wave 1 starts with `Railiance01` as the first current member of the grouped +home reef. + +Future Railiance home servers should be represented here when they share the +same lifecycle, access path, and workload-placement policy. If they stop +sharing those traits, the grouped reef may need to split later. diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..2711464 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2026 Railiance + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index cc5b0e2..0ddda00 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,46 @@ # reef-railiance -The railiance repo to represent its own home reef \ No newline at end of file +Wave-1 grouped home reef for Railiance-managed server substrates. + +## Purpose + +`reef-railiance` is the first concrete `reef-*` repo in Railiance. +It owns the grouped home-substrate boundary that should describe current and +future Railiance home servers without creating one repo per machine. + +This repo exists to hold: + +- the source-controlled reef declaration for the Railiance home substrate +- grouped substrate identity and topology facts +- rail and workload binding surfaces for this reef +- the migration path from source-backed S1 facts in `railiance-infra` + +## Boundary + +`reef-railiance` does not own: + +- generic S1 provisioning, hardening, or server inventory authority +- generic Kubernetes runtime ownership +- platform-service governance or workload packaging +- one permanent repo per host in the Railiance home substrate + +Those concerns stay with `railiance-infra`, `railiance-cluster`, +`railiance-platform`, or the relevant `rapp-*` repo. + +## Current Status + +This repo is in first-wave bootstrap. + +The boundary and source material come from: + +- `railiance-master/docs/reef-first-wave-rollout.md` +- `railiance-master/docs/reef-substrate-model.md` +- `railiance-infra/docs/reef-first-wave-source-map.md` + +## Initial Layout + +- `declarations/reef.yaml` — source-controlled reef contract +- `substrate/` — grouped substrate identity and topology facts +- `bindings/` — rail and `rapp` binding surfaces for this reef +- `docs/` — wave-1 contract and source import plan +- `workplans/` — repo-local execution work diff --git a/SCOPE.md b/SCOPE.md new file mode 100644 index 0000000..048e60d --- /dev/null +++ b/SCOPE.md @@ -0,0 +1,125 @@ +# SCOPE + +> This file helps you quickly understand what this repository is about, +> when it is relevant, and when it is not. +> It is intentionally lightweight and may be incomplete. + +--- + +## One-liner + +Grouped Railiance home reef for substrate identity, topology, and binding facts. + +--- + +## Core Idea + +`reef-railiance` is the first concrete `reef-*` repo in Railiance. +It exists to hold the grouped home-substrate boundary for current and future +Railiance servers, starting with `Railiance01`, without turning S1 inventory +or one-host naming into the reef model. + +--- + +## In Scope + +- Grouped home-reef declaration and compatibility notes +- Grouped substrate identity and topology facts +- Hosted-rail and bound-`rapp` surfaces for this reef +- Reef-local runbooks, overlays, and evidence as they appear +- Migration compatibility guidance while reef extraction from S1 source facts is + still in progress + +--- + +## Out of Scope + +- Generic server inventory authority +- OS provisioning, hardening, and bootstrap logic +- Kubernetes runtime ownership +- Platform-service governance or workload packaging +- One permanent repo per host + +--- + +## Relevant When + +- Defining the Railiance home substrate as a grouped reef +- Recording which servers belong to that grouped substrate +- Clarifying which rails or `rapp`s attach to the home reef +- Moving reef-local identity out of generic S1 ownership docs + +--- + +## Not Relevant When + +- The work is purely S1 provisioning or hardening +- The work is generic rail behavior +- The work is workload-specific packaging or platform governance + +--- + +## Current State + +- Status: active bootstrap +- Implementation: declaration, initial grouped substrate files, and first + repo-local workplan are present +- Stability: evolving +- Usage: wave-1 home reef for the Railiance server group + +--- + +## How It Fits + +- Upstream dependencies: `railiance-infra`, `railiance-master` +- Downstream consumers: `rail-kubernetes`, future `rapp-*` repos, and Fabric + relation projection +- Often used with: `railiance-cluster`, `railiance-platform`, `railiance-fabric` + +--- + +## Terminology + +- Preferred terms: reef, grouped home substrate, substrate boundary, topology +- Also known as: Railiance home reef +- Potentially confusing terms: this repo defines a grouped reef boundary; it + does not replace `railiance-infra` as the S1 source of truth + +--- + +## Related / Overlapping Repositories + +- `railiance-infra` — canonical S1 inventory and provisioning authority +- `rail-kubernetes` — execution contract expected to be primary on this reef +- `rapp-openbao` and future `rapp-*` repos — workload packages that may bind to + this reef +- `railiance-master` — framework architecture and reef naming decisions + +--- + +## Getting Oriented + +- Start with: `README.md`, `INTENT.md` +- Key files / directories: `declarations/`, `substrate/`, `bindings/`, `docs/`, + `workplans/` +- Entry points: `declarations/reef.yaml`, `substrate/identity.yaml`, + `docs/wave-1-contract.md` + +--- + +## Provided Capabilities + +```capability +type: governance +title: Grouped home reef contract +description: Defines the grouped Railiance home substrate boundary, hosted rails, and reef-local topology facts. +keywords: [railiance, reef, substrate, topology, server-group] +``` + +--- + +## Notes + +Keep this repo grouped and explicit. If a future Railiance server no longer +shares the same substrate boundary, split the reef rather than forcing +permanent ambiguity. diff --git a/bindings/rails.yaml b/bindings/rails.yaml new file mode 100644 index 0000000..f140d06 --- /dev/null +++ b/bindings/rails.yaml @@ -0,0 +1,6 @@ +reef_id: reef-railiance +hosted_rails: + - rail_id: rail-kubernetes + role: primary + status: active + notes: First-wave default execution rail for the grouped Railiance home reef. diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml new file mode 100644 index 0000000..d8df8c4 --- /dev/null +++ b/bindings/rapps.yaml @@ -0,0 +1,5 @@ +reef_id: reef-railiance +bound_rapps: [] +notes: + - No grouped home-reef workload bindings are declared yet. + - Add `rapp` bindings here only when the substrate decision is explicit and source-backed. diff --git a/declarations/reef.yaml b/declarations/reef.yaml new file mode 100644 index 0000000..7f92ead --- /dev/null +++ b/declarations/reef.yaml @@ -0,0 +1,24 @@ +kind: substrate-reef +reef_id: reef-railiance +repo: reef-railiance +ownership_repo: railiance-infra +substrate_kind: server-group +lifecycle_state: active +criticality: high +primary_rail: rail-kubernetes +hosted_rails: + - rail-kubernetes +bound_rapps: [] +current_members: + - Railiance01 +source_documents: + - repo: railiance-master + path: docs/reef-first-wave-rollout.md + - repo: railiance-master + path: docs/reef-substrate-model.md + - repo: railiance-infra + path: docs/reef-first-wave-source-map.md +compatibility_notes: + - Railiance01 is the first current member of the grouped home reef. + - Additional Railiance home servers should join this reef when they share the same substrate boundary. + - Split the grouped reef later if member lifecycle, access, or workload-placement policy diverges. diff --git a/docs/README.md b/docs/README.md new file mode 100644 index 0000000..7b5eb75 --- /dev/null +++ b/docs/README.md @@ -0,0 +1,5 @@ +# reef-railiance Docs + +- `wave-1-contract.md` — current grouped home-reef contract and boundary summary +- `source-backed-substrate-facts.md` — source-backed first-wave facts imported from S1 +- `source-import-plan.md` — source material and migration direction from existing repos diff --git a/docs/source-backed-substrate-facts.md b/docs/source-backed-substrate-facts.md new file mode 100644 index 0000000..09604db --- /dev/null +++ b/docs/source-backed-substrate-facts.md @@ -0,0 +1,33 @@ +# Source-Backed Substrate Facts + +## Purpose + +Record the first source-backed facts imported into `reef-railiance` for the +grouped home reef bootstrap. + +## Imported Facts + +From `railiance-infra/inventory/servers.yaml`: + +- current first member: `Railiance01` +- member IP: `92.205.62.239` +- member SSH user: `tegwick` + +From `railiance-infra/docs/reef-first-wave-source-map.md`: + +- this repo represents the grouped Railiance home reef rather than a singleton + host repo +- `rail-kubernetes` is the first primary rail stance +- additional Railiance home servers should join this reef when they share the + same lifecycle and workload-placement boundary + +From `railiance-infra/docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`: + +- Forgejo production and the in-cluster Actions runner already use + `railiance01` as a Kubernetes-first operational substrate + +## Explicit Gaps + +- only one source-backed member is declared today +- there is still no dedicated `host_vars/Railiance01.yml` +- future grouped members and split criteria remain explicit follow-up work diff --git a/docs/source-import-plan.md b/docs/source-import-plan.md new file mode 100644 index 0000000..2105efe --- /dev/null +++ b/docs/source-import-plan.md @@ -0,0 +1,40 @@ +# Source Import Plan + +## Purpose + +Record which reviewed source materials are expected to seed this repo. + +## Imported In The Current Wave + +Imported source documents from `railiance-master`: + +- `docs/reef-first-wave-rollout.md` +- `docs/reef-substrate-model.md` +- `docs/repo-family-bootstrap-contract.md` + +Imported source documents from `railiance-infra`: + +- `docs/reef-first-wave-source-map.md` +- `inventory/servers.yaml` +- `docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md` + +## Pending First-Wave Imports + +Expected future source surfaces from `railiance-infra`: + +- reef-localized runbooks once they stop being generic S1 ownership material +- any additional source-backed member facts for future Railiance home servers +- explicit grouped `rapp` binding decisions when they become substrate-local + +## Deferred Migration Debt + +Do not import these into `reef-railiance` as part of wave 1: + +- generic S1 provisioning or inventory ownership +- generic Kubernetes runtime behavior +- workload packaging or platform governance + +## Rule + +Imports into this repo should preserve the grouped home-reef boundary already +reviewed in `railiance-master` and `railiance-infra`. diff --git a/docs/wave-1-contract.md b/docs/wave-1-contract.md new file mode 100644 index 0000000..f0085ce --- /dev/null +++ b/docs/wave-1-contract.md @@ -0,0 +1,57 @@ +# Wave-1 Railiance Home Reef Contract + +## Purpose + +Summarize the initial grouped home-reef contract `reef-railiance` owns in wave +1. + +This repo starts from already-reviewed source documents rather than inventing a +new substrate model: + +- `railiance-master/docs/reef-first-wave-rollout.md` +- `railiance-master/docs/reef-substrate-model.md` +- `railiance-infra/docs/reef-first-wave-source-map.md` + +## What `reef-railiance` Owns + +Wave 1 assigns these concerns to the reef: + +- the grouped Railiance home-substrate identity +- current member and topology facts for that grouped reef +- the default hosted-rail statement for the home substrate +- future grouped `rapp` bindings for that substrate +- reef-local runbooks, overlays, and evidence when they become substrate-owned + +## What Stays In `railiance-infra` + +Wave 1 keeps these concerns in the canonical S1 ownership repo: + +- server inventory authority +- OS provisioning and hardening logic +- SSH key and convergence mechanics +- source-backed server facts that are not yet reef-localized +- future split criteria that still depend on broader S1 review + +## Published Substrate Assumptions + +Wave 1 `reef-railiance` may assume: + +- `Railiance01` is the first current member +- `rail-kubernetes` is the first primary rail stance +- additional Railiance home servers may join when they share the same grouped + substrate boundary + +Wave 1 `reef-railiance` must not assume: + +- that every future Railiance server belongs here automatically +- that platform or workload ownership moves into this repo +- that grouped membership is permanent if lifecycle or security boundaries split + +## Migration Constraint + +Until the extraction is complete, `railiance-infra` remains the canonical S1 +source of truth. + +`reef-railiance` should become the durable grouped substrate home first. Only +then should additional bindings, runbooks, and substrate-local overlays move +here in a migration-safe sequence. diff --git a/substrate/identity.yaml b/substrate/identity.yaml new file mode 100644 index 0000000..1e6b5ec --- /dev/null +++ b/substrate/identity.yaml @@ -0,0 +1,16 @@ +reef_id: reef-railiance +display_name: Railiance Home Reef +substrate_kind: server-group +ownership_repo: railiance-infra +lifecycle_state: active +criticality: high +primary_rail: rail-kubernetes +current_members: + - Railiance01 +current_role: Grouped home substrate for Kubernetes-first Railiance workloads. +source_of_truth: + repo: railiance-infra + paths: + - inventory/servers.yaml + - docs/reef-first-wave-source-map.md + - docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md diff --git a/substrate/topology.yaml b/substrate/topology.yaml new file mode 100644 index 0000000..eae43cc --- /dev/null +++ b/substrate/topology.yaml @@ -0,0 +1,22 @@ +reef_id: reef-railiance +membership_policy: Add Railiance home servers here when they share one durable home-substrate boundary. +members: + - member_id: Railiance01 + role: first-current-member + provider: HostEurope + ip: 92.205.62.239 + ssh_user: tegwick + evidence: + - repo: railiance-infra + path: inventory/servers.yaml + - repo: railiance-infra + path: docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md +access_surfaces: + - type: ssh + member: Railiance01 + user: tegwick + - type: kubernetes-runtime + rail: rail-kubernetes +unresolved_questions: + - Which future Railiance servers should join this grouped home reef first? + - At what point would member divergence justify splitting this reef? diff --git a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md new file mode 100644 index 0000000..9f5e205 --- /dev/null +++ b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md @@ -0,0 +1,107 @@ +--- +id: REEF-RAILIANCE-WP-0001 +type: workplan +title: "Bootstrap reef-railiance and import the wave-1 grouped substrate surface" +domain: financials +repo: reef-railiance +status: active +owner: codex +topic_slug: railiance +created: "2026-07-26" +updated: "2026-07-26" +--- + +# REEF-RAILIANCE-WP-0001 - Bootstrap reef-railiance and import the wave-1 grouped substrate surface + +## Goal + +Turn `reef-railiance` into the concrete home of the first grouped Railiance +home reef. + +## Boundaries + +This workplan may bootstrap the repo, publish the initial reef declaration, +and import the first source-backed grouped substrate facts from +`railiance-infra`. + +It must not: + +- absorb generic S1 provisioning or inventory ownership from `railiance-infra` +- pretend one repo per server is the default reef model +- normalize generic rail or platform behavior into this repo + +## T01 - Establish the repo baseline and reef declaration + +```task +id: REEF-RAILIANCE-WP-0001-T01 +status: done +priority: high +``` + +Create the baseline repo files, the initial reef declaration, and the first +wave-1 contract summary. + +Acceptance: + +- baseline repo files exist +- `declarations/reef.yaml` exists +- the repo states its boundary with `railiance-infra` + +2026-07-26: Created the initial repo baseline, grouped reef declaration, and +wave-1 contract summary. + +## T02 - Import the first source-backed grouped substrate facts + +```task +id: REEF-RAILIANCE-WP-0001-T02 +status: done +priority: high +``` + +Bring the reviewed first grouped-substrate fact set into this repo in a +migration-safe sequence. + +Acceptance: + +- the import sequence is anchored in the reviewed S1 source map +- imported material stays reef-local rather than generic S1 ownership +- the repo becomes a real grouped home reef rather than only a shell + +2026-07-26: Imported the first grouped substrate facts from `railiance-infra`, +including the current member identity from `inventory/servers.yaml`, the +grouped home-reef rollout stance from `docs/reef-first-wave-source-map.md`, +and the operational substrate evidence from ADR-004. + +## T03 - Prepare the retained S1 handoff from `railiance-infra` + +```task +id: REEF-RAILIANCE-WP-0001-T03 +status: wait +priority: medium +``` + +Define the thin compatibility path that keeps current operators functional +while reef-localization proceeds. + +Acceptance: + +- the retained S1 surface is explicit +- current operators do not need a flag day +- the retained S1 surface stays narrow and temporary + +## T04 - Register `reef-railiance` in State Hub and Fabric + +```task +id: REEF-RAILIANCE-WP-0001-T04 +status: wait +priority: medium +``` + +Register the repo from classification and add it to the Fabric repository +registry with `reef`-family metadata. + +Acceptance: + +- State Hub recognizes the repo and its workplan +- Fabric recognizes the repo as `repo_family: reef` +- ownership, primary-rail, and substrate-kind metadata are visible From 660563c5b6678ab82c757b6a60422f340eb92549 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 02:41:28 +0200 Subject: [PATCH 02/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .custodian-brief.md diff --git a/.custodian-brief.md b/.custodian-brief.md new file mode 100644 index 0000000..e5eb88a --- /dev/null +++ b/.custodian-brief.md @@ -0,0 +1,23 @@ + +# Custodian Brief — reef-railiance + +**Domain:** financials +**Last synced:** 2026-07-26 00:41 UTC +**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* + +## Active Workstreams + +### Bootstrap reef-railiance and import the wave-1 grouped substrate surface +Progress: 2/4 done | workplan_id: `da64c718-68bf-4719-aa42-fcf26687ab23` + +**Open tasks:** +- ! T03 - Prepare the retained S1 handoff from `railiance-infra` `c6365200` +- ! T04 - Register `reef-railiance` in State Hub and Fabric `21b7e7e9` + +--- +## MCP Orientation (when available) + +If the state-hub MCP server is reachable, call: +`get_domain_summary("financials")` +This provides richer cross-domain context. +If the MCP call fails, use this file as your orientation source. From 3b10f50459aea17e9631c5f491c5d3b45cc6f481 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 08:49:44 +0200 Subject: [PATCH 03/52] Close reef-railiance registration task --- WORK-RECORDS.md | 15 +++++++++++++++ ...IANCE-WP-0001-bootstrap-and-wave1-import.md | 18 +++++++++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 WORK-RECORDS.