coulomb/repo-manager
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
repo-manager/workplans/RMGR-WP-0006-railiance-app-wrapper-setup.md
codex c3f4ece7ea fix(workplans): adopt ADR-007 derived identifiers for unregistered records 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 20:21:52 +02:00

4.9 KiB
Raw Permalink Blame History

id type title domain repo status owner topic_slug created updated parent_project related state_hub_workstream_id
RMGR-WP-0006 workplan Railiance managed-app wrapper setup infotech repo-manager finished grok infotech 2026-08-18 2026-08-18 prj-state-hub-retirement
RMGR-WP-0004
b177cdd5-6169-5888-8160-fa4b5e38bd68

Railiance managed-app wrapper setup

Goal

Give Repo Manager a governed path to set up rapp-<app> repositories so ordinary applications (starting with user-engine) can run on Railiance as managed workloads: declared, packaged, bound to a rail and reef, and operable without copying charts into railiance-apps.

This specializes RMGR-WP-0004 scaffolding for the rapp-* family. It does not move family schemas out of railiance-master, and it does not operate the cluster.

Practice and remaining work are structured in docs/RailianceAppDeploymentGuide.md.

Record the wrapper best-practice guide

id: RMGR-WP-0006-T01
status: done
priority: high
state_hub_task_id: "8df39852-ceaf-5e00-a845-2626c7add3b7"

Survey live rails (rail-kubernetes, rail-knative), reefs (reef-railiance, reef-storage), existing rapps, and the user-engine / rapp-user-engine pair. Write docs/RailianceAppDeploymentGuide.md as the best-practice shape and the work breakdown for later scaffolder phases.

Result (2026-08-18): guide written. Pilot target is rapp-user-engine (empty stub). Copy targets are rapp-policy-nexus and rapp-openbao, not drifted rapp-qonto.

Bootstrap the user-engine wrapper to declared

id: RMGR-WP-0006-T02
status: done
priority: high
state_hub_task_id: "04c17e28-604e-5e20-976c-88783cdccff2"

Fill rapp-user-engine with the bootstrap baseline and a schema-valid declarations/rapp.yaml at readiness_state: declared (or draft if image/consumer pins are still missing). Follow the worked example in the guide. Validate with railiance-master/tools/validate-family-declarations.py --root ...

Do not place the rapp (bound_reefs stays empty) and do not set public exposure.

Result (2026-08-18): rapp-user-engine has the bootstrap set and a schema-valid declarations/rapp.yaml at declared. Isolated family validation: 4 declaration(s) ok.

Generate the Kubernetes package skeleton

id: RMGR-WP-0006-T03
status: done
priority: high
state_hub_task_id: "fd7a8425-0661-5d38-b078-da61b7eda3c3"

Absorb net-kingdom/sso-mfa/k8s/user-engine/ into rapp-user-engine/manifests/ (or a Helm chart only if a rewrite is justified separately). Add Makefile server-dry-run / deploy / verify-live / rollback DIGEST=… and a runtime-contract doc. Leave a pointer in NetKingdom so there is one apply path.

make server-dry-run must pass. No production apply in this task. Package type is manifest-managed-platform-service unless the rewrite to Helm is an explicit later decision.

Result (2026-08-18): manifests absorbed, Makefile render|server-dry-run|deploy|verify-live|rollback added, NetKingdom README points here. make server-dry-run passes. Restore-drill is a separate target so completed Jobs are not reapplied.

Draft platform handoffs

id: RMGR-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "0b889136-195a-53ca-8409-24dd2215a67d"

Draft the rapp-postgres consumer and secret-reference list for user-engine. Apply them only in the owning repos (rapp-postgres, railiance-platform) after those owners accept the draft. This repo records the request; it does not become the credential home.

Result (2026-08-18): docs/platform-handoffs.md keeps the dedicated user-engine-pg Cluster and lists OpenBao/delivery/flex-auth references. No postgres consumer file is added.

Implement rmgr rapp scaffolding

id: RMGR-WP-0006-T05
status: done
priority: high
state_hub_task_id: "3ee67dd8-7a39-55be-80aa-e50fa5cc1b99"

Turn P1–P4 from the guide into Repo Manager commands (rapp init, rapp skeleton, rapp validate) that are idempotent, secret-free, and refuse to invent rails, reefs, or package types. Pilot by regenerating the user-engine wrapper (or the next engine stub) without hand-editing the baseline files.

Depends on the shape proven in T02–T03 and on RMGR-WP-0004 scaffolding ownership.

Result (2026-08-18): rmgr rapp init|validate|pin-image added. init refuses a rapp- workload name and refuses to overwrite an existing declaration. validate runs the family validator against an isolated sibling root so undeclared engine stubs do not fail the check.

Residuals

  • rapp-secrets-engine and rapp-tenant-engine remain undeclared stubs; wrap them only after the user-engine path validates.
  • rapp-vergabe-teilnahme extraction stays a railiance-apps residual (ADR-0003). This workplan does not close that item.
  • Schema enum helm-managed-application would be a railiance-master change if the platform-service name proves misleading.