reef-railiance/workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
REEF-RAILIANCE-WP-0002	workplan	Admit rail-knative and rapp-qonto with production evidence	financials	reef-railiance	active	codex	railiance	2026-07-26	2026-07-26	5b31c13e-ddc9-495f-8325-88fa770982c5

REEF-RAILIANCE-WP-0002 - Knative and Qonto production admission

Goal

Host a derived rail-knative slice while keeping rail-kubernetes primary, and bind rapp-qonto only through explicit readiness evidence.

T01 - Publish the admission schema and baseline

id: REEF-RAILIANCE-WP-0002-T01
status: done
priority: high
state_hub_task_id: "a20cc59f-bb93-4d1b-bf46-0d67c2270b98"

Add declared, installed, verified, production-approved, and deprecated states plus source-linked evidence requirements.

2026-07-26: Added the admission schema and a baseline record for the existing Kubernetes rail. The baseline intentionally records unresolved capacity, recovery, and failure-domain evidence rather than inferring it from topology.

T02 - Collect the Knative substrate baseline

id: REEF-RAILIANCE-WP-0002-T02
status: done
priority: high
state_hub_task_id: "833f6246-23bc-43ac-802d-7595b18f77a2"

Collect Kubernetes version, capacity/headroom, ingress, DNS/TLS, network, identity/secret delivery, observability, backup/restore, and maintenance evidence before installation.

2026-07-26: The first read-only probe reached the configured context but the API endpoint timed out. Recorded machine-readable failure evidence and kept installation blocked. railiance-cluster now owns a reusable preflight probe and the access/install workplan.

2026-07-26: Server-side preflight passed after the upgrade. Kubernetes is v1.35.1 and the Ready node has 4 CPU/16 GiB. The below-recommendation CPU count and single-node topology remain explicit production risks.

T03 - Install and verify the derived rail

id: REEF-RAILIANCE-WP-0002-T03
status: done
priority: high
state_hub_task_id: "ff070df6-8ffa-40e6-bbaa-2dcff20f64f2"

Install only after the baseline matches the derived rail prerequisites. Record versioned smoke and rollback evidence.

Blocked by failed API reachability preflight; no install was attempted.

2026-07-26: Installed and verified checksum-locked Serving and Kourier v1.22.0. Scale-to-zero, cold activation, revision creation, private routing, and previous-revision rollback passed. Public exposure remains disabled.

T04 - Bind and verify rapp-qonto

id: REEF-RAILIANCE-WP-0002-T04
status: progress
priority: high
state_hub_task_id: "485e757b-6519-4f2e-a678-d66ef14206f5"

Add the binding at declared, then promote it only from machine-readable identity, egress, cold-start, audit, revocation, rollback, and dependency failure evidence.

2026-07-26: Added topology-only declared bindings for rail-knative and rapp-qonto. Baseline evidence keeps unmeasured runtime checks unknown; no installed, verified, or production-approved state is claimed.

T05 - Decide production residual risk

id: REEF-RAILIANCE-WP-0002-T05
status: wait
priority: high
state_hub_task_id: "f1ac627d-1ec8-445b-acd9-a65eeb068d3c"

Reserve human interaction for explicit acceptance or mitigation of the single-server/shared-control-plane failure domain. Automated evidence must be complete first.

T06 - Automate evidence freshness and drift

id: REEF-RAILIANCE-WP-0002-T06
status: todo
priority: medium
state_hub_task_id: "82685f27-575e-4956-8c46-433a2ab2b9ea"

Make probes idempotent and suitable for scheduled reconciliation. Expired or failed evidence must prevent false production-ready state.