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md new file mode 100644 index 0000000..6d31148 --- /dev/null +++ b/WORK-RECORDS.md @@ -0,0 +1,15 @@ +# Work Records — reef-railiance + +> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record +> stage 3). Do not edit by hand — edit the source file/block listed for +> each record and re-run fix-consistency to refresh this index. Archived +> workplans are omitted; closed decisions/intakes/engagements stay listed +> so recently-resolved work is still visible. [auto] + +| Kind | ID | Status | Lane | Source | +| --- | --- | --- | --- | --- | +| workplan | REEF-RAILIANCE-WP-0001 | active | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | diff --git a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md index 9f5e205..03be2d8 100644 --- a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md +++ b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md @@ -9,6 +9,7 @@ owner: codex topic_slug: railiance created: "2026-07-26" updated: "2026-07-26" +state_hub_workstream_id: "da64c718-68bf-4719-aa42-fcf26687ab23" --- # REEF-RAILIANCE-WP-0001 - Bootstrap reef-railiance and import the wave-1 grouped substrate surface @@ -36,6 +37,7 @@ It must not: id: REEF-RAILIANCE-WP-0001-T01 status: done priority: high +state_hub_task_id: "c7f85080-527c-48ec-bffc-0bb045b08a62" ``` Create the baseline repo files, the initial reef declaration, and the first @@ -56,6 +58,7 @@ wave-1 contract summary. id: REEF-RAILIANCE-WP-0001-T02 status: done priority: high +state_hub_task_id: "acb010ad-a430-414c-8f63-06b13cdc00f7" ``` Bring the reviewed first grouped-substrate fact set into this repo in a @@ -78,6 +81,7 @@ and the operational substrate evidence from ADR-004. id: REEF-RAILIANCE-WP-0001-T03 status: wait priority: medium +state_hub_task_id: "c6365200-9e2b-4299-9464-0620d94aad2a" ``` Define the thin compatibility path that keeps current operators functional @@ -93,8 +97,9 @@ Acceptance: ```task id: REEF-RAILIANCE-WP-0001-T04 -status: wait +status: done priority: medium +state_hub_task_id: "21b7e7e9-1cb5-412b-88f1-f8e1a4689576" ``` Register the repo from classification and add it to the Fabric repository @@ -105,3 +110,14 @@ Acceptance: - State Hub recognizes the repo and its workplan - Fabric recognizes the repo as `repo_family: reef` - ownership, primary-rail, and substrate-kind metadata are visible + +2026-07-26: Registered `reef-railiance` in State Hub from +`.repo-classification.yaml`, generated `.custodian-brief.md` and +`WORK-RECORDS.md`, reconciled the local grouped-reef bootstrap with the +existing remote `main`, and pushed the clean history to +`forgejo-remote:coulomb/reef-railiance.git`. Added the repo to +`railiance-fabric/registry/railiance-repos.yaml` and ran a targeted live +registry sync against `http://127.0.0.1:8765`. Fabric now stores +`reef-railiance` as a registered repo with `repo_family: reef`, +`ownership_repo: railiance-infra`, `primary_rail: rail-kubernetes`, +`substrate_kind: server-group`, and snapshot `id: 97`. From 114f49bec26116f3efd41ca4502de85813f98589 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 08:50:13 +0200 Subject: [PATCH 04/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index e5eb88a..0f3f57d 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,16 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 00:41 UTC +**Last synced:** 2026-07-26 06:50 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Bootstrap reef-railiance and import the wave-1 grouped substrate surface -Progress: 2/4 done | workplan_id: `da64c718-68bf-4719-aa42-fcf26687ab23` +Progress: 3/4 done | workplan_id: `da64c718-68bf-4719-aa42-fcf26687ab23` **Open tasks:** - ! T03 - Prepare the retained S1 handoff from `railiance-infra` `c6365200` -- ! T04 - Register `reef-railiance` in State Hub and Fabric `21b7e7e9` --- ## MCP Orientation (when available) From e2c3796de2529c64e5363a42ce53eabba769f852 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 09:00:52 +0200 Subject: [PATCH 05/52] Sync reef-railiance work records --- WORK-RECORDS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 6d31148..50aefcf 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,4 +12,4 @@ | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | -| task | REEF-RAILIANCE-WP-0001-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | From e6bede57988550e202a8235596c25f8478968e90 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 10:38:21 +0200 Subject: [PATCH 06/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 0f3f57d..7e49a5d 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,16 +2,12 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 06:50 UTC +**Last synced:** 2026-07-26 08:38 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Bootstrap reef-railiance and import the wave-1 grouped substrate surface -Progress: 3/4 done | workplan_id: `da64c718-68bf-4719-aa42-fcf26687ab23` - -**Open tasks:** -- ! T03 - Prepare the retained S1 handoff from `railiance-infra` `c6365200` +*(none — repo may need first-session setup)* --- ## MCP Orientation (when available) From 784a88e4e9c5d64e269e1ad575666a8767d7a567 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 10:39:39 +0200 Subject: [PATCH 07/52] Finish reef-railiance first-wave handoff --- README.md | 6 +- SCOPE.md | 8 +-- WORK-RECORDS.md | 4 +- docs/README.md | 1 + docs/retained-s1-handoff.md | 58 +++++++++++++++++++ docs/source-import-plan.md | 13 +++++ docs/wave-1-contract.md | 3 + ...ANCE-WP-0001-bootstrap-and-wave1-import.md | 12 +++- 8 files changed, 96 insertions(+), 9 deletions(-) create mode 100644 docs/retained-s1-handoff.md diff --git a/README.md b/README.md index 0ddda00..9a4d462 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,10 @@ Those concerns stay with `railiance-infra`, `railiance-cluster`, ## Current Status -This repo is in first-wave bootstrap. +This repo now owns the wave-1 grouped home-reef boundary for Railiance. + +The retained S1 compatibility path while reef localization is still in flight +is documented in `docs/retained-s1-handoff.md`. The boundary and source material come from: @@ -43,4 +46,5 @@ The boundary and source material come from: - `substrate/` — grouped substrate identity and topology facts - `bindings/` — rail and `rapp` binding surfaces for this reef - `docs/` — wave-1 contract and source import plan +- `docs/retained-s1-handoff.md` — migration-window split with `railiance-infra` - `workplans/` — repo-local execution work diff --git a/SCOPE.md b/SCOPE.md index 048e60d..296a029 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -61,10 +61,10 @@ or one-host naming into the reef model. ## Current State -- Status: active bootstrap -- Implementation: declaration, initial grouped substrate files, and first - repo-local workplan are present -- Stability: evolving +- Status: bootstrapped first-wave grouped reef home +- Implementation: declaration, grouped substrate files, and retained-S1 + compatibility handoff are present +- Stability: evolving, with the migration-window split now explicit - Usage: wave-1 home reef for the Railiance server group --- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 50aefcf..e8bb933 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,8 +8,8 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | REEF-RAILIANCE-WP-0001 | active | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | -| task | REEF-RAILIANCE-WP-0001-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | diff --git a/docs/README.md b/docs/README.md index 7b5eb75..8e5a76d 100644 --- a/docs/README.md +++ b/docs/README.md @@ -3,3 +3,4 @@ - `wave-1-contract.md` — current grouped home-reef contract and boundary summary - `source-backed-substrate-facts.md` — source-backed first-wave facts imported from S1 - `source-import-plan.md` — source material and migration direction from existing repos +- `retained-s1-handoff.md` — migration-window split between grouped reef ownership and retained S1 authority diff --git a/docs/retained-s1-handoff.md b/docs/retained-s1-handoff.md new file mode 100644 index 0000000..c503ee2 --- /dev/null +++ b/docs/retained-s1-handoff.md @@ -0,0 +1,58 @@ +# Retained S1 Handoff + +## Purpose + +Define the migration-window handoff between `reef-railiance` and +`railiance-infra` while grouped reef localization is still in flight. + +Wave 1 makes `reef-railiance` the durable owner of the grouped Railiance +home-reef identity, topology, hosted-rail statement, and future `rapp` +bindings. `railiance-infra` remains the canonical S1 owner of raw inventory, +provisioning, hardening, and source-backed host facts that have not yet been +localized into the reef repo. + +## Canonical Reef Surface + +Use `reef-railiance` as the canonical home for: + +- `declarations/reef.yaml` +- `substrate/identity.yaml` +- `substrate/topology.yaml` +- `bindings/rails.yaml` +- `bindings/rapps.yaml` +- repo-local grouped-boundary docs, questions, and future reef-local runbooks + +New grouped-reef behavior, membership interpretation, hosted-rail stance, and +future `rapp` binding decisions should land here first. + +## Retained S1 Surface + +Still owned by `railiance-infra`: + +- `inventory/servers.yaml` as the raw server identity source +- Terraform/cloud-init/Ansible provisioning and convergence logic +- generic OS hardening and substrate verification +- canonical S1 docs such as `docs/reef-first-wave-source-map.md` +- source-backed host facts that are still broader than the grouped home-reef + boundary + +## Current Compatibility Path + +Current operators do not need a flag day: + +1. Continue using `railiance-infra` for server provisioning, inventory edits, + SSH/bootstrap mechanics, and raw host-fact maintenance. +2. Use `reef-railiance` for grouped home-reef identity, topology, hosted-rail + stance, and reef-local `rapp` binding decisions. +3. When a raw server fact changes, update `railiance-infra` first, then refresh + the reef-local projection only where that fact affects the grouped reef + boundary. +4. Keep unresolved grouped-membership or split criteria explicit in this repo + rather than forcing one permanent repo per server. + +## Exit Condition + +The migration window can end once the reef-specific interpretation no longer +depends on broader S1 docs for routine operator understanding, and the +remaining source-backed member facts needed by the grouped reef have been +localized cleanly. diff --git a/docs/source-import-plan.md b/docs/source-import-plan.md index 2105efe..f708aa2 100644 --- a/docs/source-import-plan.md +++ b/docs/source-import-plan.md @@ -34,6 +34,19 @@ Do not import these into `reef-railiance` as part of wave 1: - generic Kubernetes runtime behavior - workload packaging or platform governance +## Current Migration-Window Compatibility + +During wave 1: + +- `reef-railiance` is the canonical home for grouped home-reef identity, + topology, hosted-rail stance, and future `rapp` bindings +- `railiance-infra` remains the canonical owner of raw inventory, provisioning, + and broader S1 source-backed host facts +- raw host-fact changes should be made in `railiance-infra` first and then + projected here when they affect the grouped reef boundary + +See `docs/retained-s1-handoff.md` for the active handoff contract. + ## Rule Imports into this repo should preserve the grouped home-reef boundary already diff --git a/docs/wave-1-contract.md b/docs/wave-1-contract.md index f0085ce..9dcc74d 100644 --- a/docs/wave-1-contract.md +++ b/docs/wave-1-contract.md @@ -52,6 +52,9 @@ Wave 1 `reef-railiance` must not assume: Until the extraction is complete, `railiance-infra` remains the canonical S1 source of truth. +The active migration-window compatibility rules live in +`docs/retained-s1-handoff.md`. + `reef-railiance` should become the durable grouped substrate home first. Only then should additional bindings, runbooks, and substrate-local overlays move here in a migration-safe sequence. diff --git a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md index 03be2d8..eb0146a 100644 --- a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md +++ b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md @@ -4,7 +4,7 @@ type: workplan title: "Bootstrap reef-railiance and import the wave-1 grouped substrate surface" domain: financials repo: reef-railiance -status: active +status: finished owner: codex topic_slug: railiance created: "2026-07-26" @@ -79,7 +79,7 @@ and the operational substrate evidence from ADR-004. ```task id: REEF-RAILIANCE-WP-0001-T03 -status: wait +status: done priority: medium state_hub_task_id: "c6365200-9e2b-4299-9464-0620d94aad2a" ``` @@ -93,6 +93,14 @@ Acceptance: - current operators do not need a flag day - the retained S1 surface stays narrow and temporary +2026-07-26: Added `docs/retained-s1-handoff.md` to define the migration-window +split with `railiance-infra`. `reef-railiance` is now the canonical home for +the grouped home-reef identity, topology, hosted-rail stance, and future +`rapp` bindings, while `railiance-infra` retains raw inventory, provisioning, +and broader S1 source-backed host facts. `README.md`, `docs/README.md`, +`docs/wave-1-contract.md`, `docs/source-import-plan.md`, and `SCOPE.md` now +point operators at the explicit no-flag-day handoff. + ## T04 - Register `reef-railiance` in State Hub and Fabric ```task From 9c2cb89938bc77cf88f1298e29133a0d1dea70f4 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 13:08:45 +0200 Subject: [PATCH 08/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 7e49a5d..8eb6667 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,12 +2,20 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 08:38 UTC +**Last synced:** 2026-07-26 11:08 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -*(none — repo may need first-session setup)* +### Admit rail-knative and rapp-qonto with production evidence +Progress: 1/6 done | workplan_id: `5b31c13e-ddc9-495f-8325-88fa770982c5` + +**Open tasks:** +- ! T05 - Decide production residual risk `f1ac627d` +- ► T02 - Collect the Knative substrate baseline `833f6246` +- · T03 - Install and verify the derived rail `ff070df6` +- · T04 - Bind and verify rapp-qonto `485e757b` +- · T06 - Automate evidence freshness and drift `82685f27` --- ## MCP Orientation (when available) From 9ffeac2e92dc7207bb258b612c47adf121d3f1eb Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 13:34:56 +0200 Subject: [PATCH 09/52] Add Knative and Qonto admission evidence --- WORK-RECORDS.md | 7 ++ bindings/rails.yaml | 13 ++- bindings/rapps.yaml | 11 +- declarations/reef.yaml | 4 +- evidence/admission/rail-knative-baseline.json | 39 +++++++ .../admission/rail-kubernetes-baseline.json | 39 +++++++ schemas/admission-evidence-v1.schema.json | 59 ++++++++++ ...-knative-and-qonto-production-admission.md | 103 ++++++++++++++++++ 8 files changed, 270 insertions(+), 5 deletions(-) create mode 100644 evidence/admission/rail-knative-baseline.json create mode 100644 evidence/admission/rail-kubernetes-baseline.json create mode 100644 schemas/admission-evidence-v1.schema.json create mode 100644 workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e8bb933..71bf7e6 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -9,7 +9,14 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| workplan | REEF-RAILIANCE-WP-0002 | active | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | +| task | REEF-RAILIANCE-WP-0002-T01 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T03 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T04 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T05 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T06 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | diff --git a/bindings/rails.yaml b/bindings/rails.yaml index f140d06..f158337 100644 --- a/bindings/rails.yaml +++ b/bindings/rails.yaml @@ -2,5 +2,16 @@ reef_id: reef-railiance hosted_rails: - rail_id: rail-kubernetes role: primary - status: active + readiness_state: declared + contract_version: 1.0.0 + evidence: + - evidence/admission/rail-kubernetes-baseline.json notes: First-wave default execution rail for the grouped Railiance home reef. + - rail_id: rail-knative + role: derived + readiness_state: declared + contract_version: 1.0.0 + base_rail: rail-kubernetes + evidence: + - evidence/admission/rail-knative-baseline.json + notes: Declared second-wave rail; not installed or production-approved. diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml index d8df8c4..0c84a6c 100644 --- a/bindings/rapps.yaml +++ b/bindings/rapps.yaml @@ -1,5 +1,10 @@ reef_id: reef-railiance -bound_rapps: [] +bound_rapps: + - rapp_id: rapp-qonto + rail_id: rail-knative + readiness_state: declared + evidence: + - ../rapp-qonto/docs/security-and-reliability-gates.md notes: - - No grouped home-reef workload bindings are declared yet. - - Add `rapp` bindings here only when the substrate decision is explicit and source-backed. + - The Qonto binding is topology-only until admission evidence supports promotion. + - Add or promote bindings only when the substrate decision is explicit and source-backed. diff --git a/declarations/reef.yaml b/declarations/reef.yaml index 7f92ead..2df7741 100644 --- a/declarations/reef.yaml +++ b/declarations/reef.yaml @@ -8,7 +8,9 @@ criticality: high primary_rail: rail-kubernetes hosted_rails: - rail-kubernetes -bound_rapps: [] + - rail-knative +bound_rapps: + - rapp-qonto current_members: - Railiance01 source_documents: diff --git a/evidence/admission/rail-knative-baseline.json b/evidence/admission/rail-knative-baseline.json new file mode 100644 index 0000000..856d6ca --- /dev/null +++ b/evidence/admission/rail-knative-baseline.json @@ -0,0 +1,39 @@ +{ + "contract_version": "1.0.0", + "reef_id": "reef-railiance", + "subject": "rail-knative", + "readiness_state": "declared", + "checked_at": "2026-07-26T00:00:00Z", + "checks": { + "compatibility": { + "status": "pass", + "evidence": [ + "../rail-knative/declarations/rail.yaml", + "../rail-kubernetes/declarations/rail.yaml" + ], + "notes": "Declaration compatibility passes; runtime versions are not yet observed." + }, + "capacity": { + "status": "unknown", + "evidence": [], + "notes": "CPU, memory, pod, and control-plane headroom must be measured." + }, + "ingress": {"status": "unknown", "evidence": []}, + "network": {"status": "unknown", "evidence": []}, + "identity_and_secrets": {"status": "unknown", "evidence": []}, + "observability": {"status": "unknown", "evidence": []}, + "recovery": {"status": "unknown", "evidence": []}, + "failure_domain": { + "status": "unknown", + "evidence": [], + "notes": "Knative would share the current single-member Kubernetes reef." + } + }, + "residual_risks": [ + { + "risk": "Single server and shared control plane for a critical bank-connected workload", + "status": "open", + "owner": "railiance-infra" + } + ] +} diff --git a/evidence/admission/rail-kubernetes-baseline.json b/evidence/admission/rail-kubernetes-baseline.json new file mode 100644 index 0000000..d5c3bad --- /dev/null +++ b/evidence/admission/rail-kubernetes-baseline.json @@ -0,0 +1,39 @@ +{ + "contract_version": "1.0.0", + "reef_id": "reef-railiance", + "subject": "rail-kubernetes", + "readiness_state": "declared", + "checked_at": "2026-07-26T00:00:00Z", + "checks": { + "compatibility": { + "status": "pass", + "evidence": [ + "declarations/reef.yaml", + "bindings/rails.yaml", + "../rail-kubernetes/declarations/rail.yaml" + ] + }, + "capacity": { + "status": "unknown", + "evidence": [], + "notes": "Automated capacity and headroom probe not yet recorded." + }, + "ingress": {"status": "unknown", "evidence": []}, + "network": {"status": "unknown", "evidence": []}, + "identity_and_secrets": {"status": "unknown", "evidence": []}, + "observability": {"status": "unknown", "evidence": []}, + "recovery": {"status": "unknown", "evidence": []}, + "failure_domain": { + "status": "unknown", + "evidence": [], + "notes": "Current grouped reef has one declared member." + } + }, + "residual_risks": [ + { + "risk": "Single declared server and shared Kubernetes control plane", + "status": "open", + "owner": "railiance-infra" + } + ] +} diff --git a/schemas/admission-evidence-v1.schema.json b/schemas/admission-evidence-v1.schema.json new file mode 100644 index 0000000..65eeb30 --- /dev/null +++ b/schemas/admission-evidence-v1.schema.json @@ -0,0 +1,59 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://railiance.dev/schemas/reef-admission-evidence-v1.schema.json", + "type": "object", + "additionalProperties": false, + "required": [ + "contract_version", + "reef_id", + "subject", + "readiness_state", + "checked_at", + "checks", + "residual_risks" + ], + "properties": { + "contract_version": {"const": "1.0.0"}, + "reef_id": {"const": "reef-railiance"}, + "subject": {"type": "string", "pattern": "^(rail|rapp)-[a-z0-9-]+$"}, + "readiness_state": { + "enum": ["declared", "installed", "verified", "production-approved", "deprecated"] + }, + "checked_at": {"type": "string", "format": "date-time"}, + "checks": { + "type": "object", + "additionalProperties": { + "type": "object", + "required": ["status", "evidence"], + "properties": { + "status": {"enum": ["pass", "fail", "unknown", "not-applicable"]}, + "evidence": {"type": "array", "items": {"type": "string"}}, + "notes": {"type": "string"} + } + }, + "required": [ + "compatibility", + "capacity", + "ingress", + "network", + "identity_and_secrets", + "observability", + "recovery", + "failure_domain" + ] + }, + "residual_risks": { + "type": "array", + "items": { + "type": "object", + "required": ["risk", "status", "owner"], + "properties": { + "risk": {"type": "string"}, + "status": {"enum": ["open", "mitigated", "accepted"]}, + "owner": {"type": "string"}, + "decision": {"type": "string"} + } + } + } + } +} diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md new file mode 100644 index 0000000..874b8ce --- /dev/null +++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md @@ -0,0 +1,103 @@ +--- +id: REEF-RAILIANCE-WP-0002 +type: workplan +title: "Admit rail-knative and rapp-qonto with production evidence" +domain: financials +repo: reef-railiance +status: active +owner: codex +topic_slug: railiance +created: "2026-07-26" +updated: "2026-07-26" +state_hub_workstream_id: "5b31c13e-ddc9-495f-8325-88fa770982c5" +--- + +# REEF-RAILIANCE-WP-0002 - Knative and Qonto production admission + +## Goal + +Host a derived `rail-knative` slice while keeping `rail-kubernetes` primary, +and bind `rapp-qonto` only through explicit readiness evidence. + +## T01 - Publish the admission schema and baseline + +```task +id: REEF-RAILIANCE-WP-0002-T01 +status: done +priority: high +state_hub_task_id: "a20cc59f-bb93-4d1b-bf46-0d67c2270b98" +``` + +Add declared, installed, verified, production-approved, and deprecated states +plus source-linked evidence requirements. + +2026-07-26: Added the admission schema and a baseline record for the existing +Kubernetes rail. The baseline intentionally records unresolved capacity, +recovery, and failure-domain evidence rather than inferring it from topology. + +## T02 - Collect the Knative substrate baseline + +```task +id: REEF-RAILIANCE-WP-0002-T02 +status: progress +priority: high +state_hub_task_id: "833f6246-23bc-43ac-802d-7595b18f77a2" +``` + +Collect Kubernetes version, capacity/headroom, ingress, DNS/TLS, network, +identity/secret delivery, observability, backup/restore, and maintenance +evidence before installation. + +## T03 - Install and verify the derived rail + +```task +id: REEF-RAILIANCE-WP-0002-T03 +status: todo +priority: high +state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2" +``` + +Install only after the baseline matches the derived rail prerequisites. Record +versioned smoke and rollback evidence. + +## T04 - Bind and verify rapp-qonto + +```task +id: REEF-RAILIANCE-WP-0002-T04 +status: progress +priority: high +state_hub_task_id: "485e757b-6519-4f2e-a678-d66ef14206f5" +``` + +Add the binding at `declared`, then promote it only from machine-readable +identity, egress, cold-start, audit, revocation, rollback, and dependency +failure evidence. + +2026-07-26: Added topology-only declared bindings for `rail-knative` and +`rapp-qonto`. Baseline evidence keeps unmeasured runtime checks `unknown`; no +installed, verified, or production-approved state is claimed. + +## T05 - Decide production residual risk + +```task +id: REEF-RAILIANCE-WP-0002-T05 +status: wait +priority: high +state_hub_task_id: "f1ac627d-1ec8-445b-acd9-a65eeb068d3c" +``` + +Reserve human interaction for explicit acceptance or mitigation of the +single-server/shared-control-plane failure domain. Automated evidence must be +complete first. + +## T06 - Automate evidence freshness and drift + +```task +id: REEF-RAILIANCE-WP-0002-T06 +status: todo +priority: medium +state_hub_task_id: "82685f27-575e-4956-8c46-433a2ab2b9ea" +``` + +Make probes idempotent and suitable for scheduled reconciliation. Expired or +failed evidence must prevent false production-ready state. From 502729b85cd832d85d1e2bad9a55e12a3f633823 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 14:13:48 +0200 Subject: [PATCH 10/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 8eb6667..3616a22 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 11:08 UTC +**Last synced:** 2026-07-26 12:13 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -11,10 +11,10 @@ Progress: 1/6 done | workplan_id: `5b31c13e-ddc9-495f-8325-88fa770982c5` **Open tasks:** +- ! T03 - Install and verify the derived rail `ff070df6` - ! T05 - Decide production residual risk `f1ac627d` - ► T02 - Collect the Knative substrate baseline `833f6246` -- · T03 - Install and verify the derived rail `ff070df6` -- · T04 - Bind and verify rapp-qonto `485e757b` +- ► T04 - Bind and verify rapp-qonto `485e757b` - · T06 - Automate evidence freshness and drift `82685f27` --- From d4e9da0ce4caca404a3652eefed3af46512c80cc Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 14:14:30 +0200 Subject: [PATCH 11/52] Record blocked Knative substrate preflight --- WORK-RECORDS.md | 4 ++-- evidence/preflight/knative-2026-07-26.json | 12 ++++++++++++ ...WP-0002-knative-and-qonto-production-admission.md | 9 ++++++++- 3 files changed, 22 insertions(+), 3 deletions(-) create mode 100644 evidence/preflight/knative-2026-07-26.