repo-manager/workplans/RMGR-WP-0006-railiance-app-wrapper-setup.md

---
id: RMGR-WP-0006
type: workplan
title: "Railiance managed-app wrapper setup"
domain: infotech
repo: repo-manager
status: finished
owner: grok
topic_slug: infotech
created: "2026-08-18"
updated: "2026-08-18"
parent_project: prj-state-hub-retirement
related:
  - RMGR-WP-0004
state_hub_workstream_id: "b177cdd5-6169-5888-8160-fa4b5e38bd68"
---

# Railiance managed-app wrapper setup

## Goal

Give Repo Manager a governed path to set up `rapp-<app>` repositories so
ordinary applications (starting with `user-engine`) can run on Railiance
as managed workloads: declared, packaged, bound to a rail and reef, and
operable without copying charts into `railiance-apps`.

This specializes `RMGR-WP-0004` scaffolding for the `rapp-*` family. It
does not move family schemas out of `railiance-master`, and it does not
operate the cluster.

Practice and remaining work are structured in
[`docs/RailianceAppDeploymentGuide.md`](../docs/RailianceAppDeploymentGuide.md).

## Record the wrapper best-practice guide

```task
id: RMGR-WP-0006-T01
status: done
priority: high
state_hub_task_id: "8df39852-ceaf-5e00-a845-2626c7add3b7"
```

Survey live rails (`rail-kubernetes`, `rail-knative`), reefs
(`reef-railiance`, `reef-storage`), existing rapps, and the `user-engine`
/ `rapp-user-engine` pair. Write
`docs/RailianceAppDeploymentGuide.md` as the best-practice shape and the
work breakdown for later scaffolder phases.

**Result (2026-08-18):** guide written. Pilot target is
`rapp-user-engine` (empty stub). Copy targets are `rapp-policy-nexus` and
`rapp-openbao`, not drifted `rapp-qonto`.

## Bootstrap the user-engine wrapper to `declared`

```task
id: RMGR-WP-0006-T02
status: done
priority: high
state_hub_task_id: "04c17e28-604e-5e20-976c-88783cdccff2"
```

Fill `rapp-user-engine` with the bootstrap baseline and a schema-valid
`declarations/rapp.yaml` at `readiness_state: declared` (or `draft` if
image/consumer pins are still missing). Follow the worked example in the
guide. Validate with
`railiance-master/tools/validate-family-declarations.py --root ..`.

Do not place the rapp (`bound_reefs` stays empty) and do not set public
exposure.

**Result (2026-08-18):** `rapp-user-engine` has the bootstrap set and a
schema-valid `declarations/rapp.yaml` at `declared`. Isolated family
validation: `4 declaration(s) ok`.

## Generate the Kubernetes package skeleton

```task
id: RMGR-WP-0006-T03
status: done
priority: high
state_hub_task_id: "fd7a8425-0661-5d38-b078-da61b7eda3c3"
```

Absorb `net-kingdom/sso-mfa/k8s/user-engine/` into
`rapp-user-engine/manifests/` (or a Helm chart only if a rewrite is
justified separately). Add Makefile `server-dry-run` / `deploy` /
`verify-live` / `rollback DIGEST=…` and a runtime-contract doc. Leave a
pointer in NetKingdom so there is one apply path.

`make server-dry-run` must pass. No production apply in this task.
Package type is `manifest-managed-platform-service` unless the rewrite
to Helm is an explicit later decision.

**Result (2026-08-18):** manifests absorbed, Makefile
`render|server-dry-run|deploy|verify-live|rollback` added, NetKingdom
README points here. `make server-dry-run` passes. Restore-drill is a
separate target so completed Jobs are not reapplied.

## Draft platform handoffs

```task
id: RMGR-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "0b889136-195a-53ca-8409-24dd2215a67d"
```

Draft the `rapp-postgres` consumer and secret-reference list for
user-engine. Apply them only in the owning repos (`rapp-postgres`,
`railiance-platform`) after those owners accept the draft. This repo
records the request; it does not become the credential home.

**Result (2026-08-18):** `docs/platform-handoffs.md` keeps the dedicated
`user-engine-pg` Cluster and lists OpenBao/delivery/flex-auth
references. No postgres consumer file is added.

## Implement `rmgr rapp` scaffolding

```task
id: RMGR-WP-0006-T05
status: done
priority: high
state_hub_task_id: "3ee67dd8-7a39-55be-80aa-e50fa5cc1b99"
```

Turn P1–P4 from the guide into Repo Manager commands (`rapp init`,
`rapp skeleton`, `rapp validate`) that are idempotent, secret-free, and
refuse to invent rails, reefs, or package types. Pilot by regenerating
the user-engine wrapper (or the next engine stub) without hand-editing
the baseline files.

Depends on the shape proven in T02–T03 and on `RMGR-WP-0004` scaffolding
ownership.

**Result (2026-08-18):** `rmgr rapp init|validate|pin-image` added.
`init` refuses a `rapp-` workload name and refuses to overwrite an
existing declaration. `validate` runs the family validator against an
isolated sibling root so undeclared engine stubs do not fail the check.

## Residuals

- `rapp-secrets-engine` and `rapp-tenant-engine` remain undeclared stubs;
  wrap them only after the user-engine path validates.
- `rapp-vergabe-teilnahme` extraction stays a `railiance-apps` residual
  (ADR-0003). This workplan does not close that item.
- Schema enum `helm-managed-application` would be a `railiance-master`
  change if the platform-service name proves misleading.