apiVersion: helixforge.repo-manager/v1
kind: OwnerTaskInterface
metadata:
  id: helixforge.workloads.rapp-coverage.v1
  title: Clarify universal rapp coverage for managed deployables
source:
  repo: repo-manager
  workplan_task: RMGR-WP-0010-T05
target:
  repo: railiance-master
  owner_agent: railiance-master
  suggested_work_record: owner-selected Railiance Master schema workplan task
approval:
  dispositions: [approved, amended, rejected]
  record_in: Railiance Master file-backed workplan task or decision
task:
  title: Clarify universal rapp coverage for managed deployables
  priority: high
  objective: >-
    Make the normative rapp contract explicit that every managed running
    deployable, including operational and tooling workloads participating in
    controls, belongs to exactly one rapp.
  inputs:
    - ref: railiance-master/docs/adr/ADR-0007-rapp-declaration-contract.md
      authority: railiance-master
    - ref: repo-manager/docs/adr-004-authoritative-workload-declarations.md
      authority: repo-manager boundary ruling
  deliverables:
    - >-
      Amend or clarify ADR-0007 and the rapp authoring guide with universal
      managed-deployable coverage.
    - >-
      State that a pre-rapp running deployable is migration debt and remains
      unknown to workload controls until declared.
    - >-
      Preserve native identity for human access, credential patterns, broker
      actions, one-shot operations, and infrastructure resources that are not workloads.
    - Keep Railiance Master as the sole owner of the normative rapp schema vocabulary.
  constraints:
    - Do not create a parallel generic workload declaration surface.
    - Do not require one rapp per process when deployables share rollout and rollback fate.
    - Do not turn non-workload operational subjects into fake workloads.
  acceptance:
    - Normative documentation answers whether operational and tooling deployables require rapps.
    - The exactly-one-rapp invariant remains explicit and schema-compatible.
    - Migration debt and not-applicable subjects are distinguishable.
    - Existing valid rapp declarations continue to validate.
  verification:
    - tools/validate-family-declarations.py --repo /home/worsch/rapp-issue-core
    - tools/validate-family-declarations.py --repo /home/worsch/rapp-qonto