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 71bf7e6..14f1065 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -16,7 +16,7 @@ | task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0002-T01 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T03 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T04 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T04 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T05 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | diff --git a/evidence/preflight/knative-2026-07-26.json b/evidence/preflight/knative-2026-07-26.json new file mode 100644 index 0000000..8968528 --- /dev/null +++ b/evidence/preflight/knative-2026-07-26.json @@ -0,0 +1,12 @@ +{ + "schema_version": "railiance.knative-preflight/v1", + "collected_at": "2026-07-26T11:50:08Z", + "collector": "manual invocation of railiance-cluster/tools/knative-preflight.sh precursor", + "context": "default", + "status": "unreachable", + "api_endpoint": "92.205.62.239:6443", + "error_class": "network_timeout", + "facts_collected": false, + "secret_values_collected": false, + "admission_effect": "block_installation" +} diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md index 874b8ce..6778314 100644 --- a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md +++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md @@ -48,11 +48,16 @@ Collect Kubernetes version, capacity/headroom, ingress, DNS/TLS, network, identity/secret delivery, observability, backup/restore, and maintenance evidence before installation. +2026-07-26: The first read-only probe reached the configured context but the +API endpoint timed out. Recorded machine-readable failure evidence and kept +installation blocked. `railiance-cluster` now owns a reusable preflight probe +and the access/install workplan. + ## T03 - Install and verify the derived rail ```task id: REEF-RAILIANCE-WP-0002-T03 -status: todo +status: wait priority: high state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2" ``` @@ -60,6 +65,8 @@ state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2" Install only after the baseline matches the derived rail prerequisites. Record versioned smoke and rollback evidence. +Blocked by failed API reachability preflight; no install was attempted. + ## T04 - Bind and verify rapp-qonto ```task From 93c08393753236780ac72cf10e2cd705a0399c46 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 20:15:54 +0200 Subject: [PATCH 12/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 3616a22..a88215c 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,18 +2,16 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 12:13 UTC +**Last synced:** 2026-07-26 18:15 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Admit rail-knative and rapp-qonto with production evidence -Progress: 1/6 done | workplan_id: `5b31c13e-ddc9-495f-8325-88fa770982c5` +Progress: 3/6 done | workplan_id: `5b31c13e-ddc9-495f-8325-88fa770982c5` **Open tasks:** -- ! T03 - Install and verify the derived rail `ff070df6` - ! T05 - Decide production residual risk `f1ac627d` -- ► T02 - Collect the Knative substrate baseline `833f6246` - ► T04 - Bind and verify rapp-qonto `485e757b` - · T06 - Automate evidence freshness and drift `82685f27` From cd5c404af0414e734a75af87299fa1bff7dd54a7 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 20:16:32 +0200 Subject: [PATCH 13/52] Publish Knative installation evidence --- WORK-RECORDS.md | 4 ++-- .../preflight/knative-2026-07-26-success.json | 14 +++++++++++++ .../rail-knative-v1.22.0-2026-07-26.json | 21 +++++++++++++++++++ ...-knative-and-qonto-production-admission.md | 12 +++++++++-- 4 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 evidence/preflight/knative-2026-07-26-success.json create mode 100644 evidence/verification/rail-knative-v1.22.0-2026-07-26.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 14f1065..d570135 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -15,8 +15,8 @@ | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T04 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0002-T01 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T02 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T03 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T04 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T05 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | diff --git a/evidence/preflight/knative-2026-07-26-success.json b/evidence/preflight/knative-2026-07-26-success.json new file mode 100644 index 0000000..e89cdc7 --- /dev/null +++ b/evidence/preflight/knative-2026-07-26-success.json @@ -0,0 +1,14 @@ +{ + "schema_version": "railiance.knative-preflight/v1", + "collected_at": "2026-07-26T16:30:00Z", + "status": "passed_with_risk", + "kubernetes_server_version": "v1.35.1+k3s1", + "nodes": {"total": 1, "ready": 1, "allocatable_cpu": "4", "allocatable_memory": "16377056Ki", "observed_cpu": "452m", "observed_memory": "4619Mi"}, + "disk": {"size": "193G", "available": "147G", "used_percent": 25}, + "ingress_classes": ["traefik"], + "storage_classes": ["local-path"], + "knative_crd_count_before_install": 0, + "secret_values_collected": false, + "risks": ["single node and shared control plane", "4 CPU is below the upstream generic one-node 6 CPU recommendation"], + "admission_effect": "allow_installation_block_production_approval" +} diff --git a/evidence/verification/rail-knative-v1.22.0-2026-07-26.json b/evidence/verification/rail-knative-v1.22.0-2026-07-26.json new file mode 100644 index 0000000..b08ca82 --- /dev/null +++ b/evidence/verification/rail-knative-v1.22.0-2026-07-26.json @@ -0,0 +1,21 @@ +{ + "schema_version": "railiance.rail-verification/v1", + "collected_at": "2026-07-26T17:42:50Z", + "rail_id": "rail-knative", + "state": "verified", + "serving_version": "1.22.0", + "networking": {"implementation": "net-kourier", "version": "1.22.0", "gateway_service_type": "ClusterIP", "public_exposure": false}, + "compatibility": {"kubernetes": "v1.35.1+k3s1", "knative_minimum_kubernetes": "1.34", "result": "passed"}, + "checks": { + "control_plane_available": "passed", + "private_service_ready": "passed", + "scale_to_zero": {"result": "passed", "observed_seconds": 50}, + "cold_activation": {"result": "passed", "observed_milliseconds": 6276}, + "second_revision_ready": "passed", + "previous_revision_rollback": "passed", + "smoke_namespace_cleanup": "passed" + }, + "production_approval": "blocked", + "remaining_gates": ["single-node residual-risk decision", "public ingress DNS and TLS if requested", "restricted Qonto FQDN egress", "workload identity and OpenBao delivery", "Qonto-specific failure and audit probes"], + "secret_values_collected": false +} diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md index 6778314..9d94913 100644 --- a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md +++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md @@ -39,7 +39,7 @@ recovery, and failure-domain evidence rather than inferring it from topology. ```task id: REEF-RAILIANCE-WP-0002-T02 -status: progress +status: done priority: high state_hub_task_id: "833f6246-23bc-43ac-802d-7595b18f77a2" ``` @@ -53,11 +53,15 @@ API endpoint timed out. Recorded machine-readable failure evidence and kept installation blocked. `railiance-cluster` now owns a reusable preflight probe and the access/install workplan. +2026-07-26: Server-side preflight passed after the upgrade. Kubernetes is +v1.35.1 and the Ready node has 4 CPU/16 GiB. The below-recommendation CPU count +and single-node topology remain explicit production risks. + ## T03 - Install and verify the derived rail ```task id: REEF-RAILIANCE-WP-0002-T03 -status: wait +status: done priority: high state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2" ``` @@ -67,6 +71,10 @@ versioned smoke and rollback evidence. Blocked by failed API reachability preflight; no install was attempted. +2026-07-26: Installed and verified checksum-locked Serving and Kourier +v1.22.0. Scale-to-zero, cold activation, revision creation, private routing, +and previous-revision rollback passed. Public exposure remains disabled. + ## T04 - Bind and verify rapp-qonto ```task From 55de6c936afafe559641d3b128dcb80e032123a1 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 26 Jul 2026 23:15:03 +0200 Subject: [PATCH 14/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-26: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index a88215c..4f60e15 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,18 +2,19 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 18:15 UTC +**Last synced:** 2026-07-26 21:15 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Admit rail-knative and rapp-qonto with production evidence -Progress: 3/6 done | workplan_id: `5b31c13e-ddc9-495f-8325-88fa770982c5` +### Complete rapp-qonto production gates +Progress: 0/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** -- ! T05 - Decide production residual risk `f1ac627d` -- ► T04 - Bind and verify rapp-qonto `485e757b` -- · T06 - Automate evidence freshness and drift `82685f27` +- ! T03 - Deploy and verify rapp-qonto `ddf25c7b` +- ! T04 - Reassess production failure-domain risk `9d0c1f61` +- · T01 - Verify workload identity and secret delivery `de8a8e05` +- · T02 - Enforce restricted Qonto egress `2a6742f1` --- ## MCP Orientation (when available) From 7751e5f04305e7d459696c09af3b51f0d6d1bca1 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 23:17:08 +0200 Subject: [PATCH 15/52] Finish Knative reef admission workplan --- WORK-RECORDS.md | 13 ++-- evidence/admission/rail-knative-baseline.json | 25 +++---- ...ion_freshness.cpython-312-pytest-7.4.4.pyc | Bin 0 -> 5998 bytes tests/test_admission_freshness.py | 33 +++++++++ .../check_admission_freshness.cpython-312.pyc | Bin 0 -> 3074 bytes tools/check_admission_freshness.py | 45 +++++++++++++ ...-knative-and-qonto-production-admission.md | 19 ++++-- ...NCE-WP-0003-rapp-qonto-production-gates.md | 63 ++++++++++++++++++ 8 files changed, 178 insertions(+), 20 deletions(-) create mode 100644 tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc create mode 100644 tests/test_admission_freshness.py create mode 100644 tools/__pycache__/check_admission_freshness.cpython-312.pyc create mode 100755 tools/check_admission_freshness.py create mode 100644 workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index d570135..21606ce 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -9,7 +9,8 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | -| workplan | REEF-RAILIANCE-WP-0002 | active | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| workplan | REEF-RAILIANCE-WP-0003 | active | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -17,6 +18,10 @@ | task | REEF-RAILIANCE-WP-0002-T01 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T02 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T03 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T04 | progress | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T05 | wait | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0002-T06 | todo | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | +| task | REEF-RAILIANCE-WP-0003-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/evidence/admission/rail-knative-baseline.json b/evidence/admission/rail-knative-baseline.json index 856d6ca..2c657a9 100644 --- a/evidence/admission/rail-knative-baseline.json +++ b/evidence/admission/rail-knative-baseline.json @@ -2,8 +2,8 @@ "contract_version": "1.0.0", "reef_id": "reef-railiance", "subject": "rail-knative", - "readiness_state": "declared", - "checked_at": "2026-07-26T00:00:00Z", + "readiness_state": "verified", + "checked_at": "2026-07-26T18:00:00Z", "checks": { "compatibility": { "status": "pass", @@ -11,22 +11,22 @@ "../rail-knative/declarations/rail.yaml", "../rail-kubernetes/declarations/rail.yaml" ], - "notes": "Declaration compatibility passes; runtime versions are not yet observed." + "notes": "Knative 1.22 minimum Kubernetes 1.34; observed Kubernetes 1.35.1." }, "capacity": { - "status": "unknown", - "evidence": [], - "notes": "CPU, memory, pod, and control-plane headroom must be measured." + "status": "pass", + "evidence": ["../preflight/knative-2026-07-26-success.json"], + "notes": "Installation verification passed; 4 CPU remains below the generic 6 CPU recommendation." }, - "ingress": {"status": "unknown", "evidence": []}, - "network": {"status": "unknown", "evidence": []}, + "ingress": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Kourier is verified ClusterIP-only; public exposure is disabled."}, + "network": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"]}, "identity_and_secrets": {"status": "unknown", "evidence": []}, - "observability": {"status": "unknown", "evidence": []}, + "observability": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Control-plane availability and lifecycle observations are recorded."}, "recovery": {"status": "unknown", "evidence": []}, "failure_domain": { - "status": "unknown", - "evidence": [], - "notes": "Knative would share the current single-member Kubernetes reef." + "status": "fail", + "evidence": ["../preflight/knative-2026-07-26-success.json"], + "notes": "Production approval is rejected while Knative shares the single-member control plane." } }, "residual_risks": [ @@ -34,6 +34,7 @@ "risk": "Single server and shared control plane for a critical bank-connected workload", "status": "open", "owner": "railiance-infra" + ,"decision": "Not accepted for production; verified non-production rail operation may continue." } ] } diff --git a/tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc b/tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc new file mode 100644 index 0000000000000000000000000000000000000000..31edb65b7a1dbf9ade2faf1e0e3cd59c94563ef1 GIT binary patch literal 5998 zcmd5=O>7&-6`m!R%U_9-75TTe87FGIm1T*tE!(XX)PIEov}(|%K*7s`<_xW+$X#M~ zC0hz_)<}e~G|Q}j2W*wY!Ld`)=ph(VeJM>yp`Rry$2!jj z{mQG|b2P^KS0cfDVelL5M!N0Tpo*q2#0D!TyEQ7K-E(Y6S;2Z!)VQY=_S5)1QaC^p zAP>?c$U}>onchU>8B-Jb+eLqN6IZ@;!gt-OH(r`$r8%oeYqsavu49!s^JX39d8g}( zBH135q8-;appWCN90<4zS_5{MMjM(9e^hToXzW4cmPU;S`mc!@pILfka$<67Y~uXb z zW8=47?v-Z8Ib-E9UW9;(PKk~C%=0}dziEdI&Ppz)d=T8h!$Q0tfmkO0*neu{NN!{3 z#KYe{T3CI3YIWcFjo0%}-dQ_xW%cmY|0H7><0}%28C#%DN+?uACvtDU0QoWTTTdxG zr>*BoDdLf8xbIZ=+mjXbhO}qE67ScJ_DO6d7ECpXkDDu7MZS4z6daqH-=}6)TAgNu z8qH{gG_*#fK^oB&j2K!|zeSp{hTe$H!86=68pcPO_pYA}&O#&usuvzqK8dGQ{HLn zrA3}mF)81>M&4xsk*9WvJfghQ^qwOh?(o@T&l^PfgA?$*qu~!&}mJ9+UcU_0Vt-LCsF5|(t%D(=Zxu{G*it}(#MqP1)U3~2a~z!z;zy! zI3k2ZHW78)+h#&U>x&a8CQ+P0aSp{4iVH%=Fr_^6B8x$AUtS^)mzLA#%&dq|UnD5N zwQtv$NT6JD9VVjleo0&dwcGb5X zPZ(7fG(2(8@@C!nDwV3%t*UzyxWFmG^^%rXEHm^V`Y+1}f%C3&?s73?m0eyd`WCxW zuNEEPCD$>N{3z^!NaJOK73DhzXFCVyI|mno&{{T=+eZ0d6kINUcH3ymLv{jU3K~bi z6r*wn78tk7HgI39xCkrri?$GL`vo^n=ll=>5z0 z`NPRiZhkuVc+cTSQ>(K}j5k<_4Z zl>$OqlxS0<7D7l!7C@xQW)w&?DhX3>=-z*Q%q3*2;KFw_nri4kmua-=pv#OutQ0Ff z0C^i-hW>kitlzKvC@2Hc2`zdg%iR_Lgb4a}(QVV- zE_!X!q5ThZNeeNWr2~yvizEymAwsqePdy5ThM{&;9a|)U1fe&hKn#O39A90I_mbmn zZFbc}Sp5o#Pr1+4DSyj!%GC>JJc2;yN$}e+?$h0ge?5H&I~z%STa2 z_Be$-ylMP0iZK+YQH-OQK#@l=iQ){3vmng4#9e*``kkmc**Q4Jr`o3jENvlhFu3R; zN^HZ?5s9PWK3c&(0y*HSJ*!l8Jx2Kru*3S#`xA)W5cJFJ!S(F%we0af8mn(ydSXA# z-T3Ua&-l~qua<8-*N?9M|NmF@qumIJ7$p(%8OZMjA)zGD!qmBEDG>>AQXx_^O5;r( zN(sO-C?)hZUdEufh%M~3h)BpHB8fI3Du#&L3rRz?fE0P}==rT>K)8POj&DoZd*FGu z#g3G{hfSl6U63-rtjN1chg~D@ve=Qr_li73)4em+o=b>r#YV5IcNQC&U7n6!MMN*3 zVG+^SE+YDA_9Yh)25>~XkdQ^hKnGWBVolP)6@zTSrVPGdkfC2)7flkW|s3fc|E~@GxAMj0BQb>R|6Z|ShoN)usaZF}Tb9S5C@cAwoq!utG;;p$LUyykPW*DO1uGL-cSM8gp z=Y6{>lI^jG!<7>&|54E-AiPe#}){<{6 z8yoR~_wT-UcRfC~79V>w_hjm6{K~Svks1DQ=7X8_%;;KX^wG7anf!8cgXr(4-%GEP j18d~K{p2%pV#_cz#BBF literal 0 HcmV?d00001 diff --git a/tests/test_admission_freshness.py b/tests/test_admission_freshness.py new file mode 100644 index 0000000..7a2a3dd --- /dev/null +++ b/tests/test_admission_freshness.py @@ -0,0 +1,33 @@ +import datetime as dt +import importlib.util +from pathlib import Path + +MODULE = Path(__file__).parents[1] / "tools/check_admission_freshness.py" +spec = importlib.util.spec_from_file_location("freshness", MODULE) +freshness = importlib.util.module_from_spec(spec) +spec.loader.exec_module(freshness) + + +def record(state="verified", status="pass", risk="open"): + return { + "checked_at": "2026-07-26T18:00:00Z", + "readiness_state": state, + "checks": {"compatibility": {"status": status}}, + "residual_risks": [{"risk": "single node", "status": risk}], + } + + +def test_verified_may_retain_explicit_open_risk(): + now = dt.datetime(2026, 7, 26, 19, tzinfo=dt.timezone.utc) + assert freshness.assess(record(), now, 24) == [] + + +def test_production_approval_fails_closed(): + now = dt.datetime(2026, 7, 26, 19, tzinfo=dt.timezone.utc) + failures = freshness.assess(record("production-approved", "unknown"), now, 24) + assert len(failures) == 2 + + +def test_stale_evidence_fails(): + now = dt.datetime(2026, 7, 28, 19, tzinfo=dt.timezone.utc) + assert "evidence is stale" in freshness.assess(record(), now, 24) diff --git a/tools/__pycache__/check_admission_freshness.cpython-312.pyc b/tools/__pycache__/check_admission_freshness.cpython-312.pyc new file mode 100644 index 0000000000000000000000000000000000000000..d40fa3fa238e4fc6df0859c2615c7459336e0827 GIT binary patch literal 3074 zcmaJ@O>7&-6`uX!?ux&nMg2HdtWB)gqHT(55$DHs1she}CMfK{GMZRT%d9vTM}zTM9Q0WX5~NimgqM?&Z;)^S@;N7?=pDDNSRW)S8upW|jYNAfd* zBgGjJq>%IEr5TAsSR^v`5FsPFKsypkM8PuYA>M;vOet9Tqd4OOi<07T59odpz~1Z_ zLNvf55`@S9pfmgd*H(VdUFV~|@=wlddQMH|43l7WK1~WLB_yS4IIo+gZWL5Ub>?F&3B&>X4?7PC7o1Ge2QgAR_n z{Hj>tDqPd)z1vRRH_@QL(ftyYXcJ`(9+l zjRa(bd)O*FoBIdo`J}m(2rtC`sPQq8BnyDoSVmFgvIwcf${s z11u8qH~@L{Kuph5>)rRn48k<5jYCPHDpfu6ZJnK(K3|7gQ@v)Km$MGOQNE(R_oEx0`~tq7f~1ly7W0T+P9luTPJYNlB}xf80kL$#cm)=aekV_Ae=m{Z#$ zPpf7Aq-qB#F?C$hatW%NS->%hq+pAzQ$F!DG!_H*x;;>J21XT|$Cj;N$k@{J#15q3 zI_sv9GH4zuB~wz&X-Q)DFfS%KOS2_Nkrc4)(JhjPsWXONh+AvQ>NKAj2Ev%s-_7l9R*khZN}l2FQ8^9yzuj_VDEBvDZ3dwRu3M# zC*7;m$IfhyP1VPy)}}ujYm7}df|nP5)|9=AZ~m_O7y4f1X60UNWAK%A`IV;9yBt~y z)rL-NC?}h8aHX%~KesVBUJsA2%j4aUQya=lO*v2tj?`tfHu~zi{Ax==>e0LD`bd0p zS*B%rIw*+u53Xc(p$6n+QHT{w0 zi%S=4!>@mK`JY$*ai#X=%;&$U5C3Yz|Mq`gI8i%!rvAc@|10nV-sZEyG)Vd(DcoYiH^OwgTgM^?BD@YC*=>Dz5V$VGISsLEUYZd8T023$Qe z~xhzlMS8J2uMBge~X=%l10q z%)^+=GzzvSXK2`TuJOv=!*z42;$T zqm97Ph4W3(yD1LV#lc(N)ksYo+z`jRrrJ>SZ^FY%j`eKQ7vA&@*L}kc-{FO+tw4Br zW@+Y@cqec>usIa355*fpKWGGgxNv?e)W4E?fA&uHcJ_{O+gP3bD0@Hqk#XN>9G+Yg zH_u+GpS{!wO#@4cJvT;|k1rkn@W@^K*Zc?h#`7<(jXliO-g>9ruQj~08)963zUoSqnOiY+xsJ8J!#PxbBH+| z3i%Qn!j7j?9R|xjAc=(SoxX0ux96wVbn8B%KVlKAl;0|6^6<&ckx4oQUG_s~5_q)) zj^n;WuYH9=U!eXkkni7Us3k?X$jXZ?1mc!c2S!-4<+ literal 0 HcmV?d00001 diff --git a/tools/check_admission_freshness.py b/tools/check_admission_freshness.py new file mode 100755 index 0000000..e8a9157 --- /dev/null +++ b/tools/check_admission_freshness.py @@ -0,0 +1,45 @@ +#!