---
id: REEF-RAILIANCE-WP-0005
type: workplan
title: "Reconcile reef bindings and refresh rail evidence"
domain: financials
repo: reef-railiance
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-21"
updated: "2026-08-21"
quality_dod: DoD-Ok
quality_dod_at: "2026-08-21"
quality_dod_by: codex
quality_dod_note: "Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit."
related:
  - REEF-RAILIANCE-WP-0002
  - REEF-RAILIANCE-WP-0003
  - ADR-0006
  - ADR-0007
state_hub_workstream_id: "99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9"
---

# REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation

## Goal

Remove drift between the reef-local binding surfaces, family declarations,
and current secret-free runtime evidence without promoting any workload beyond
its proven reef admission state.

## T01 — Refresh hosted-rail evidence

```task
id: REEF-RAILIANCE-WP-0005-T01
status: done
priority: high
state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c"
```

Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative
runtime evidence, and reconcile both hosted rails to `verified`.

Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of
one nodes Ready, all five Knative control-plane deployments available, Kourier
as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or
values were read. The one-node control-plane/etcd failure-domain check remains
failed, so neither the rail nor Qonto gained production approval.

## T02 — Reconcile the rApp binding projection

```task
id: REEF-RAILIANCE-WP-0005-T02
status: done
priority: high
state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa"
```

Project every family rApp whose declaration names `reef-railiance`, while
keeping package readiness distinct from reef binding admission. Add a check
that fails when the local relation files diverge from sibling declarations.

Completed 2026-08-21. `bindings/rapps.yaml` now covers `rapp-issue-core`,
`rapp-openbao`, `rapp-policy-nexus`, `rapp-postgres`, `rapp-qonto`, and
`rapp-user-engine`. Only Policy Nexus is `production-approved`; Qonto remains
`verified`, and User Engine remains `declared` at the reef binding.

## T03 — Close documentation and quality drift

```task
id: REEF-RAILIANCE-WP-0005-T03
status: done
priority: medium
state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1"
```

Correct the renamed ThreePhoenix dependency, state the current blocker in the
orientation docs, and retrospectively assess the completed WP-0001 and WP-0002
records against the current workplan Definition of Done.

Completed 2026-08-21. References now use `RCLUSTER-WP-0007`; the README and
scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok.

## Outcome

The reef-local relationship files are current and mechanically checked. Rail
evidence is fresh and secret-free. `REEF-RAILIANCE-WP-0003` remains correctly
blocked until ThreePhoenix produces independent-failure-domain evidence and
Qonto is reverified during loss of Railiance01, or the founder explicitly
accepts the single-node availability risk.