90 lines
3.1 KiB
Markdown
90 lines
3.1 KiB
Markdown
---
|
|
id: REEF-RAILIANCE-WP-0005
|
|
type: workplan
|
|
title: "Reconcile reef bindings and refresh rail evidence"
|
|
domain: financials
|
|
repo: reef-railiance
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-21"
|
|
updated: "2026-08-21"
|
|
quality_dod: DoD-Ok
|
|
quality_dod_at: "2026-08-21"
|
|
quality_dod_by: codex
|
|
quality_dod_note: "Binding projections match family declarations, live rail evidence is fresh, tests pass, and the Qonto production block remains explicit."
|
|
related:
|
|
- REEF-RAILIANCE-WP-0002
|
|
- REEF-RAILIANCE-WP-0003
|
|
- ADR-0006
|
|
- ADR-0007
|
|
state_hub_workstream_id: "99e8e93b-99a0-4ef6-91d7-e4f155fa7ee9"
|
|
---
|
|
|
|
# REEF-RAILIANCE-WP-0005 — binding and evidence reconciliation
|
|
|
|
## Goal
|
|
|
|
Remove drift between the reef-local binding surfaces, family declarations,
|
|
and current secret-free runtime evidence without promoting any workload beyond
|
|
its proven reef admission state.
|
|
|
|
## T01 — Refresh hosted-rail evidence
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0005-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "bebf85e7-db0a-41f1-9ad3-a7e184a6249c"
|
|
```
|
|
|
|
Add a repeatable operator-SSH collector, capture fresh Kubernetes and Knative
|
|
runtime evidence, and reconcile both hosted rails to `verified`.
|
|
|
|
Completed 2026-08-21. The collector observed Kubernetes v1.35.1+k3s1, one of
|
|
one nodes Ready, all five Knative control-plane deployments available, Kourier
|
|
as ClusterIP, and the Qonto Knative Service Ready. No Secret resources or
|
|
values were read. The one-node control-plane/etcd failure-domain check remains
|
|
failed, so neither the rail nor Qonto gained production approval.
|
|
|
|
## T02 — Reconcile the rApp binding projection
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0005-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "88fb7abe-6b85-4cae-bd0b-d6d7c4a5deaa"
|
|
```
|
|
|
|
Project every family rApp whose declaration names `reef-railiance`, while
|
|
keeping package readiness distinct from reef binding admission. Add a check
|
|
that fails when the local relation files diverge from sibling declarations.
|
|
|
|
Completed 2026-08-21. `bindings/rapps.yaml` now covers `rapp-issue-core`,
|
|
`rapp-openbao`, `rapp-policy-nexus`, `rapp-postgres`, `rapp-qonto`, and
|
|
`rapp-user-engine`. Only Policy Nexus is `production-approved`; Qonto remains
|
|
`verified`, and User Engine remains `declared` at the reef binding.
|
|
|
|
## T03 — Close documentation and quality drift
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0005-T03
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "923647a0-1010-4023-8f2f-9e69c9f0b8e1"
|
|
```
|
|
|
|
Correct the renamed ThreePhoenix dependency, state the current blocker in the
|
|
orientation docs, and retrospectively assess the completed WP-0001 and WP-0002
|
|
records against the current workplan Definition of Done.
|
|
|
|
Completed 2026-08-21. References now use `RCLUSTER-WP-0007`; the README and
|
|
scope state the fresh single-node result; WP-0001 and WP-0002 are DoD-Ok.
|
|
|
|
## Outcome
|
|
|
|
The reef-local relationship files are current and mechanically checked. Rail
|
|
evidence is fresh and secret-free. `REEF-RAILIANCE-WP-0003` remains correctly
|
|
blocked until ThreePhoenix produces independent-failure-domain evidence and
|
|
Qonto is reverified during loss of Railiance01, or the founder explicitly
|
|
accepts the single-node availability risk.
|