/usr/bin/env python3 +"""Fail closed when reef admission evidence is stale or over-promoted.""" + +import argparse +import datetime as dt +import json +from pathlib import Path + + +def assess(record: dict, now: dt.datetime, max_age_hours: int) -> list[str]: + failures = [] + checked = dt.datetime.fromisoformat(record["checked_at"].replace("Z", "+00:00")) + if now - checked > dt.timedelta(hours=max_age_hours): + failures.append("evidence is stale") + if checked > now + dt.timedelta(minutes=5): + failures.append("checked_at is in the future") + if record["readiness_state"] == "production-approved": + bad = [ + name + for name, check in record["checks"].items() + if check["status"] != "pass" + ] + if bad: + failures.append("production approval has non-passing checks: " + ", ".join(bad)) + open_risks = [ + risk["risk"] for risk in record["residual_risks"] if risk["status"] == "open" + ] + if open_risks: + failures.append("production approval has open residual risks") + return failures + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("evidence", type=Path) + parser.add_argument("--max-age-hours", type=int, default=24) + args = parser.parse_args() + record = json.loads(args.evidence.read_text()) + failures = assess(record, dt.datetime.now(dt.timezone.utc), args.max_age_hours) + print(json.dumps({"evidence": str(args.evidence), "pass": not failures, "failures": failures})) + return bool(failures) + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md index 9d94913..e8c253d 100644 --- a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md +++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md @@ -4,7 +4,7 @@ type: workplan title: "Admit rail-knative and rapp-qonto with production evidence" domain: financials repo: reef-railiance -status: active +status: finished owner: codex topic_slug: railiance created: "2026-07-26" @@ -79,7 +79,7 @@ and previous-revision rollback passed. Public exposure remains disabled. ```task id: REEF-RAILIANCE-WP-0002-T04 -status: progress +status: cancel priority: high state_hub_task_id: "485e757b-6519-4f2e-a678-d66ef14206f5" ``` @@ -92,11 +92,15 @@ failure evidence. `rapp-qonto`. Baseline evidence keeps unmeasured runtime checks `unknown`; no installed, verified, or production-approved state is claimed. +2026-07-26: The declared binding is retained without false promotion. Live +Qonto verification moved to `REEF-RAILIANCE-WP-0003` because identity, +restricted egress, and workload evidence are not yet established. + ## T05 - Decide production residual risk ```task id: REEF-RAILIANCE-WP-0002-T05 -status: wait +status: done priority: high state_hub_task_id: "f1ac627d-1ec8-445b-acd9-a65eeb068d3c" ``` @@ -105,14 +109,21 @@ Reserve human interaction for explicit acceptance or mitigation of the single-server/shared-control-plane failure domain. Automated evidence must be complete first. +Decision: do not accept the current failure domain for production. The +verified rail may operate privately for non-production verification. Reassess +only after workload gates pass or the failure domain is mitigated. + ## T06 - Automate evidence freshness and drift ```task id: REEF-RAILIANCE-WP-0002-T06 -status: todo +status: done priority: medium state_hub_task_id: "82685f27-575e-4956-8c46-433a2ab2b9ea" ``` Make probes idempotent and suitable for scheduled reconciliation. Expired or failed evidence must prevent false production-ready state. + +2026-07-26: Added a deterministic freshness gate that fails stale evidence and +rejects production approval with any non-passing check or open residual risk. diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md new file mode 100644 index 0000000..be4deb7 --- /dev/null +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -0,0 +1,63 @@ +--- +id: REEF-RAILIANCE-WP-0003 +type: workplan +title: "Complete rapp-qonto production gates" +domain: financials +repo: reef-railiance +status: active +owner: codex +topic_slug: railiance +created: "2026-07-26" +updated: "2026-07-26" +state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" +--- + +# REEF-RAILIANCE-WP-0003 - rapp-qonto production gates + +## T01 - Verify workload identity and secret delivery + +```task +id: REEF-RAILIANCE-WP-0003-T01 +status: todo +priority: high +state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" +``` + +Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane +without exposing credential values. + +## T02 - Enforce restricted Qonto egress + +```task +id: REEF-RAILIANCE-WP-0003-T02 +status: todo +priority: high +state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d" +``` + +Implement and verify FQDN-aware policy or a controlled egress proxy. Do not +substitute unrestricted HTTPS. + +## T03 - Deploy and verify rapp-qonto + +```task +id: REEF-RAILIANCE-WP-0003-T03 +status: wait +priority: high +state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" +``` + +After T01 and T02, verify cold start, audit, revocation, dependency failure, +idempotency, and previous-revision rollback using machine-readable evidence. + +## T04 - Reassess production failure-domain risk + +```task +id: REEF-RAILIANCE-WP-0003-T04 +status: wait +priority: high +state_hub_task_id: "9d0c1f61-0ed8-4d5c-b4c2-2578424ad3b4" +``` + +Production approval requires mitigation or explicit acceptance of the +single-node/shared-control-plane risk after all automated workload gates pass. From 556c9a49bd8fab6d2226906827f22a047334bda2 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 26 Jul 2026 23:17:53 +0200 Subject: [PATCH 16/52] Ignore generated Python artifacts --- .gitignore | 3 +++ ...ission_freshness.cpython-312-pytest-7.4.4.pyc | Bin 5998 -> 0 bytes .../check_admission_freshness.cpython-312.pyc | Bin 3074 -> 0 bytes 3 files changed, 3 insertions(+) create mode 100644 .gitignore delete mode 100644 tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc delete mode 100644 tools/__pycache__/check_admission_freshness.cpython-312.pyc diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a160f49 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +__pycache__/ +*.py[cod] +.pytest_cache/ diff --git a/tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc b/tests/__pycache__/test_admission_freshness.cpython-312-pytest-7.4.4.pyc deleted file mode 100644 index 31edb65b7a1dbf9ade2faf1e0e3cd59c94563ef1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 5998 zcmd5=O>7&-6`m!R%U_9-75TTe87FGIm1T*tE!(XX)PIEov}(|%K*7s`<_xW+$X#M~ zC0hz_)<}e~G|Q}j2W*wY!Ld`)=ph(VeJM>yp`Rry$2!jj z{mQG|b2P^KS0cfDVelL5M!N0Tpo*q2#0D!TyEQ7K-E(Y6S;2Z!)VQY=_S5)1QaC^p zAP>?c$U}>onchU>8B-Jb+eLqN6IZ@;!gt-OH(r`$r8%oeYqsavu49!s^JX39d8g}( zBH135q8-;appWCN90<4zS_5{MMjM(9e^hToXzW4cmPU;S`mc!@pILfka$<67Y~uXb z zW8=47?v-Z8Ib-E9UW9;(PKk~C%=0}dziEdI&Ppz)d=T8h!$Q0tfmkO0*neu{NN!{3 z#KYe{T3CI3YIWcFjo0%}-dQ_xW%cmY|0H7><0}%28C#%DN+?uACvtDU0QoWTTTdxG zr>*BoDdLf8xbIZ=+mjXbhO}qE67ScJ_DO6d7ECpXkDDu7MZS4z6daqH-=}6)TAgNu z8qH{gG_*#fK^oB&j2K!|zeSp{hTe$H!86=68pcPO_pYA}&O#&usuvzqK8dGQ{HLn zrA3}mF)81>M&4xsk*9WvJfghQ^qwOh?(o@T&l^PfgA?$*qu~!&}mJ9+UcU_0Vt-LCsF5|(t%D(=Zxu{G*it}(#MqP1)U3~2a~z!z;zy! zI3k2ZHW78)+h#&U>x&a8CQ+P0aSp{4iVH%=Fr_^6B8x$AUtS^)mzLA#%&dq|UnD5N zwQtv$NT6JD9VVjleo0&dwcGb5X zPZ(7fG(2(8@@C!nDwV3%t*UzyxWFmG^^%rXEHm^V`Y+1}f%C3&?s73?m0eyd`WCxW zuNEEPCD$>N{3z^!NaJOK73DhzXFCVyI|mno&{{T=+eZ0d6kINUcH3ymLv{jU3K~bi z6r*wn78tk7HgI39xCkrri?$GL`vo^n=ll=>5z0 z`NPRiZhkuVc+cTSQ>(K}j5k<_4Z zl>$OqlxS0<7D7l!7C@xQW)w&?DhX3>=-z*Q%q3*2;KFw_nri4kmua-=pv#OutQ0Ff z0C^i-hW>kitlzKvC@2Hc2`zdg%iR_Lgb4a}(QVV- zE_!X!q5ThZNeeNWr2~yvizEymAwsqePdy5ThM{&;9a|)U1fe&hKn#O39A90I_mbmn zZFbc}Sp5o#Pr1+4DSyj!%GC>JJc2;yN$}e+?$h0ge?5H&I~z%STa2 z_Be$-ylMP0iZK+YQH-OQK#@l=iQ){3vmng4#9e*``kkmc**Q4Jr`o3jENvlhFu3R; zN^HZ?5s9PWK3c&(0y*HSJ*!l8Jx2Kru*3S#`xA)W5cJFJ!S(F%we0af8mn(ydSXA# z-T3Ua&-l~qua<8-*N?9M|NmF@qumIJ7$p(%8OZMjA)zGD!qmBEDG>>AQXx_^O5;r( zN(sO-C?)hZUdEufh%M~3h)BpHB8fI3Du#&L3rRz?fE0P}==rT>K)8POj&DoZd*FGu z#g3G{hfSl6U63-rtjN1chg~D@ve=Qr_li73)4em+o=b>r#YV5IcNQC&U7n6!MMN*3 zVG+^SE+YDA_9Yh)25>~XkdQ^hKnGWBVolP)6@zTSrVPGdkfC2)7flkW|s3fc|E~@GxAMj0BQb>R|6Z|ShoN)usaZF}Tb9S5C@cAwoq!utG;;p$LUyykPW*DO1uGL-cSM8gp z=Y6{>lI^jG!<7>&|54E-AiPe#}){<{6 z8yoR~_wT-UcRfC~79V>w_hjm6{K~Svks1DQ=7X8_%;;KX^wG7anf!8cgXr(4-%GEP j18d~K{p2%pV#_cz#BBF diff --git a/tools/__pycache__/check_admission_freshness.cpython-312.pyc b/tools/__pycache__/check_admission_freshness.cpython-312.pyc deleted file mode 100644 index d40fa3fa238e4fc6df0859c2615c7459336e0827..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 3074 zcmaJ@O>7&-6`uX!?ux&nMg2HdtWB)gqHT(55$DHs1she}CMfK{GMZRT%d9vTM}zTM9Q0WX5~NimgqM?&Z;)^S@;N7?=pDDNSRW)S8upW|jYNAfd* zBgGjJq>%IEr5TAsSR^v`5FsPFKsypkM8PuYA>M;vOet9Tqd4OOi<07T59odpz~1Z_ zLNvf55`@S9pfmgd*H(VdUFV~|@=wlddQMH|43l7WK1~WLB_yS4IIo+gZWL5Ub>?F&3B&>X4?7PC7o1Ge2QgAR_n z{Hj>tDqPd)z1vRRH_@QL(ftyYXcJ`(9+l zjRa(bd)O*FoBIdo`J}m(2rtC`sPQq8BnyDoSVmFgvIwcf${s z11u8qH~@L{Kuph5>)rRn48k<5jYCPHDpfu6ZJnK(K3|7gQ@v)Km$MGOQNE(R_oEx0`~tq7f~1ly7W0T+P9luTPJYNlB}xf80kL$#cm)=aekV_Ae=m{Z#$ zPpf7Aq-qB#F?C$hatW%NS->%hq+pAzQ$F!DG!_H*x;;>J21XT|$Cj;N$k@{J#15q3 zI_sv9GH4zuB~wz&X-Q)DFfS%KOS2_Nkrc4)(JhjPsWXONh+AvQ>NKAj2Ev%s-_7l9R*khZN}l2FQ8^9yzuj_VDEBvDZ3dwRu3M# zC*7;m$IfhyP1VPy)}}ujYm7}df|nP5)|9=AZ~m_O7y4f1X60UNWAK%A`IV;9yBt~y z)rL-NC?}h8aHX%~KesVBUJsA2%j4aUQya=lO*v2tj?`tfHu~zi{Ax==>e0LD`bd0p zS*B%rIw*+u53Xc(p$6n+QHT{w0 zi%S=4!>@mK`JY$*ai#X=%;&$U5C3Yz|Mq`gI8i%!rvAc@|10nV-sZEyG)Vd(DcoYiH^OwgTgM^?BD@YC*=>Dz5V$VGISsLEUYZd8T023$Qe z~xhzlMS8J2uMBge~X=%l10q z%)^+=GzzvSXK2`TuJOv=!*z42;$T zqm97Ph4W3(yD1LV#lc(N)ksYo+z`jRrrJ>SZ^FY%j`eKQ7vA&@*L}kc-{FO+tw4Br zW@+Y@cqec>usIa355*fpKWGGgxNv?e)W4E?fA&uHcJ_{O+gP3bD0@Hqk#XN>9G+Yg zH_u+GpS{!wO#@4cJvT;|k1rkn@W@^K*Zc?h#`7<(jXliO-g>9ruQj~08)963zUoSqnOiY+xsJ8J!#PxbBH+| z3i%Qn!j7j?9R|xjAc=(SoxX0ux96wVbn8B%KVlKAl;0|6^6<&ckx4oQUG_s~5_q)) zj^n;WuYH9=U!eXkkni7Us3k?X$jXZ?1mc!c2S!-4<+ From 269d9226317699b13ba7a07753c72dba02a723d0 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 27 Jul 2026 02:08:39 +0200 Subject: [PATCH 17/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-27: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 4f60e15..c869c93 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-26 21:15 UTC +**Last synced:** 2026-07-27 00:08 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -13,7 +13,7 @@ Progress: 0/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T03 - Deploy and verify rapp-qonto `ddf25c7b` - ! T04 - Reassess production failure-domain risk `9d0c1f61` -- · T01 - Verify workload identity and secret delivery `de8a8e05` +- ► T01 - Verify workload identity and secret delivery `de8a8e05` - · T02 - Enforce restricted Qonto egress `2a6742f1` --- From 0a4f4b9de6cc3cc30c753e9418fa3036ddc768a0 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 02:08:54 +0200 Subject: [PATCH 18/52] Start Qonto workload identity gate --- WORK-RECORDS.md | 2 +- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 21606ce..69dfc53 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -21,7 +21,7 @@ | task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0003-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index be4deb7..3d92dda 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -18,7 +18,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" ```task id: REEF-RAILIANCE-WP-0003-T01 -status: todo +status: progress priority: high state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" ``` @@ -26,6 +26,11 @@ state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane without exposing credential values. +2026-07-27: ops-mason surveyed live OpenBao state and produced reviewed plan +`rapp-qonto-openbao-kubernetes-lane`. It reuses the existing exact-scope Qonto +policy, replaces the draft static-token store with Kubernetes authentication, +and awaits the mandatory structural-access approval before build. + ## T02 - Enforce restricted Qonto egress ```task From 1c679ee42127acc13d18aa8f92270bb331c2480d Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 03:14:25 +0200 Subject: [PATCH 19/52] Complete Qonto secret delivery gate --- ...NCE-WP-0003-rapp-qonto-production-gates.md | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 3d92dda..456f09e 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-07-26" +updated: "2026-07-27" state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" --- @@ -18,7 +18,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" ```task id: REEF-RAILIANCE-WP-0003-T01 -status: progress +status: done priority: high state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" ``` @@ -26,16 +26,23 @@ state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane without exposing credential values. -2026-07-27: ops-mason surveyed live OpenBao state and produced reviewed plan -`rapp-qonto-openbao-kubernetes-lane`. It reuses the existing exact-scope Qonto -policy, replaces the draft static-token store with Kubernetes authentication, -and awaits the mandatory structural-access approval before build. +2026-07-27: Live topology invalidated the original Kubernetes-auth design: +Coulombcore OpenBao cannot validate railiance01 service-account tokens. The +failed objects were removed. The revised, explicitly approved ops-mason plan +`rapp-qonto-openbao-approle-bridge` reuses the existing exact-scope Qonto +policy and establishes a transitional AppRole bridge with 15-minute tokens, +30-minute maximum TTL, eight uses, and a revocable bootstrap identity held by +ESO. Live metadata-only verification reports +`ClusterSecretStore/openbao-rapp-qonto` `Valid`, +`ExternalSecret/rapp-qonto` `SecretSynced`, and exactly two keys in the +derived Secret. No credential value was exposed. Same-cluster Kubernetes auth +remains the migration target. ## T02 - Enforce restricted Qonto egress ```task id: REEF-RAILIANCE-WP-0003-T02 -status: todo +status: progress priority: high state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d" ``` From 9ac0468cdf00b42a4cbe93dee5997a2ac11f13cc Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 27 Jul 2026 03:14:42 +0200 Subject: [PATCH 20/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-27: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index c869c93..cf463b1 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,19 +2,18 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-27 00:08 UTC +**Last synced:** 2026-07-27 01:14 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Complete rapp-qonto production gates -Progress: 0/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` +Progress: 1/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T03 - Deploy and verify rapp-qonto `ddf25c7b` - ! T04 - Reassess production failure-domain risk `9d0c1f61` -- ► T01 - Verify workload identity and secret delivery `de8a8e05` -- · T02 - Enforce restricted Qonto egress `2a6742f1` +- ► T02 - Enforce restricted Qonto egress `2a6742f1` --- ## MCP Orientation (when available) From 70f72e4a92a220ae2ad52d72f7de7db111cce539 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 03:27:58 +0200 Subject: [PATCH 21/52] Record Qonto egress enforcement failure --- WORK-RECORDS.md | 4 ++-- ...F-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 11 +++++++++++ 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 69dfc53..9578af9 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -21,7 +21,7 @@ | task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 456f09e..0245e0e 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -50,6 +50,17 @@ state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d" Implement and verify FQDN-aware policy or a controlled egress proxy. Do not substitute unrestricted HTTPS. +2026-07-27: Implemented a pinned Canonical Squid controlled-proxy candidate +that permits `CONNECT` only to exact host `thirdparty.qonto.com:443`, with +private-address exclusions and namespace/pod isolation policies. Repository +tests and Kubernetes server-side validation passed. Live probes did not: +allowlisted proxy access returned `000`, non-allowlisted access returned +`000`, and direct Qonto HTTPS unexpectedly succeeded despite namespace +default-deny. The candidate was removed from the live cluster and is not +included by the runtime Kustomization. T02 remains `progress` until +railiance01 NetworkPolicy enforcement is repaired and the three-way probe +proves allowlisted success, other-host denial, and direct-bypass denial. + ## T03 - Deploy and verify rapp-qonto ```task From 80ed9c315ff3c1c1fbc21801a323a6b9c41f0670 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 07:18:38 +0200 Subject: [PATCH 22/52] Complete fail-closed Qonto egress gate --- ...ILIANCE-WP-0003-rapp-qonto-production-gates.md | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 0245e0e..de32a27 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -42,7 +42,7 @@ remains the migration target. ```task id: REEF-RAILIANCE-WP-0003-T02 -status: progress +status: done priority: high state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d" ``` @@ -61,11 +61,22 @@ included by the runtime Kustomization. T02 remains `progress` until railiance01 NetworkPolicy enforcement is repaired and the three-way probe proves allowlisted success, other-host denial, and direct-bypass denial. +2026-07-27 follow-up: Host firewall-chain tracing showed NetworkPolicy does +enforce after kube-router creates the per-pod chain; the failed immediate +probe exposed an asynchronous startup window rather than a disabled +controller. The runtime now uses an immutable curl init container as a +fail-closed startup gate. It retries until its own pod proves Qonto proxy +access (`CONNECT 200`), other-host proxy denial (`CONNECT 403`), and direct +Qonto denial. Knative init-container support is enabled and source-controlled +in `railiance-cluster`. Live disposable-pod evidence reported `gate=passed` +before `application=admitted`. The proxy bundle is now part of the active +runtime Kustomization and T02 is complete. + ## T03 - Deploy and verify rapp-qonto ```task id: REEF-RAILIANCE-WP-0003-T03 -status: wait +status: progress priority: high state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" ``` From 29f813f14486ec46f0e81003243e53cbc8c2cde5 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 27 Jul 2026 07:18:45 +0200 Subject: [PATCH 23/52] chore(consistency): sync task status from DB [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-07-27: - REEF-RAILIANCE-WP-0003-T03: progress → wait --- workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index de32a27..6955240 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -76,7 +76,7 @@ runtime Kustomization and T02 is complete. ```task id: REEF-RAILIANCE-WP-0003-T03 -status: progress +status: wait priority: high state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" ``` From e2f99d4b29b14792c205c5666dc11e90a15b6f2b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 27 Jul 2026 07:18:46 +0200 Subject: [PATCH 24/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-27: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index cf463b1..2cbd41f 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,18 +2,17 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-27 01:14 UTC +**Last synced:** 2026-07-27 05:18 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Complete rapp-qonto production gates -Progress: 1/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` +Progress: 2/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T03 - Deploy and verify rapp-qonto `ddf25c7b` - ! T04 - Reassess production failure-domain risk `9d0c1f61` -- ► T02 - Enforce restricted Qonto egress `2a6742f1` --- ## MCP Orientation (when available) From d5da1727edd774634d2c67af8586f13ce7b40857 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 07:19:36 +0200 Subject: [PATCH 25/52] Activate Qonto deployment verification --- WORK-RECORDS.md | 4 ++-- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 9578af9..e63dc44 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -22,6 +22,6 @@ | task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| task | REEF-RAILIANCE-WP-0003-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T03 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 6955240..de32a27 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -76,7 +76,7 @@ runtime Kustomization and T02 is complete. ```task id: REEF-RAILIANCE-WP-0003-T03 -status: wait +status: progress priority: high state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" ``` From 64a4ff6cc1b3dff7f0f5848f2ed0ff7e1c92214b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 27 Jul 2026 07:19:50 +0200 Subject: [PATCH 26/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-27: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 2cbd41f..c4d1a72 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-27 05:18 UTC +**Last synced:** 2026-07-27 05:19 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -11,8 +11,8 @@ Progress: 2/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** -- ! T03 - Deploy and verify rapp-qonto `ddf25c7b` - ! T04 - Reassess production failure-domain risk `9d0c1f61` +- ► T03 - Deploy and verify rapp-qonto `ddf25c7b` --- ## MCP Orientation (when available) From c68b33a40d49398ac56f53bad6cfe7bc13eed9c0 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 21:10:51 +0200 Subject: [PATCH 27/52] Record rapp-qonto live readiness --- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index de32a27..ddecebe 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -84,6 +84,12 @@ state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" After T01 and T02, verify cold start, audit, revocation, dependency failure, idempotency, and previous-revision rollback using machine-readable evidence. +2026-07-27: The first application revision is live and ready as +`rapp-qonto-00004`; its egress admission gate completed and `/v1/health` +passed through the cluster-local Knative service. Full failure, revocation, +idempotency, timing, and rollback evidence is still required before T03 can +close. + ## T04 - Reassess production failure-domain risk ```task From 4a783664a6cbbffd2188fda9ab30b17c51e7cfc0 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Wed, 29 Jul 2026 23:08:25 +0200 Subject: [PATCH 28/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-29: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index c4d1a72..c50679d 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,16 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-27 05:19 UTC +**Last synced:** 2026-07-29 21:08 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Complete rapp-qonto production gates -Progress: 2/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` +Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T04 - Reassess production failure-domain risk `9d0c1f61` -- ► T03 - Deploy and verify rapp-qonto `ddf25c7b` --- ## MCP Orientation (when available) From 85e35b1a7ca36d877e685a8e897dcf46f5a1915b Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 29 Jul 2026 23:13:35 +0200 Subject: [PATCH 29/52] Promote Qonto reef binding to verified --- WORK-RECORDS.md | 2 +- bindings/rapps.yaml | 5 +++-- ...RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 13 +++++++++++-- 3 files changed, 15 insertions(+), 5 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e63dc44..e0d34be 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -23,5 +23,5 @@ | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0003-T01 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| task | REEF-RAILIANCE-WP-0003-T03 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml index 0c84a6c..851e001 100644 --- a/bindings/rapps.yaml +++ b/bindings/rapps.yaml @@ -2,9 +2,10 @@ reef_id: reef-railiance bound_rapps: - rapp_id: rapp-qonto rail_id: rail-knative - readiness_state: declared + readiness_state: verified evidence: - ../rapp-qonto/docs/security-and-reliability-gates.md + - ../rapp-qonto/evidence/live/2026-07-29-railiance01.json notes: - - The Qonto binding is topology-only until admission evidence supports promotion. + - The Qonto binding is verified for non-production operation; production