reef-railiance/workplans/REEF-RAILIANCE-WP-0005-binding-and-evidence-reconciliation.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	quality_dod	quality_dod_at	quality_dod_by	quality_dod_note	related	state_hub_workstream_id
REEF-RAILIANCE-WP-0005	workplan	Reconcile reef bindings and refresh rail evidence	financials	reef-railiance	finished	codex	railiance	2026-08-21	2026-08-21	DoD-Ok	2026-08-21	codex	Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit.	REEF-RAILIANCE-WP-0002 REEF-RAILIANCE-WP-0003 ADR-0006 ADR-0007	99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9

REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation

Goal

Remove drift between the reef-local binding surfaces, family declarations, and current secret-free runtime evidence without promoting any workload beyond its proven reef admission state.

T01 — Refresh hosted-rail evidence

id: REEF-RAILIANCE-WP-0005-T01
status: done
priority: high
state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c"

Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative runtime evidence, and reconcile both hosted rails to verified.

Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of one nodes Ready, all five Knative control-plane deployments available, Kourier as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or values were read. The one-node control-plane/etcd failure-domain check remains failed, so neither the rail nor Qonto gained production approval.

T02 — Reconcile the rApp binding projection

id: REEF-RAILIANCE-WP-0005-T02
status: done
priority: high
state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa"

Project every family rApp whose declaration names reef-railiance, while keeping package readiness distinct from reef binding admission. Add a check that fails when the local relation files diverge from sibling declarations.

Completed 2026-08-21. bindings/rapps.yaml now covers rapp-issue-core, rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-qonto, and rapp-user-engine. Only Policy Nexus is production-approved; Qonto remains verified, and User Engine remains declared at the reef binding.

T03 — Close documentation and quality drift

id: REEF-RAILIANCE-WP-0005-T03
status: done
priority: medium
state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1"

Correct the renamed ThreePhoenix dependency, state the current blocker in the orientation docs, and retrospectively assess the completed WP-0001 and WP-0002 records against the current workplan Definition of Done.

Completed 2026-08-21. References now use RCLUSTER-WP-0007; the README and scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok.

Outcome

The reef-local relationship files are current and mechanically checked. Rail evidence is fresh and secret-free. REEF-RAILIANCE-WP-0003 remains correctly blocked until ThreePhoenix produces independent-failure-domain evidence and Qonto is reverified during loss of Railiance01, or the founder explicitly accepts the single-node availability risk.