approval remains separate. - Add or promote bindings only when the substrate decision is explicit and source-backed. diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index ddecebe..c64ab27 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-07-27" +updated: "2026-07-29" state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" --- @@ -76,7 +76,7 @@ runtime Kustomization and T02 is complete. ```task id: REEF-RAILIANCE-WP-0003-T03 -status: progress +status: done priority: high state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad" ``` @@ -90,6 +90,15 @@ passed through the cluster-local Knative service. Full failure, revocation, idempotency, timing, and rollback evidence is still required before T03 can close. +2026-07-29: The reversible `rapp-qonto/tools/verify_live.sh` gate produced +machine-readable, secret-free evidence for scale-to-zero, 7.384443-second cold +activation, repeat health, ExternalSecret readiness, fail-closed dependency +loss, recovery, missing-secret denial, secret restoration, previous-revision +rollback, and latest-traffic restoration. The `qonto-assistant` owner suite +passes 80 tests covering domain-level audit, idempotency, authorization, and +redaction behavior. The reef binding is now `verified`, not +`production-approved`. + ## T04 - Reassess production failure-domain risk ```task From 0144bfff9edb14b1fb125b5d537f80a00f621543 Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 30 Jul 2026 00:52:54 +0200 Subject: [PATCH 30/52] Record Qonto failure-domain blocker --- WORK-RECORDS.md | 2 +- ...F-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 11 ++++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e0d34be..aaf2d3b 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -10,7 +10,7 @@ | --- | --- | --- | --- | --- | | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| workplan | REEF-RAILIANCE-WP-0003 | active | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index c64ab27..a933f19 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -4,7 +4,7 @@ type: workplan title: "Complete rapp-qonto production gates" domain: financials repo: reef-railiance -status: active +status: blocked owner: codex topic_slug: railiance created: "2026-07-26" @@ -110,3 +110,12 @@ state_hub_task_id: "9d0c1f61-0ed8-4d5c-b4c2-2578424ad3b4" Production approval requires mitigation or explicit acceptance of the single-node/shared-control-plane risk after all automated workload gates pass. + +2026-07-30 reassessment: the reef still exposes exactly one Ready Kubernetes +node (`239.62.205.92.host.secureserver.net`). All workload-level gates are +green, but no node or control-plane failure domain has been added. This is a +real infrastructure availability risk, not stale task bookkeeping. The +workplan is therefore `blocked` until either a second independent failure +domain is implemented and drilled or the founder explicitly accepts +single-node production availability risk for Qonto. The current binding +remains accurately `verified`, not `production-approved`. From aa5315d650565463e070514a98e17cfd25f2d34d Mon Sep 17 00:00:00 2001 From: codex Date: Thu, 30 Jul 2026 00:56:52 +0200 Subject: [PATCH 31/52] Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Maintainer decision, 2026-07-29: adopts TRSL V1C1 as this repo's preliminary governing license, per target-revenue's workplans/TREV-WP-0008-governance-and-pilot-rollout.md T05. Full specialist legal review is deferred until out of beta (target-revenue SCOPE.md §1). No Phase is yet declared for this repo. Co-Authored-By: Claude Sonnet 5 --- LICENSE | 164 ++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 147 insertions(+), 17 deletions(-) diff --git a/LICENSE b/LICENSE index 2711464..7e08e28 100644 --- a/LICENSE +++ b/LICENSE @@ -1,21 +1,151 @@ -MIT License +# Target Revenue Source License -Copyright (c) 2026 Railiance +**Version 1.0, Candidate 1 (V1C1)** -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: +--- -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. +> **PRELIMINARY CANDIDATE — SUBJECT TO CHANGE — NOT FINAL** +> +> This repository is governed by the Target Revenue Source License +> (TRSL), Version 1, Candidate 1. This is the framework's first working +> candidate, adopted as the org's preliminary operating license across +> all repos (maintainer decision, 2026-07-29) during the build/alpha +> stage — see `SCOPE.md` §1 and Appendix A of the canonical text (link +> below) for the alpha/beta risk-acceptance decision this reflects and +> what it does and does not mean. Full specialist legal review is +> explicitly deferred until the framework moves out of beta. +> +> **Canonical source, full candidate-status banner, and Appendix A +> (non-normative candidate notes tracking every open item):** the +> `coulomb` org's `target-revenue` repository, +> `specs/TargetRevenueSourceLicense-V1C1.md` — this file is the operative +> legal text (Preamble through Section 11) only; the canonical document +> is authoritative if this copy and that document ever diverge. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. +--- + +## Preamble + +This Target Revenue Source License ("**License**") governs the Software identified in the applicable Phase Manifest. It implements the Target Revenue Framework: a defined development Phase accumulates Development Credit and Remission Credit against an immutable Initial Target until the Milestone Release automatically and irrevocably converts to a declared permissive Future License. + +Commercial beneficiaries fund the creation and early availability of a software improvement; once the declared target is satisfied, the governed release becomes permissively open source. + +## 1. Definitions + +Capitalized terms used in this License have the meanings given below. Where a term is also defined in the Phase Manifest or Target Ledger for a specific Phase, the Phase Manifest and Target Ledger govern the *values* (amounts, dates, identifiers) and this License governs the *legal effect* of those values — the two must not be read as conflicting definitions of the same concept. + +**"Commercial Entitlement"** means a right, purchased or otherwise granted under a Commercial Use Agreement, to make Commercial Use of the Software during a Phase. + +**"Commercial Use"** means billing, invoicing, or otherwise charging any customer a fee, subscription, license fee, or other consideration for or in connection with use of the Software, at any time before the Conversion Event for the applicable Phase, regardless of whether the person or organization billed would otherwise qualify for Noncommercial Use. Commercial Use occurs by virtue of such billing alone, whether or not the resulting payment is registered with the Trust Service; in particular, billing a customer for pre-conversion use of the Software without recording the corresponding payment in the applicable Phase's Target Ledger is Commercial Use without a valid Commercial Entitlement — a violation of Section 3, addressed under Section 7 and, where applicable, the Enforcement Network described in the canonical repository's `specs/EnforcementNetworkConcept.md`. + +**"Commercial Use Agreement"** means the separate agreement, referenced by the applicable Phase Manifest, under which a Commercial Entitlement is purchased or granted. This License does not itself set pricing, metering, or payment terms — those are governed by the Commercial Use Agreement. + +**"Conversion Event"** means the moment the Outstanding Target for a Phase reaches zero, as computed from the Phase Manifest and Target Ledger per the Target Ledger Specification. The Conversion Event occurs automatically and is not conditioned on any declaration, attestation, or other act by the Licensor or any Trust Service. + +**"Development Credit"** means the portion of a collected and settled payment explicitly allocated toward satisfying the Initial Target of a specific Phase, as recorded in that Phase's Target Ledger. + +**"Future License"** means the permissive license identified in the applicable Phase Manifest, being either the MIT License or the Apache License, Version 2.0, which applies to the Milestone Release upon the Conversion Event. + +**"Initial Target"** means the immutable monetary target declared for a Phase in its Phase Manifest. + +**"Licensor"** means **Binky Hedgehog GmbH**, the party that publishes the Phase Manifest and holds the rights necessary to grant this License and the Future License for the Milestone Release. + +**"Milestone Release"** means the precisely identified software release designated in the applicable Phase Manifest, identified by an immutable source revision, release artifact, or cryptographic digest. + +**"Noncommercial Use"** means use of the Software for personal purposes, private study, hobby or amateur projects; use by any charitable organization, educational institution, public research organization, or government institution acting in a non-revenue-generating capacity; or other use of a materially similar character. + +**"Outstanding Target"** means, at any time, `max(0, Initial Target − cumulative Development Credit − cumulative Remission Credit)` for a Phase, as computed from that Phase's Target Ledger. + +**"Phase"** means a bounded development undertaking governed by one Initial Target, one Milestone Release, one degeneration policy, and one Future License declaration, as declared in a Phase Manifest. + +**"Phase Manifest"** means the published, immutable declaration identifying a Phase, its Milestone Release, Initial Target, Future License, degeneration policy, and Target Ledger location, as specified in the Phase Manifest Specification. + +**"Remission Credit"** means a transparent, non-revenue reduction of a Phase's Outstanding Target, generated under that Phase's published degeneration policy and recorded in the Target Ledger. + +**"Settled Payment"** means a payment that has cleared through its payment processor and is no longer subject to reversal in the ordinary course (chargeback, dispute, or equivalent), as further specified by the applicable Commercial Use Agreement or monetization extension. + +**"Software"** means the source code, object code, and associated documentation of the Milestone Release identified in the applicable Phase Manifest. + +**"Target Ledger"** means the append-only record of Development Credit, Remission Credit, and correction entries for a Phase, as specified in the Target Ledger Specification. + +**"You"** or **"Licensee"** means the individual or entity exercising rights under this License. + +## 2. Grant of Rights for Noncommercial Use + +Subject to the terms of this License, the Licensor grants You a worldwide, royalty-free, non-exclusive license, during the applicable Phase, to: + +(a) use, reproduce, and study the Software for any Noncommercial Use; + +(b) modify the Software and create derivative works of it for any Noncommercial Use; and + +(c) redistribute the Software and Your modifications, in source or object form, for any Noncommercial Use, provided that You include this License, unmodified, with any such redistribution, and that You do not remove or alter any copyright, patent, trademark, or attribution notices contained in the Software. + +This grant does not extend to Commercial Use. Commercial Use requires a Commercial Entitlement under Section 3. + +## 3. Commercial Use + +You may not make Commercial Use of the Software during the applicable Phase unless You hold a valid, current Commercial Entitlement under a Commercial Use Agreement with the Licensor covering the applicable Phase. A Commercial Entitlement granted under one Phase's Commercial Use Agreement does not extend to a later Phase's Milestone Release unless the Commercial Use Agreement expressly says so. + +This Section 3 states the existence and boundary of the commercial-use restriction. It does not itself set pricing, invoicing, metering, audit rights, or payment terms — those are governed exclusively by the applicable Commercial Use Agreement. + +## 4. Patent License + +Subject to the terms of this License, each contributor to the Software grants You, during the applicable Phase and solely to the extent of rights granted under Sections 2 and 3, a perpetual (subject to the termination below), worldwide, non-exclusive, no-charge, royalty-free patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Software, limited to those patent claims licensable by that contributor that are necessarily infringed by their contribution(s) alone or by combination of their contribution(s) with the Software. + +If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Software or a contribution incorporated within it constitutes direct or contributory patent infringement, then any patent licenses granted to You under this Section 4 for the Software shall terminate as of the date such litigation is filed. + +## 5. Automatic Conversion to the Future License + +**5.1 Automatic effect.** Upon the Conversion Event for a Phase, the rights and restrictions in Sections 3 (Commercial Use) of this License, as they apply to that Phase's Milestone Release, terminate automatically. In their place, the Milestone Release is licensed under the Future License identified in that Phase's Phase Manifest, effective as of the Conversion Event, without any further act, declaration, or attestation required by the Licensor, any Trust Service, or any other party. + +**5.2 Irrevocability.** Once a valid Conversion Event has occurred for a Phase, no subsequent refund, chargeback, accounting correction, dispute, or termination of this License for an unrelated breach shall revoke, suspend, or otherwise impair the Future License grant for that Phase's Milestone Release. Any shortfall or dispute arising after a Conversion Event is a commercial or accounting matter between the relevant parties and does not reinstate a commercial-use restriction over already-converted Software. + +**5.3 Prior freedom preserved.** A later Phase covering subsequent improvements to the Software does not restrict, withdraw, or otherwise affect the rights granted under the Future License for an earlier Phase's already-converted Milestone Release. + +**5.4 Evidence, not cause.** A Trust Service may publish a Conversion Attestation documenting a Conversion Event. Such an attestation is evidence that the Conversion Event occurred; it is not a condition of, and its absence or delay does not postpone, the automatic effect described in Section 5.1. Any person may independently verify whether a Conversion Event has occurred directly from the Phase Manifest and Target Ledger. + +## 6. Successive Phases + +The Licensor may declare a new Phase covering subsequent improvements to the Software following a Milestone Release's Conversion Event. Each Phase is independently governed by its own Phase Manifest, Initial Target, degeneration policy, and Target Ledger. Nothing in a later Phase's Phase Manifest may be construed to reduce or withdraw rights already granted under Section 5 for an earlier Phase's Milestone Release. + +## 7. Term and Termination + +**7.1 Term.** This License applies to the Software for the duration of the applicable Phase, and, for the Milestone Release, indefinitely following that Phase's Conversion Event under the Future License. + +**7.2 Termination for breach.** If You breach Section 3 (Commercial Use) or Section 2(c) (redistribution notice requirement), the Licensor may terminate this License as to You. Before such termination becomes effective, the Licensor shall provide You written notice of the breach; if You cure the breach within thirty (30) days of that notice, this License continues in effect. A second breach of the same provision within twelve (12) months may be terminated immediately without a further cure opportunity. + +**7.3 Effect of termination.** Termination under this Section 7 affects only Your rights under Sections 2 and 3 for the Phase in which the breach occurred. It does not affect any rights already vested under Section 5 (Automatic Conversion) for a Milestone Release whose Conversion Event has already occurred, per Section 5.2. + +**7.4 Public record of breach and resolution.** The Licensor shall cause the Trust Service to publish, as part of the public record for the affected Phase, notice of: (a) any breach notice issued under Section 7.2, stating the general nature of the breach and the date of notice; (b) whether the breach was cured within the applicable cure period, and the date of cure; and (c) any termination determination made under this Section 7, including its effective date and scope. This public record exists to give the ecosystem a transparent, verifiable conformity signal for the Phase, distinct from and in addition to the Development Credit and Remission Credit facts already published under Section 5.4 and the Target Ledger Specification. + +A breach that You dispute, and that has not been finally determined, shall be recorded as **alleged**; it shall be recorded as **determined** only once the cure period has run without cure, or the dispute has been resolved against You under the applicable Commercial Use Agreement's dispute process, if any. The Trust Service shall update the record promptly upon resolution in either direction. Recording an alleged or determined breach under this Section 7.4 is a ministerial act of publishing the Licensor's determination (or a dispute process's outcome); it does not give the Trust Service discretionary authority to decide whether a breach occurred, consistent with Section 5.4's evidence-not-cause principle. + +Whether, and under what conditions, the public record identifies a Commercial Entitlement holder by name is governed exclusively by the applicable Commercial Use Agreement, which the Licensor and that Commercial Entitlement holder negotiate and agree to directly. This License does not itself set a naming default. Where no Commercial Use Agreement addresses the question, or where the affected party has no Commercial Use Agreement at all (for example, a Section 2(c) breach by a Noncommercial Use licensee), the public record states the Phase and breach category only, without naming the party. + +## 8. Disclaimer of Warranty + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. THE LICENSOR DOES NOT WARRANT THAT THE SOFTWARE WILL BE ERROR-FREE OR THAT ANY PHASE WILL REACH ITS CONVERSION EVENT. + +## 9. Limitation of Liability + +IN NO EVENT SHALL THE LICENSOR OR ANY CONTRIBUTOR BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE, EXCEPT TO THE EXTENT SUCH LIMITATION IS PROHIBITED BY APPLICABLE LAW. + +## 10. Trademarks + +This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary attribution. + +## 11. General Provisions + +**11.1 Governing law and venue.** Adopted for alpha/beta 2026-07-29: disputes arising under this License shall be resolved by binding arbitration, seated at a neutral, arbitration-mature venue (Singapore or London are the two candidates concretely supported by current research), rather than by litigation in a national court. The specific arbitral institution and substantive governing law remain a per-deployment blank pending final selection; they are not fixed by this candidate. See the canonical repository's `history/260729-TRSL-Jurisdiction-Synthesis.md` §2. + +**11.2 Severability.** If any provision of this License is held unenforceable, the remaining provisions remain in full force, and the unenforceable provision shall be reformed to the minimum extent necessary to make it enforceable. + +**11.3 No waiver.** Failure to enforce any provision of this License is not a waiver of future enforcement of that or any other provision. + +**11.4 Entire agreement (as to licensing).** This License, together with the applicable Phase Manifest and, where applicable, the Commercial Use Agreement, constitutes the entire agreement between You and the Licensor regarding the Software's licensing terms. Operations, service, and consulting arrangements are governed by separate agreements, if any, and are not part of this License. + +**11.5 Definitions control.** Marketing materials, documentation, or other non-normative communications about the Software must not describe pre-Conversion-Event Software as "Open Source," "free software," or "open core." Pre-conversion Noncommercial Use is **source-available**; pre-conversion Commercial Use requires a **Commercial Entitlement**; only post-conversion Software may be described as Open Source, under the Future License. + +--- + +**No Phase is currently declared for this repository under this License.** Until a Phase Manifest is published and registered with the Trust Service for a Milestone Release in this repository, Sections 2–7 above have no operative subject matter here — this License establishes the governing framework in advance of that declaration, consistent with the org-wide rollout decision recorded in `target-revenue`'s `workplans/TREV-WP-0008-governance-and-pilot-rollout.md`. From 4ea7798fb8cb0d195c4a247232de57268767afb5 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 8 Aug 2026 22:44:08 +0200 Subject: [PATCH 32/52] Align Qonto gate with ThreePhoenix HA --- ...AILIANCE-WP-0003-rapp-qonto-production-gates.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index a933f19..aa803a6 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -8,7 +8,7 @@ status: blocked owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-07-29" +updated: "2026-08-08" state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" --- @@ -119,3 +119,15 @@ workplan is therefore `blocked` until either a second independent failure domain is implemented and drilled or the founder explicitly accepts single-node production availability risk for Qonto. The current binding remains accurately `verified`, not `production-approved`. + +2026-08-08 alignment: live inspection still reports one Ready node, which also +owns the control-plane and etcd roles. `railiance-cluster/RAIL-BS-WP-0007` now +owns the required three-server embedded-etcd topology, source-backed +node-to-reef failure-domain map, and machine-readable one-server-loss S2 +drill. `state-hub/CUST-WP-0038` is a downstream stateful consumer and does not +substitute for the Qonto gate. After the S2 drill passes, T04 closes only when +the Qonto live verification is rerun with fresh evidence while Railiance01 is +absent, proving the service path, restricted egress, identity/secret delivery, +dependency behavior, and restoration on the surviving cluster. The alternate +closure remains explicit founder acceptance of the single-node production +availability risk. From 9ab00f0dff5e6bbb32cee10d47048bb13e4bfe63 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 15 Aug 2026 20:52:04 +0200 Subject: [PATCH 33/52] chore: narrow Qonto gates and file exposure-grant workplan WP-0003 only updates the binding. WP-0004 takes the RMASTER-WP-0023 grants. Production approval does not make Qonto public. --- ...NCE-WP-0003-rapp-qonto-production-gates.md | 18 +++++- .../REEF-RAILIANCE-WP-0004-exposure-grants.md | 58 +++++++++++++++++++ 2 files changed, 75 insertions(+), 1 deletion(-) create mode 100644 workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index aa803a6..5535665 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -8,12 +8,24 @@ status: blocked owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-08-08" +updated: "2026-08-15" +related: + - RAIL-BS-WP-0007 + - RMASTER-WP-0023 + - ADR-0006 + - ADR-0008 state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" --- # REEF-RAILIANCE-WP-0003 - rapp-qonto production gates +This reef records the `rapp-qonto` binding and refuses +`production-approved` without ADR-0006 evidence. It does not implement +HA (`RAIL-BS-WP-0007`), Knative packaging (`rapp-qonto`), or public +listeners. Production approval does not make Qonto public (ADR-0008). +New binds stay `private`. Exposure grants for already-public surfaces +are `REEF-RAILIANCE-WP-0004`, not this file. + ## T01 - Verify workload identity and secret delivery ```task @@ -131,3 +143,7 @@ absent, proving the service path, restricted egress, identity/secret delivery, dependency behavior, and restoration on the surviving cluster. The alternate closure remains explicit founder acceptance of the single-node production availability risk. + +This repo only updates `bindings/rapps.yaml` when those conditions hold. +Do not implement the three-node topology here. Do not add an exposure +grant for Qonto as a side effect of `production-approved`. diff --git a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md new file mode 100644 index 0000000..2a59969 --- /dev/null +++ b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md @@ -0,0 +1,58 @@ +--- +id: REEF-RAILIANCE-WP-0004 +type: workplan +title: "File exposure grants; keep new binds private" +domain: financials +repo: reef-railiance +status: ready +owner: codex +topic_slug: railiance +created: "2026-08-15" +updated: "2026-08-15" +related: + - RMASTER-WP-0023 + - ADR-0008 + - REEF-RAILIANCE-WP-0003 +--- + +# REEF-RAILIANCE-WP-0004 — exposure grants + +Intake from `RMASTER-WP-0023-T05`. Snapshot: +`railiance-master/docs/evidence/reef-railiance-exposure-snapshot-2026-08-15.md`. + +## Goal + +First live admission of the family rule. New binds stay `private` (or +`operator` only for a named admin path). Existing public surfaces get +named grants. Do not take down Forgejo, Coulomb Social, reuse-surface, +or Nydus. Do not re-public `6443`. Qonto stays private even if WP-0003 +later writes `production-approved`. + +## T01 — Add reef exposure grants + +```task +id: REEF-RAILIANCE-WP-0004-T01 +status: todo +priority: high +``` + +Add `exposure` to `declarations/reef.yaml` with substrate grants for the +80/443 DNS/Ingress surface and Nydus `2224`. Residual-risk owners as in +the snapshot. + +**Done when:** the declaration validates and names those surfaces. + +## T02 — Route rapp grants + +```task +id: REEF-RAILIANCE-WP-0004-T02 +status: todo +priority: medium +``` + +File or request grants on the owning declarations for +`forgejo.coulomb.social`, `app.coulomb.social`, and +`reuse.coulomb.social`. Layer repos may hold residual-risk ownership +until the rapps exist. + +**Done when:** each snapshot hostname has a grant home. From 822a20e4eaa948618707aefb9ed54169ff1dbefe Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 15 Aug 2026 20:54:18 +0200 Subject: [PATCH 34/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-08-15: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index c50679d..14b9fc4 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,30 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-07-29 21:08 UTC +**Last synced:** 2026-08-15 18:54 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams +### File exposure grants; keep new binds private +Progress: 0/2 done | workplan_id: `dff82d6f-11d5-466e-93ce-c9503ec43838` + +**Open tasks:** +- · T01 — Add reef exposure grants `52d14311` +- · T02 — Route rapp grants `02dadeaf` + ### Complete rapp-qonto production gates Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T04 - Reassess production failure-domain risk `9d0c1f61` +## Inbox Hygiene + +**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. +- ! railiance-platform: CORRECTION PROPOSAL: bound_rapps lists 1 of 3 live rapps on Railiance01 `f0f44ce0` + --- ## MCP Orientation (when available) From 43f09588a7eae821b964750b3c3ce7c1bc4e0310 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 15 Aug 2026 20:56:47 +0200 Subject: [PATCH 35/52] chore(consistency): register REEF-RAILIANCE-WP-0004 hub ids --- WORK-RECORDS.md | 3 +++ workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | 3 +++ 2 files changed, 6 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index aaf2d3b..93e1e50 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,6 +11,7 @@ | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| workplan | REEF-RAILIANCE-WP-0004 | ready | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -25,3 +26,5 @@ | task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0004-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0004-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | diff --git a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md index 2a59969..0359717 100644 --- a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md +++ b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md @@ -13,6 +13,7 @@ related: - RMASTER-WP-0023 - ADR-0008 - REEF-RAILIANCE-WP-0003 +state_hub_workstream_id: "dff82d6f-11d5-466e-93ce-c9503ec43838" --- # REEF-RAILIANCE-WP-0004 — exposure grants @@ -34,6 +35,7 @@ later writes `production-approved`. id: REEF-RAILIANCE-WP-0004-T01 status: todo priority: high +state_hub_task_id: "52d14311-b1be-4d11-aa75-86042b8ba72b" ``` Add `exposure` to `declarations/reef.yaml` with substrate grants for the @@ -48,6 +50,7 @@ the snapshot. id: REEF-RAILIANCE-WP-0004-T02 status: todo priority: medium +state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d" ``` File or request grants on the owning declarations for From b09b66330f47ac75588c1db97375f5c570e24b69 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Tue, 18 Aug 2026 11:01:43 +0200 Subject: [PATCH 36/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-08-18: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 14b9fc4..e0104b9 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,16 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-08-15 18:54 UTC +**Last synced:** 2026-08-18 09:01 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### File exposure grants; keep new binds private -Progress: 0/2 done | workplan_id: `dff82d6f-11d5-466e-93ce-c9503ec43838` +Progress: 1/2 done | workplan_id: `dff82d6f-11d5-466e-93ce-c9503ec43838` **Open tasks:** -- · T01 — Add reef exposure grants `52d14311` -- · T02 — Route rapp grants `02dadeaf` +- ► T02 — Route rapp grants `02dadeaf` ### Complete rapp-qonto production gates Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` @@ -22,8 +21,8 @@ Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` ## Inbox Hygiene -**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 2 unread message(s) lack supersession chains. +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 3 unread message(s) lack supersession chains. - ! railiance-platform: CORRECTION PROPOSAL: bound_rapps lists 1 of 3 live rapps on Railiance01 `f0f44ce0` --- From f3735a56aebb46910b891c9f32004f2b85dfeb25 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 18 Aug 2026 12:53:39 +0200 Subject: [PATCH 37/52] Admit Policy Nexus public binding --- WORK-RECORDS.md | 6 +++--- bindings/rapps.yaml | 9 +++++++++ declarations/reef.yaml | 17 +++++++++++++++-- .../REEF-RAILIANCE-WP-0004-exposure-grants.md | 18 ++++++++++++++---- 4 files changed, 41 insertions(+), 9 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 93e1e50..e7d4d67 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| workplan | REEF-RAILIANCE-WP-0004 | ready | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| workplan | REEF-RAILIANCE-WP-0004 | active | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -26,5 +26,5 @@ | task | REEF-RAILIANCE-WP-0003-T02 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| task | REEF-RAILIANCE-WP-0004-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | -| task | REEF-RAILIANCE-WP-0004-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0004-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml index 851e001..8be378e 100644 --- a/bindings/rapps.yaml +++ b/bindings/rapps.yaml @@ -6,6 +6,15 @@ bound_rapps: evidence: - ../rapp-qonto/docs/security-and-reliability-gates.md - ../rapp-qonto/evidence/live/2026-07-29-railiance01.json + - rapp_id: rapp-policy-nexus + rail_id: rail-kubernetes + readiness_state: production-approved + evidence: + - ../rapp-policy-nexus/declarations/rapp.yaml + - ../rapp-policy-nexus/docs/runtime-contract.md + - ../rapp-policy-nexus/bindings/reef-railiance.yaml + - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01.json notes: - The Qonto binding is verified for non-production operation; production approval remains separate. + - The policy-nexus binding is approved for production, but the package remains declared until its immutable image is published, deployed, and verified. - Add or promote bindings only when the substrate decision is explicit and source-backed. diff --git a/declarations/reef.yaml b/declarations/reef.yaml index 2df7741..76724ce 100644 --- a/declarations/reef.yaml +++ b/declarations/reef.yaml @@ -9,8 +9,6 @@ primary_rail: rail-kubernetes hosted_rails: - rail-kubernetes - rail-knative -bound_rapps: - - rapp-qonto current_members: - Railiance01 source_documents: @@ -24,3 +22,18 @@ compatibility_notes: - Railiance01 is the first current member of the grouped home reef. - Additional Railiance home servers should join this reef when they share the same substrate boundary. - Split the grouped reef later if member lifecycle, access, or workload-placement policy diverges. +exposure: + posture: public + grants: + - port: 80 + reason: Public HTTP ingress, ACME challenges, and HTTPS redirects for approved application hostnames + approved_on: "2026-08-15" + residual_risk_owner: railiance-infra + - port: 443 + reason: Public TLS ingress for approved application hostnames + approved_on: "2026-08-15" + residual_risk_owner: railiance-infra + - port: 2224 + reason: HostEurope Nydus provider agent required by the platform + approved_on: "2026-08-15" + residual_risk_owner: railiance-infra diff --git a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md index 0359717..83a2c43 100644 --- a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md +++ b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md @@ -4,11 +4,11 @@ type: workplan title: "File exposure grants; keep new binds private" domain: financials repo: reef-railiance -status: ready +status: active owner: codex topic_slug: railiance created: "2026-08-15" -updated: "2026-08-15" +updated: "2026-08-18" related: - RMASTER-WP-0023 - ADR-0008 @@ -33,7 +33,7 @@ later writes `production-approved`. ```task id: REEF-RAILIANCE-WP-0004-T01 -status: todo +status: done priority: high state_hub_task_id: "52d14311-b1be-4d11-aa75-86042b8ba72b" ``` @@ -44,11 +44,16 @@ the snapshot. **Done when:** the declaration validates and names those surfaces. +Completed 2026-08-18. `declarations/reef.yaml` now records the already-live +80/443 ingress surface and the Nydus 2224 exception with dated grants and +residual-risk ownership. The stale hand-maintained `bound_rapps` projection was +removed; the family validator derives it from rApp declarations. + ## T02 — Route rapp grants ```task id: REEF-RAILIANCE-WP-0004-T02 -status: todo +status: progress priority: medium state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d" ``` @@ -59,3 +64,8 @@ File or request grants on the owning declarations for until the rapps exist. **Done when:** each snapshot hostname has a grant home. + +2026-08-18: the newly approved `policy.coulomb.social` grant has a family home +in `rapp-policy-nexus`, and its production binding is recorded in +`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need +their eventual rApp/layer declaration homes, so this task remains in progress. From 060d5d1ec8e6228aa2723b68fcc7c95bdf119316 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 18 Aug 2026 15:18:44 +0200 Subject: [PATCH 38/52] Record verified policy nexus reef binding --- bindings/rapps.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml index 8be378e..3fc107a 100644 --- a/bindings/rapps.yaml +++ b/bindings/rapps.yaml @@ -14,7 +14,8 @@ bound_rapps: - ../rapp-policy-nexus/docs/runtime-contract.md - ../rapp-policy-nexus/bindings/reef-railiance.yaml - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01.json + - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01-release2-rollback.json notes: - The Qonto binding is verified for non-production operation; production approval remains separate. - - The policy-nexus binding is approved for production, but the package remains declared until its immutable image is published, deployed, and verified. + - The policy-nexus release-2 binding is deployed and verified; rollback to release 1 and forward restoration to release 2 were exercised successfully on 2026-08-18. - Add or promote bindings only when the substrate decision is explicit and source-backed. From ebbd0350f7af376b27d5cc5e1d98ee10a5cb4f96 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Fri, 21 Aug 2026 01:34:13 +0200 Subject: [PATCH 39/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-08-21: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index e0104b9..6bdd026 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,11 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-08-18 09:01 UTC +**Last synced:** 2026-08-20 23:34 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### File exposure grants; keep new binds private -Progress: 1/2 done | workplan_id: `dff82d6f-11d5-466e-93ce-c9503ec43838` - -**Open tasks:** -- ► T02 — Route rapp grants `02dadeaf` - ### Complete rapp-qonto production gates Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` @@ -21,7 +15,7 @@ Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` ## Inbox Hygiene -**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. **Missing thread_id:** 3 unread message(s) lack supersession chains. - ! railiance-platform: CORRECTION PROPOSAL: bound_rapps lists 1 of 3 live rapps on Railiance01 `f0f44ce0` From 00657c513d0dbebd055821db2baf484e69c0e621 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Fri, 21 Aug 2026 01:34:42 +0200 Subject: [PATCH 40/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-08-21: - update .custodian-brief.md for reef-railiance --- .custodian-brief.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 6bdd026..8150ff9 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -13,12 +13,6 @@ Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` **Open tasks:** - ! T04 - Reassess production failure-domain risk `9d0c1f61` -## Inbox Hygiene - -**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 3 unread message(s) lack supersession chains. -- ! railiance-platform: CORRECTION PROPOSAL: bound_rapps lists 1 of 3 live rapps on Railiance01 `f0f44ce0` - --- ## MCP Orientation (when available) From 721398125ba24bba59de0c7ac0d28327aac3afa2 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 21 Aug 2026 01:35:28 +0200 Subject: [PATCH 41/52] Finalize reef exposure grants --- WORK-RECORDS.md | 4 +- declarations/reef.yaml | 12 ++++++ .../REEF-RAILIANCE-WP-0004-exposure-grants.md | 37 +++++++++++++++---- 3 files changed, 44 insertions(+), 9 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e7d4d67..8dcd28f 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -11,7 +11,7 @@ | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | -| workplan | REEF-RAILIANCE-WP-0004 | active | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| workplan | REEF-RAILIANCE-WP-0004 | finished | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -27,4 +27,4 @@ | task | REEF-RAILIANCE-WP-0003-T03 | done | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | -| task | REEF-RAILIANCE-WP-0004-T02 | progress | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0004-T02 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | diff --git a/declarations/reef.yaml b/declarations/reef.yaml index 76724ce..86d7499 100644 --- a/declarations/reef.yaml +++ b/declarations/reef.yaml @@ -37,3 +37,15 @@ exposure: reason: HostEurope Nydus provider agent required by the platform approved_on: "2026-08-15" residual_risk_owner: railiance-infra + - hostname: forgejo.coulomb.social + reason: Canonical git forge, OCI registry, and npm registry for the estate + approved_on: "2026-08-15" + residual_risk_owner: railiance-infra + - hostname: app.coulomb.social + reason: Public Coulomb Social web application on Railiance01 + approved_on: "2026-08-15" + residual_risk_owner: railiance-apps + - hostname: reuse.coulomb.social + reason: Public federation and reuse landing surface on Railiance01 + approved_on: "2026-08-15" + residual_risk_owner: railiance-apps diff --git a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md index 83a2c43..669235e 100644 --- a/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md +++ b/workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md @@ -4,11 +4,15 @@ type: workplan title: "File exposure grants; keep new binds private" domain: financials repo: reef-railiance -status: active +status: finished owner: codex topic_slug: railiance created: "2026-08-15" -updated: "2026-08-18" +updated: "2026-08-21" +quality_dod: DoD-Ok +quality_dod_at: "2026-08-21" +quality_dod_by: codex +quality_dod_note: "Both tasks are done; declaration validation, tests, owner routing, and State Hub reconciliation passed." related: - RMASTER-WP-0023 - ADR-0008 @@ -53,7 +57,7 @@ removed; the family validator derives it from rApp declarations. ```task id: REEF-RAILIANCE-WP-0004-T02 -status: progress +status: done priority: medium state_hub_task_id: "02dadeaf-8d51-4199-9f54-5d704555b20d" ``` @@ -65,7 +69,26 @@ until the rapps exist. **Done when:** each snapshot hostname has a grant home. -2026-08-18: the newly approved `policy.coulomb.social` grant has a family home -in `rapp-policy-nexus`, and its production binding is recorded in -`bindings/rapps.yaml`. The three pre-existing snapshot hostnames still need -their eventual rApp/layer declaration homes, so this task remains in progress. +Completed 2026-08-21. The three pre-existing snapshot hostnames now have exact, +dated grants in `declarations/reef.yaml`, which is their living substrate and +public-DNS grant home while their family rApps do not yet exist. Residual-risk +ownership remains with `railiance-infra` for `forgejo.coulomb.social` and with +`railiance-apps` for `app.coulomb.social` and `reuse.coulomb.social`, matching +the source snapshot. When those workloads gain `rapp-*` declarations, each +public rApp must also carry its own binding grant before the reef-level grants +can be treated as sufficient for that family declaration. + +The handoff is routed to `railiance-infra` in State Hub message +`2438f29d-f9e0-4e58-bbbe-cd8445a7ae14` and to `railiance-apps` in message +`85f0a3c7-306c-4a58-ab3b-9c847d3b11b1`. + +The separately approved `policy.coulomb.social` grant already has its family +home in `rapp-policy-nexus`, and its production binding is recorded in +`bindings/rapps.yaml`. + +## Outcome + +Finished 2026-08-21. Every public surface in the 2026-08-15 snapshot now has a +living, source-backed grant: ports 80, 443, and 2224 plus the exact Forgejo, +Coulomb Social, and reuse hostnames. New bindings remain private by default, +and no grant was added for port 6443 or Qonto. From 3e98b10d81990c45465f3f620441d97347670b52 Mon Sep 17 00:00:00 2001 From: codex Date: Fri, 21 Aug 2026 02:01:49 +0200 Subject: [PATCH 42/52] Reconcile reef bindings and evidence --- README.md | 5 ++ SCOPE.md | 7 +- WORK-RECORDS.md | 4 + bindings/rails.yaml | 10 ++- bindings/rapps.yaml | 34 +++++++ evidence/admission/rail-knative-baseline.json | 55 +++++++++--- .../admission/rail-kubernetes-baseline.json | 34 ++++--- .../verification/rail-runtime-2026-08-21.json | 76 ++++++++++++++++ tests/test_binding_projection.py | 65 ++++++++++++++ tools/check_binding_projection.py | 86 ++++++++++++++++++ tools/collect_rail_runtime_evidence.sh | 85 ++++++++++++++++++ ...ANCE-WP-0001-bootstrap-and-wave1-import.md | 6 +- ...-knative-and-qonto-production-admission.md | 6 +- ...NCE-WP-0003-rapp-qonto-production-gates.md | 14 ++- ...005-binding-and-evidence-reconciliation.md | 90 +++++++++++++++++++ 15 files changed, 541 insertions(+), 36 deletions(-) create mode 100644 evidence/verification/rail-runtime-2026-08-21.json create mode 100644 tests/test_binding_projection.py create mode 100755 tools/check_binding_projection.py create mode 100755 tools/collect_rail_runtime_evidence.sh create mode 100644 workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md diff --git a/README.md b/README.md index 9a4d462..9f4b5ec 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,11 @@ Those concerns stay with `railiance-infra`, `railiance-cluster`, This repo now owns the wave-1 grouped home-reef boundary for Railiance. +The rail and rApp binding projections were reconciled against their owning +family declarations on 2026-08-21. Live evidence still shows one Ready member +carrying the Kubernetes control-plane and etcd roles, so the Qonto binding +remains verified and private rather than production-approved. + The retained S1 compatibility path while reef localization is still in flight is documented in `docs/retained-s1-handoff.md`. diff --git a/SCOPE.md b/SCOPE.md index 296a029..d19fdb6 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -62,10 +62,11 @@ or one-host naming into the reef model. ## Current State - Status: bootstrapped first-wave grouped reef home -- Implementation: declaration, grouped substrate files, and retained-S1 - compatibility handoff are present +- Implementation: declaration, grouped substrate files, retained-S1 + compatibility handoff, and checked rail/rApp binding projections are present - Stability: evolving, with the migration-window split now explicit -- Usage: wave-1 home reef for the Railiance server group +- Usage: wave-1 home reef for the Railiance server group; Qonto production + admission remains blocked on an independent failure domain --- diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8dcd28f..6793b31 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -12,6 +12,7 @@ | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | workplan | REEF-RAILIANCE-WP-0004 | finished | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| workplan | REEF-RAILIANCE-WP-0005 | finished | — | workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | @@ -28,3 +29,6 @@ | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0004-T01 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | task | REEF-RAILIANCE-WP-0004-T02 | done | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | +| task | REEF-RAILIANCE-WP-0005-T01 | done | — | workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md | +| task | REEF-RAILIANCE-WP-0005-T02 | done | — | workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md | +| task | REEF-RAILIANCE-WP-0005-T03 | done | — | workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md | diff --git a/bindings/rails.yaml b/bindings/rails.yaml index f158337..1e06bc4 100644 --- a/bindings/rails.yaml +++ b/bindings/rails.yaml @@ -2,16 +2,18 @@ reef_id: reef-railiance hosted_rails: - rail_id: rail-kubernetes role: primary - readiness_state: declared + readiness_state: verified contract_version: 1.0.0 evidence: - evidence/admission/rail-kubernetes-baseline.json - notes: First-wave default execution rail for the grouped Railiance home reef. + - evidence/verification/rail-runtime-2026-08-21.json + notes: First-wave default execution rail; live verification still records one Ready control-plane and etcd node. - rail_id: rail-knative role: derived - readiness_state: declared + readiness_state: verified contract_version: 1.0.0 base_rail: rail-kubernetes evidence: - evidence/admission/rail-knative-baseline.json - notes: Declared second-wave rail; not installed or production-approved. + - evidence/verification/rail-runtime-2026-08-21.json + notes: Installed and verified for private operation; production approval remains blocked by the single-node failure domain. diff --git a/bindings/rapps.yaml b/bindings/rapps.yaml index 3fc107a..bbc8877 100644 --- a/bindings/rapps.yaml +++ b/bindings/rapps.yaml @@ -1,13 +1,30 @@ reef_id: reef-railiance bound_rapps: + - rapp_id: rapp-issue-core + rail_id: rail-kubernetes + package_readiness_state: verified + readiness_state: verified + evidence: + - ../rapp-issue-core/declarations/rapp.yaml + - ../rapp-issue-core/evidence/live/2026-08-19-railiance01.json + - rapp_id: rapp-openbao + rail_id: rail-kubernetes + package_readiness_state: verified + readiness_state: verified + evidence: + - ../rapp-openbao/declarations/rapp.yaml + - ../railiance-platform/docs/rapp-openbao-boundary.md + - ../railiance-platform/docs/openbao.md - rapp_id: rapp-qonto rail_id: rail-knative + package_readiness_state: verified readiness_state: verified evidence: - ../rapp-qonto/docs/security-and-reliability-gates.md - ../rapp-qonto/evidence/live/2026-07-29-railiance01.json - rapp_id: rapp-policy-nexus rail_id: rail-kubernetes + package_readiness_state: verified readiness_state: production-approved evidence: - ../rapp-policy-nexus/declarations/rapp.yaml @@ -15,7 +32,24 @@ bound_rapps: - ../rapp-policy-nexus/bindings/reef-railiance.yaml - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01.json - ../rapp-policy-nexus/evidence/live/2026-08-18-railiance01-release2-rollback.json + - rapp_id: rapp-postgres + rail_id: rail-kubernetes + package_readiness_state: verified + readiness_state: verified + evidence: + - ../rapp-postgres/declarations/rapp.yaml + - ../rapp-postgres/docs/evidence/node-reboot-2026-08-16.md + - ../rapp-postgres/docs/evidence/backup-restore-2026-08-13.md + - rapp_id: rapp-user-engine + rail_id: rail-kubernetes + package_readiness_state: verified + readiness_state: declared + evidence: + - ../rapp-user-engine/declarations/rapp.yaml + - ../rapp-user-engine/bindings/reef-railiance.yaml notes: + - Membership is the derived projection of rApp declarations whose bound_reefs includes reef-railiance; package_readiness_state is not reef binding admission. - The Qonto binding is verified for non-production operation; production approval remains separate. - The policy-nexus release-2 binding is deployed and verified; rollback to release 1 and forward restoration to release 2 were exercised successfully on 2026-08-18. + - User Engine remains declared at the reef binding even though its package readiness is verified. - Add or promote bindings only when the substrate decision is explicit and source-backed. diff --git a/evidence/admission/rail-knative-baseline.json b/evidence/admission/rail-knative-baseline.json index 2c657a9..719acc6 100644 --- a/evidence/admission/rail-knative-baseline.json +++ b/evidence/admission/rail-knative-baseline.json @@ -3,29 +3,60 @@ "reef_id": "reef-railiance", "subject": "rail-knative", "readiness_state": "verified", - "checked_at": "2026-07-26T18:00:00Z", + "checked_at": "2026-08-20T23:55:06Z", "checks": { "compatibility": { "status": "pass", "evidence": [ "../rail-knative/declarations/rail.yaml", - "../rail-kubernetes/declarations/rail.yaml" + "../rail-kubernetes/declarations/rail.yaml", + "../verification/rail-runtime-2026-08-21.json" ], "notes": "Knative 1.22 minimum Kubernetes 1.34; observed Kubernetes 1.35.1." }, "capacity": { "status": "pass", - "evidence": ["../preflight/knative-2026-07-26-success.json"], - "notes": "Installation verification passed; 4 CPU remains below the generic 6 CPU recommendation." + "evidence": ["../verification/rail-runtime-2026-08-21.json"], + "notes": "All Knative control-plane deployments are available; 4 CPU remains below the generic 6 CPU recommendation." + }, + "ingress": { + "status": "pass", + "evidence": [ + "../verification/rail-knative-v1.22.0-2026-07-26.json", + "../verification/rail-runtime-2026-08-21.json" + ], + "notes": "Kourier remains ClusterIP-only; public exposure is disabled." + }, + "network": { + "status": "pass", + "evidence": [ + "../verification/rail-knative-v1.22.0-2026-07-26.json", + "../verification/rail-runtime-2026-08-21.json", + "../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json" + ] + }, + "identity_and_secrets": { + "status": "pass", + "evidence": ["../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json"] + }, + "observability": { + "status": "pass", + "evidence": [ + "../verification/rail-knative-v1.22.0-2026-07-26.json", + "../verification/rail-runtime-2026-08-21.json" + ], + "notes": "Control-plane availability and lifecycle observations are recorded." + }, + "recovery": { + "status": "pass", + "evidence": [ + "../verification/rail-knative-v1.22.0-2026-07-26.json", + "../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json" + ] }, - "ingress": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Kourier is verified ClusterIP-only; public exposure is disabled."}, - "network": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"]}, - "identity_and_secrets": {"status": "unknown", "evidence": []}, - "observability": {"status": "pass", "evidence": ["../verification/rail-knative-v1.22.0-2026-07-26.json"], "notes": "Control-plane availability and lifecycle observations are recorded."}, - "recovery": {"status": "unknown", "evidence": []}, "failure_domain": { "status": "fail", - "evidence": ["../preflight/knative-2026-07-26-success.json"], + "evidence": ["../verification/rail-runtime-2026-08-21.json"], "notes": "Production approval is rejected while Knative shares the single-member control plane." } }, @@ -33,8 +64,8 @@ { "risk": "Single server and shared control plane for a critical bank-connected workload", "status": "open", - "owner": "railiance-infra" - ,"decision": "Not accepted for production; verified non-production rail operation may continue." + "owner": "railiance-infra", + "decision": "Not accepted for production; verified non-production rail operation may continue." } ] } diff --git a/evidence/admission/rail-kubernetes-baseline.json b/evidence/admission/rail-kubernetes-baseline.json index d5c3bad..2fc47a4 100644 --- a/evidence/admission/rail-kubernetes-baseline.json +++ b/evidence/admission/rail-kubernetes-baseline.json @@ -2,31 +2,43 @@ "contract_version": "1.0.0", "reef_id": "reef-railiance", "subject": "rail-kubernetes", - "readiness_state": "declared", - "checked_at": "2026-07-26T00:00:00Z", + "readiness_state": "verified", + "checked_at": "2026-08-20T23:55:06Z", "checks": { "compatibility": { "status": "pass", "evidence": [ "declarations/reef.yaml", "bindings/rails.yaml", - "../rail-kubernetes/declarations/rail.yaml" + "../rail-kubernetes/declarations/rail.yaml", + "../verification/rail-runtime-2026-08-21.json" ] }, "capacity": { - "status": "unknown", - "evidence": [], - "notes": "Automated capacity and headroom probe not yet recorded." + "status": "pass", + "evidence": ["../verification/rail-runtime-2026-08-21.json"], + "notes": "The only node is Ready with 4 CPU and 16377028Ki allocatable memory; production failure-domain risk remains open." + }, + "ingress": { + "status": "pass", + "evidence": ["../verification/rail-runtime-2026-08-21.json"], + "notes": "Traefik is the observed ingress class." + }, + "network": { + "status": "pass", + "evidence": [ + "../verification/rail-runtime-2026-08-21.json", + "../../../rapp-qonto/evidence/live/2026-07-29-railiance01.json" + ], + "notes": "NetworkPolicy objects are present and the Qonto binding has workload-level restricted-egress evidence." }, - "ingress": {"status": "unknown", "evidence": []}, - "network": {"status": "unknown", "evidence": []}, "identity_and_secrets": {"status": "unknown", "evidence": []}, "observability": {"status": "unknown", "evidence": []}, "recovery": {"status": "unknown", "evidence": []}, "failure_domain": { - "status": "unknown", - "evidence": [], - "notes": "Current grouped reef has one declared member." + "status": "fail", + "evidence": ["../verification/rail-runtime-2026-08-21.json"], + "notes": "Current grouped reef has one Ready member carrying control-plane and etcd roles." } }, "residual_risks": [ diff --git a/evidence/verification/rail-runtime-2026-08-21.json b/evidence/verification/rail-runtime-2026-08-21.json new file mode 100644 index 0000000..502821e --- /dev/null +++ b/evidence/verification/rail-runtime-2026-08-21.json @@ -0,0 +1,76 @@ +{ + "schema_version": "reef-railiance.rail-runtime-evidence/v1", + "collected_at": "2026-08-20T23:55:06Z", + "collector": "reef-railiance/tools/collect_rail_runtime_evidence.sh", + "executor": "operator-ssh", + "context": "default", + "kubernetes": { + "server_version": "v1.35.1+k3s1", + "nodes": { + "total": 1, + "ready": 1, + "members": [ + { + "name": "239.62.205.92.host.secureserver.net", + "roles": ["control-plane", "etcd"], + "kubelet_version": "v1.35.1+k3s1", + "allocatable": {"cpu": "4", "memory": "16377028Ki", "pods": "110"} + } + ] + }, + "ingress_classes": ["traefik"], + "storage_classes": ["local-path"], + "network_policy_count": 79 + }, + "knative": { + "deployments": [ + { + "name": "activator", + "desired": 1, + "available": 1, + "images": ["gcr.io/knative-releases/knative.dev/serving/cmd/activator@sha256:8f7e9df2642a8ba715ebc55b62abee17b0984b6b6af0c6ec00dabaadf5f8cccb"] + }, + { + "name": "autoscaler", + "desired": 1, + "available": 1, + "images": ["gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler@sha256:ec66d97244395b57a67923d4a8c5a95f0264805f1fdb2ee0cdb49ec0f3bd7855"] + }, + { + "name": "controller", + "desired": 1, + "available": 1, + "images": ["gcr.io/knative-releases/knative.dev/serving/cmd/controller@sha256:6833f2c83e9f356c274ddb2de40e5471ad2b1c08882c9bd11f5afa240e86d574"] + }, + { + "name": "net-kourier-controller", + "desired": 1, + "available": 1, + "images": ["gcr.io/knative-releases/knative.dev/net-kourier/cmd/kourier@sha256:a2e8f568a4bf68ef6391bc3afea956d11a8698f6a22c4be50844b1da4f8bcc74"] + }, + { + "name": "webhook", + "desired": 1, + "available": 1, + "images": ["gcr.io/knative-releases/knative.dev/serving/cmd/webhook@sha256:c505888f7ee34ccadc1b9a6877d6d49691f633ea28cf8cbe03fcfa6d3afcd584"] + } + ], + "all_deployments_available": true, + "ingress": { + "implementation": "net-kourier", + "service_type": "ClusterIP", + "cluster_ip": "10.43.29.12" + }, + "services": [ + { + "namespace": "rapp-qonto", + "name": "rapp-qonto", + "latest_created_revision": "rapp-qonto-00008", + "latest_ready_revision": "rapp-qonto-00008", + "ready": true + } + ] + }, + "failure_domain": {"independent_members_observed": 1, "result": "fail-single-node"}, + "secret_values_collected": false +} diff --git a/tests/test_binding_projection.py b/tests/test_binding_projection.py new file mode 100644 index 0000000..998ca50 --- /dev/null +++ b/tests/test_binding_projection.py @@ -0,0 +1,65 @@ +import importlib.util +from pathlib import Path + +import yaml + + +MODULE = Path(__file__).parents[1] / "tools/check_binding_projection.py" +SPEC = importlib.util.spec_from_file_location("binding_projection", MODULE) +binding_projection = importlib.util.module_from_spec(SPEC) +SPEC.loader.exec_module(binding_projection) + + +def write_yaml(path: Path, value: dict) -> None: + path.parent.mkdir(parents=True, exist_ok=True) + path.write_text(yaml.safe_dump(value, sort_keys=False), encoding="utf-8") + + +def test_matching_projection_passes(tmp_path): + repo = tmp_path / "reef-example" + write_yaml( + repo / "declarations/reef.yaml", + {"reef_id": "reef-example", "hosted_rails": ["rail-kubernetes"]}, + ) + write_yaml( + repo / "bindings/rails.yaml", + {"hosted_rails": [{"rail_id": "rail-kubernetes"}]}, + ) + write_yaml( + repo / "bindings/rapps.yaml", + {"bound_rapps": [{"rapp_id": "rapp-example"}]}, + ) + write_yaml( + tmp_path / "rail-kubernetes/declarations/rail.yaml", + {"rail_id": "rail-kubernetes"}, + ) + write_yaml( + tmp_path / "rapp-example/declarations/rapp.yaml", + {"rapp_id": "rapp-example", "bound_reefs": ["reef-example"]}, + ) + + assert binding_projection.assess(repo, tmp_path) == [] + + +def test_stale_rapp_projection_fails(tmp_path): + repo = tmp_path / "reef-example" + write_yaml( + repo / "declarations/reef.yaml", + {"reef_id": "reef-example", "hosted_rails": ["rail-kubernetes"]}, + ) + write_yaml( + repo / "bindings/rails.yaml", + {"hosted_rails": [{"rail_id": "rail-kubernetes"}]}, + ) + write_yaml(repo / "bindings/rapps.yaml", {"bound_rapps": []}) + write_yaml( + tmp_path / "rail-kubernetes/declarations/rail.yaml", + {"rail_id": "rail-kubernetes"}, + ) + write_yaml( + tmp_path / "rapp-example/declarations/rapp.yaml", + {"rapp_id": "rapp-example", "bound_reefs": ["reef-example"]}, + ) + + failures = binding_projection.assess(repo, tmp_path) + assert failures and "rapp projection differs" in failures[0] diff --git a/tools/check_binding_projection.py b/tools/check_binding_projection.py new file mode 100755 index 0000000..6ba8c60 --- /dev/null +++ b/tools/check_binding_projection.py @@ -0,0 +1,86 @@ +#!/usr/bin/env python3 +"""Check reef binding files against authoritative sibling declarations.""" + +from __future__ import annotations + +import argparse +import json +from pathlib import Path + +import yaml + + +def load_yaml(path: Path) -> dict: + value = yaml.safe_load(path.read_text(encoding="utf-8")) + if not isinstance(value, dict): + raise ValueError(f"{path}: expected a YAML mapping") + return value + + +def ids(items: object, key: str) -> set[str]: + if not isinstance(items, list): + return set() + return { + item[key] + for item in items + if isinstance(item, dict) and isinstance(item.get(key), str) + } + + +def expected_rapps(parent: Path, reef_id: str) -> set[str]: + result: set[str] = set() + for declaration_path in sorted(parent.glob("rapp-*/declarations/rapp.yaml")): + declaration = load_yaml(declaration_path) + if reef_id in declaration.get("bound_reefs", []): + result.add(str(declaration["rapp_id"])) + return result + + +def expected_rails(parent: Path, declared: list[str]) -> set[str]: + result: set[str] = set() + for rail_id in declared: + declaration_path = parent / rail_id / "declarations" / "rail.yaml" + declaration = load_yaml(declaration_path) + result.add(str(declaration["rail_id"])) + return result + + +def assess(repo: Path, parent: Path) -> list[str]: + reef = load_yaml(repo / "declarations" / "reef.yaml") + reef_id = str(reef["reef_id"]) + rapp_bindings = load_yaml(repo / "bindings" / "rapps.yaml") + rail_bindings = load_yaml(repo / "bindings" / "rails.yaml") + + actual_rapps = ids(rapp_bindings.get("bound_rapps"), "rapp_id") + derived_rapps = expected_rapps(parent, reef_id) + actual_rails = ids(rail_bindings.get("hosted_rails"), "rail_id") + derived_rails = expected_rails(parent, list(reef.get("hosted_rails", []))) + + failures: list[str] = [] + if actual_rapps != derived_rapps: + failures.append( + f"rapp projection differs: binding={sorted(actual_rapps)}, " + f"derived={sorted(derived_rapps)}" + ) + if actual_rails != derived_rails: + failures.append( + f"rail projection differs: binding={sorted(actual_rails)}, " + f"declared={sorted(derived_rails)}" + ) + return failures + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--repo", type=Path, default=Path(__file__).parents[1]) + parser.add_argument("--parent", type=Path) + args = parser.parse_args() + repo = args.repo.resolve() + parent = (args.parent or repo.parent).resolve() + failures = assess(repo, parent) + print(json.dumps({"pass": not failures, "failures": failures})) + return bool(failures) + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/collect_rail_runtime_evidence.sh b/tools/collect_rail_runtime_evidence.sh new file mode 100755 index 0000000..1f3be11 --- /dev/null +++ b/tools/collect_rail_runtime_evidence.sh @@ -0,0 +1,85 @@ +#!/usr/bin/env bash +set -euo pipefail + +# Read-only, secret-free evidence collector for the rails hosted by this reef. +# The cluster API is intentionally reached through the operator SSH path; 6443 +# remains non-public. Override only when the approved executor name changes. +remote_host="${RAIL_RUNTIME_HOST:-railiance01}" + +ssh -o BatchMode=yes "$remote_host" 'bash -s' <<'REMOTE' +set -euo pipefail + +context="$(kubectl config current-context)" +server_version="$(kubectl version -o json | jq -r '.serverVersion.gitVersion')" +nodes="$(kubectl get nodes -o json)" +knative_deployments="$(kubectl -n knative-serving get deployments -o json)" +kourier_service="$(kubectl -n kourier-system get service kourier -o json)" +knative_services="$(kubectl get ksvc -A -o json)" +ingress_classes="$(kubectl get ingressclass -o json)" +storage_classes="$(kubectl get storageclass -o json)" +network_policy_count="$(kubectl get networkpolicy -A -o json | jq '.items | length')" + +jq -n \ + --arg context "$context" \ + --arg server_version "$server_version" \ + --argjson nodes "$nodes" \ + --argjson deployments "$knative_deployments" \ + --argjson kourier "$kourier_service" \ + --argjson services "$knative_services" \ + --argjson ingress_classes "$ingress_classes" \ + --argjson storage_classes "$storage_classes" \ + --argjson network_policy_count "$network_policy_count" \ + '{ + schema_version: "reef-railiance.rail-runtime-evidence/v1", + collected_at: (now | todateiso8601), + collector: "reef-railiance/tools/collect_rail_runtime_evidence.sh", + executor: "operator-ssh", + context: $context, + kubernetes: { + server_version: $server_version, + nodes: { + total: ($nodes.items | length), + ready: ([$nodes.items[] | select(any(.status.conditions[]; .type == "Ready" and .status == "True"))] | length), + members: [$nodes.items[] | { + name: .metadata.name, + roles: ([.metadata.labels | keys[] | select(startswith("node-role.kubernetes.io/")) | split("/")[1]] | sort), + kubelet_version: .status.nodeInfo.kubeletVersion, + allocatable: { + cpu: .status.allocatable.cpu, + memory: .status.allocatable.memory, + pods: .status.allocatable.pods + } + }] + }, + ingress_classes: [$ingress_classes.items[].metadata.name] | sort, + storage_classes: [$storage_classes.items[].metadata.name] | sort, + network_policy_count: $network_policy_count + }, + knative: { + deployments: [$deployments.items[] | { + name: .metadata.name, + desired: (.spec.replicas // 0), + available: (.status.availableReplicas // 0), + images: [.spec.template.spec.containers[].image] + }] | sort_by(.name), + all_deployments_available: (all($deployments.items[]; (.status.availableReplicas // 0) >= (.spec.replicas // 0))), + ingress: { + implementation: "net-kourier", + service_type: $kourier.spec.type, + cluster_ip: $kourier.spec.clusterIP + }, + services: [$services.items[] | { + namespace: .metadata.namespace, + name: .metadata.name, + latest_created_revision: .status.latestCreatedRevisionName, + latest_ready_revision: .status.latestReadyRevisionName, + ready: (any(.status.conditions[]?; .type == "Ready" and .status == "True")) + }] | sort_by(.namespace, .name) + }, + failure_domain: { + independent_members_observed: ($nodes.items | length), + result: (if ($nodes.items | length) > 1 then "requires-source-backed-review" else "fail-single-node" end) + }, + secret_values_collected: false + }' +REMOTE diff --git a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md index eb0146a..723e565 100644 --- a/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md +++ b/workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md @@ -8,7 +8,11 @@ status: finished owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-07-26" +updated: "2026-08-21" +quality_dod: DoD-Ok +quality_dod_at: "2026-08-21" +quality_dod_by: codex +quality_dod_note: "Retrospective assessment: all four tasks are done, the grouped boundary and handoff remain current, and repository checks pass." state_hub_workstream_id: "da64c718-68bf-4719-aa42-fcf26687ab23" --- diff --git a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md index e8c253d..d6aa0b5 100644 --- a/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md +++ b/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md @@ -8,7 +8,11 @@ status: finished owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-07-26" +updated: "2026-08-21" +quality_dod: DoD-Ok +quality_dod_at: "2026-08-21" +quality_dod_by: codex +quality_dod_note: "Retrospective assessment: completed and cancelled work is explicit, Qonto residual work transferred to WP-0003, and rail evidence checks pass." state_hub_workstream_id: "5b31c13e-ddc9-495f-8325-88fa770982c5" --- diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 5535665..6978fdc 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -8,9 +8,9 @@ status: blocked owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-08-15" +updated: "2026-08-21" related: - - RAIL-BS-WP-0007 + - RCLUSTER-WP-0007 - RMASTER-WP-0023 - ADR-0006 - ADR-0008 @@ -21,7 +21,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" This reef records the `rapp-qonto` binding and refuses `production-approved` without ADR-0006 evidence. It does not implement -HA (`RAIL-BS-WP-0007`), Knative packaging (`rapp-qonto`), or public +HA (`RCLUSTER-WP-0007`), Knative packaging (`rapp-qonto`), or public listeners. Production approval does not make Qonto public (ADR-0008). New binds stay `private`. Exposure grants for already-public surfaces are `REEF-RAILIANCE-WP-0004`, not this file. @@ -133,7 +133,7 @@ single-node production availability risk for Qonto. The current binding remains accurately `verified`, not `production-approved`. 2026-08-08 alignment: live inspection still reports one Ready node, which also -owns the control-plane and etcd roles. `railiance-cluster/RAIL-BS-WP-0007` now +owns the control-plane and etcd roles. `railiance-cluster/RCLUSTER-WP-0007` now owns the required three-server embedded-etcd topology, source-backed node-to-reef failure-domain map, and machine-readable one-server-loss S2 drill. `state-hub/CUST-WP-0038` is a downstream stateful consumer and does not @@ -144,6 +144,12 @@ dependency behavior, and restoration on the surviving cluster. The alternate closure remains explicit founder acceptance of the single-node production availability risk. +2026-08-21 evidence refresh: the read-only reef collector still observes one +Ready Kubernetes node carrying both control-plane and etcd roles. All five +Knative control-plane deployments and `rapp-qonto-00008` are Ready, and Kourier +remains ClusterIP-only. `RCLUSTER-WP-0007` is still backlog, so this is fresh +evidence for retaining the block, not grounds for production promotion. + This repo only updates `bindings/rapps.yaml` when those conditions hold. Do not implement the three-node topology here. Do not add an exposure grant for Qonto as a side effect of `production-approved`. diff --git a/workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md b/workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md new file mode 100644 index 0000000..c3bc77d --- /dev/null +++ b/workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md @@ -0,0 +1,90 @@ +--- +id: REEF-RAILIANCE-WP-0005 +type: workplan +title: "Reconcile reef bindings and refresh rail evidence" +domain: financials +repo: reef-railiance +status: finished +owner: codex +topic_slug: railiance +created: "2026-08-21" +updated: "2026-08-21" +quality_dod: DoD-Ok +quality_dod_at: "2026-08-21" +quality_dod_by: codex +quality_dod_note: "Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit." +related: + - REEF-RAILIANCE-WP-0002 + - REEF-RAILIANCE-WP-0003 + - ADR-0006 + - ADR-0007 +state_hub_workstream_id: "99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9" +--- + +# REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation + +## Goal + +Remove drift between the reef-local binding surfaces, family declarations, +and current secret-free runtime evidence without promoting any workload beyond +its proven reef admission state. + +## T01 — Refresh hosted-rail evidence + +```task +id: REEF-RAILIANCE-WP-0005-T01 +status: done +priority: high +state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c" +``` + +Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative +runtime evidence, and reconcile both hosted rails to `verified`. + +Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of +one nodes Ready, all five Knative control-plane deployments available, Kourier +as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or +values were read. The one-node control-plane/etcd failure-domain check remains +failed, so neither the rail nor Qonto gained production approval. + +## T02 — Reconcile the rApp binding projection + +```task +id: REEF-RAILIANCE-WP-0005-T02 +status: done +priority: high +state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa" +``` + +Project every family rApp whose declaration names `reef-railiance`, while +keeping package readiness distinct from reef binding admission. Add a check +that fails when the local relation files diverge from sibling declarations. + +Completed 2026-08-21. `bindings/rapps.yaml` now covers `rapp-issue-core`, +`rapp-openbao`, `rapp-policy-nexus`, `rapp-postgres`, `rapp-qonto`, and +`rapp-user-engine`. Only Policy Nexus is `production-approved`; Qonto remains +`verified`, and User Engine remains `declared` at the reef binding. + +## T03 — Close documentation and quality drift + +```task +id: REEF-RAILIANCE-WP-0005-T03 +status: done +priority: medium +state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1" +``` + +Correct the renamed ThreePhoenix dependency, state the current blocker in the +orientation docs, and retrospectively assess the completed WP-0001 and WP-0002 +records against the current workplan Definition of Done. + +Completed 2026-08-21. References now use `RCLUSTER-WP-0007`; the README and +scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok. + +## Outcome + +The reef-local relationship files are current and mechanically checked. Rail +evidence is fresh and secret-free. `REEF-RAILIANCE-WP-0003` remains correctly +blocked until ThreePhoenix produces independent-failure-domain evidence and +Qonto is reverified during loss of Railiance01, or the founder explicitly +accepts the single-node availability risk. From cec61daa7aad28462c0a737e2edf6ad09c5140eb Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Mon, 31 Aug 2026 13:35:05 +0200 Subject: [PATCH 43/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-08-31: - update .custodian-brief.md for reef-railiance Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c --- .custodian-brief.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 8150ff9..4b2f735 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,16 +2,16 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-08-20 23:34 UTC +**Last synced:** 2026-08-31 11:35 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Complete rapp-qonto production gates -Progress: 3/4 done | workplan_id: `c3f9fbfd-3db1-4387-8b65-7d53ba57138d` +Progress: 3/4 done | workplan_id: `8ac413ad-2f57-53e6-b586-c5bec9cfbd1f` **Open tasks:** -- ! T04 - Reassess production failure-domain risk `9d0c1f61` +- ! T04 - Reassess production failure-domain risk `9d792070` --- ## MCP Orientation (when available) From dcf51b30287de32cffe7388eed7b77ae97adf3f9 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 31 Aug 2026 14:00:19 +0200 Subject: [PATCH 44/52] migrate reef work record identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c --- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 6978fdc..a8033e0 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -14,7 +14,7 @@ related: - RMASTER-WP-0023 - ADR-0006 - ADR-0008 -state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" +state_hub_workstream_id: "8ac413ad-2f57-53e6-b586-c5bec9cfbd1f" --- # REEF-RAILIANCE-WP-0003 - rapp-qonto production gates @@ -117,7 +117,7 @@ redaction behavior. The reef binding is now `verified`, not id: REEF-RAILIANCE-WP-0003-T04 status: wait priority: high -state_hub_task_id: "9d0c1f61-0ed8-4d5c-b4c2-2578424ad3b4" +state_hub_task_id: "9d792070-5f2b-5b3d-ba52-92c8b0d4a6b8" ``` Production approval requires mitigation or explicit acceptance of the From e3c5ca2b74f6ae4f3b79f918708f3b573157a0c2 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 14 Sep 2026 15:50:48 +0200 Subject: [PATCH 45/52] Classify open workplans with flavor (CUST-WP-0072). Set flavor on open workplans from origin/prose/status. Copy existing depends_on aliases only. Do not promote residuals. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 --- workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 1 + 1 file changed, 1 insertion(+) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index a8033e0..0476d4d 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -5,6 +5,7 @@ title: "Complete rapp-qonto production gates" domain: financials repo: reef-railiance status: blocked +flavor: implementation owner: codex topic_slug: railiance created: "2026-07-26" From 68aff66d4572e34045beea378358d90d5aec3809 Mon Sep 17 00:00:00 2001 From: codex Date: Tue, 29 Sep 2026 21:25:00 +0200 Subject: [PATCH 46/52] Qualify wait tasks per Task Wait Qualifiers v0.1 (CUST-WP-0074-T05, long tail) Co-Authored-By: Claude Fable 5.1 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 237582@bnt-lap001 Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826 --- workplans/ADHOC-2026-09-12.md | 28 +++++++++++++++++++ ...NCE-WP-0003-rapp-qonto-production-gates.md | 2 ++ 2 files changed, 30 insertions(+) create mode 100644 workplans/ADHOC-2026-09-12.md diff --git a/workplans/ADHOC-2026-09-12.md b/workplans/ADHOC-2026-09-12.md new file mode 100644 index 0000000..7d1db99 --- /dev/null +++ b/workplans/ADHOC-2026-09-12.md @@ -0,0 +1,28 @@ +--- +id: REEF-RAILIANCE-WP-ADHOC-2026-09-12 +type: workplan +title: "Record the admitted demo and portal hostnames" +domain: financials +repo: reef-railiance +status: finished +owner: the-custodian +topic_slug: railiance +created: "2026-09-12" +updated: "2026-09-12" +--- + +## Record the two operator-selected application exposure grants + +```task +id: REEF-RAILIANCE-WP-ADHOC-2026-09-12-T01 +status: done +priority: medium +``` + +The operator added A records for vergabe-teilnahme.coulomb.social and +users.coulomb.social to 92.205.62.239. Authoritative and recursive DNS agree; +both exact certificates are Ready. Record hostname grants under the existing +public 80/443 substrate admission, with railiance-apps and rapp-user-engine as +application owners. No new substrate ports or firewall grants are introduced. +RAPPS-WP-0014, RAPP-USER-ENGINE-WP-0002 and VERGABE-WP-0019 retain runtime, +operator verification and product welcome/identity/recovery work. diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index 0476d4d..c6af93e 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -117,6 +117,8 @@ redaction behavior. The reef binding is now `verified`, not ```task id: REEF-RAILIANCE-WP-0003-T04 status: wait +needs_human: true +blocking_reason: "Production approval requires mitigation or explicit acceptance of the single-node/shared-control-plane risk." priority: high state_hub_task_id: "9d792070-5f2b-5b3d-ba52-92c8b0d4a6b8" ``` From 8c61953fe6bd0ed87561b3ea20b5f67ae017a17c Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Tue, 29 Sep 2026 21:42:08 +0200 Subject: [PATCH 47/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-29: - update .custodian-brief.md for reef-railiance Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 237582@bnt-lap001 Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826 --- .custodian-brief.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 4b2f735..45bae32 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-08-31 11:35 UTC +**Last synced:** 2026-09-29 19:42 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -12,6 +12,11 @@ Progress: 3/4 done | workplan_id: `8ac413ad-2f57-53e6-b586-c5bec9cfbd1f` **Open tasks:** - ! T04 - Reassess production failure-domain risk `9d792070` + *(wait: Production approval requires mitigation or explicit acceptance of the single-node/shared-control-plane risk.)* + +## Inbox Hygiene + +**Missing thread_id:** 1 unread message(s) lack supersession chains. --- ## MCP Orientation (when available) From 37e3b826e766618c40530ec038205478d8b22859 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 3 Oct 2026 03:33:22 +0200 Subject: [PATCH 48/52] CUST-WP-0075-T03: route human gates to hub decisions Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index c6af93e..d0197bf 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -9,7 +9,7 @@ flavor: implementation owner: codex topic_slug: railiance created: "2026-07-26" -updated: "2026-08-21" +updated: "2026-10-03" related: - RCLUSTER-WP-0007 - RMASTER-WP-0023 @@ -118,6 +118,7 @@ redaction behavior. The reef binding is now `verified`, not id: REEF-RAILIANCE-WP-0003-T04 status: wait needs_human: true +decision_id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd blocking_reason: "Production approval requires mitigation or explicit acceptance of the single-node/shared-control-plane risk." priority: high state_hub_task_id: "9d792070-5f2b-5b3d-ba52-92c8b0d4a6b8" @@ -156,3 +157,5 @@ evidence for retaining the block, not grounds for production promotion. This repo only updates `bindings/rapps.yaml` when those conditions hold. Do not implement the three-node topology here. Do not add an exposure grant for Qonto as a side effect of `production-approved`. + +2026-10-03: human gate routed to hub decision 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd (D5: Production risk acceptance and live-host authorizations) by CUST-WP-0075; resolving that decision raises C-40 here. From d4b33eeec6b1d9ab4a81ece9ed080e1df25e9c33 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 3 Oct 2026 03:33:35 +0200 Subject: [PATCH 49/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-10-03: - update .custodian-brief.md for reef-railiance Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- .custodian-brief.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 45bae32..44d203b 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-09-29 19:42 UTC +**Last synced:** 2026-10-03 01:33 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -16,6 +16,7 @@ Progress: 3/4 done | workplan_id: `8ac413ad-2f57-53e6-b586-c5bec9cfbd1f` ## Inbox Hygiene +**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. **Missing thread_id:** 1 unread message(s) lack supersession chains. --- From adaf9c2b74ae21fb1bbb8b7cd46a8ac073219675 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 11 Oct 2026 20:22:37 +0200 Subject: [PATCH 50/52] Record approved vergabe-teilnahme and users hostnames (adhoc 2026-09-12) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1370019@bnt-lap001 Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87 --- WORK-RECORDS.md | 2 ++ declarations/reef.yaml | 10 ++++++++++ workplans/ADHOC-2026-09-12.md | 2 ++ 3 files changed, 14 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 6793b31..e3c8fce 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,11 +8,13 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | +| workplan | REEF-RAILIANCE-WP-ADHOC-2026-09-12 | finished | — | workplans/ADHOC-2026-09-12.md | | workplan | REEF-RAILIANCE-WP-0001 | finished | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | workplan | REEF-RAILIANCE-WP-0002 | finished | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | workplan | REEF-RAILIANCE-WP-0003 | blocked | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | workplan | REEF-RAILIANCE-WP-0004 | finished | — | workplans/REEF-RAILIANCE-WP-0004-exposure-grants.md | | workplan | REEF-RAILIANCE-WP-0005 | finished | — | workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md | +| task | REEF-RAILIANCE-WP-ADHOC-2026-09-12-T01 | done | — | workplans/ADHOC-2026-09-12.md | | task | REEF-RAILIANCE-WP-0001-T01 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T02 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | | task | REEF-RAILIANCE-WP-0001-T03 | done | — | workplans/REEF-RAILIANCE-WP-0001-bootstrap-and-wave1-import.md | diff --git a/declarations/reef.yaml b/declarations/reef.yaml index 86d7499..28b4c9c 100644 --- a/declarations/reef.yaml +++ b/declarations/reef.yaml @@ -49,3 +49,13 @@ exposure: reason: Public federation and reuse landing surface on Railiance01 approved_on: "2026-08-15" residual_risk_owner: railiance-apps + - hostname: vergabe-teilnahme.coulomb.social + reason: Invited Vergabe pilot with isolated demo-company path; user selected hostname + and added DNS + approved_on: '2026-09-12' + residual_risk_owner: railiance-apps + - hostname: users.coulomb.social + reason: Canonical User Engine tenant administration and onboarding portal; user + added DNS + approved_on: '2026-09-12' + residual_risk_owner: rapp-user-engine diff --git a/workplans/ADHOC-2026-09-12.md b/workplans/ADHOC-2026-09-12.md index 7d1db99..d98f3c9 100644 --- a/workplans/ADHOC-2026-09-12.md +++ b/workplans/ADHOC-2026-09-12.md @@ -9,6 +9,7 @@ owner: the-custodian topic_slug: railiance created: "2026-09-12" updated: "2026-09-12" +state_hub_workstream_id: "2572b6c8-64c5-588d-b0df-7344c7a55582" --- ## Record the two operator-selected application exposure grants @@ -17,6 +18,7 @@ updated: "2026-09-12" id: REEF-RAILIANCE-WP-ADHOC-2026-09-12-T01 status: done priority: medium +state_hub_task_id: "d0a26193-10ed-5c73-b4a9-41c660949f16" ``` The operator added A records for vergabe-teilnahme.coulomb.social and From ffb9e272ce1489cc37cc6388873558d8ba56c239 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 11 Oct 2026 20:24:40 +0200 Subject: [PATCH 51/52] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-10-11: - update .custodian-brief.md for reef-railiance Assistant: claude-code Assistant-Model: opus Assistant-Process: 1370019@bnt-lap001 Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87 --- .custodian-brief.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 44d203b..5c750ef 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reef-railiance **Domain:** financials -**Last synced:** 2026-10-03 01:33 UTC +**Last synced:** 2026-10-11 18:24 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -16,8 +16,8 @@ Progress: 3/4 done | workplan_id: `8ac413ad-2f57-53e6-b586-c5bec9cfbd1f` ## Inbox Hygiene -**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 1 unread message(s) lack supersession chains. +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. --- ## MCP Orientation (when available) From 33b840faac109f134bf1115d631d5b1242052d9a Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 06:43:58 +0200 Subject: [PATCH 52/52] docs(reuse): establish reviewed NetKingdom security capabilities Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684 --- ...capability.railiance.substrate-bindings.md | 91 +++++++++++++++++++ registry/indexes/capabilities.yaml | 18 ++++ 2 files changed, 109 insertions(+) create mode 100644 registry/capabilities/capability.railiance.substrate-bindings.md create mode 100644 registry/indexes/capabilities.yaml diff --git a/registry/capabilities/capability.railiance.substrate-bindings.md b/registry/capabilities/capability.railiance.substrate-bindings.md new file mode 100644 index 0000000..c7d1122 --- /dev/null +++ b/registry/capabilities/capability.railiance.substrate-bindings.md @@ -0,0 +1,91 @@ +--- +id: capability.railiance.substrate-bindings +owner: reef-railiance +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Grouped home-reef identity, + topology and placement declarations. Availability describes the delivery form, + not production acceptance. Declarations are not automatic placement or authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Substrate topology and bindings +summary: Grouped home-reef identity, topology and placement declarations. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Grouped home-reef identity, topology and placement declarations + includes: + - Grouped home-reef identity, topology and placement declarations + excludes: + - Declarations are not automatic placement or authorization + use_cases: + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Declarations are not automatic placement or authorization + known_limitations: + - Declarations are not automatic placement or authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Substrate topology and bindings + +Grouped home-reef identity, topology and placement declarations. + +## Reuse boundary + +Declarations are not automatic placement or authorization. + +## Supported use cases + +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml new file mode 100644 index 0000000..ae1f1a9 --- /dev/null +++ b/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational +updated: '2026-10-14'