runbook-tutorials/workplans/RBT-WP-0009-finalize-the-runbook-tutorials-workplans.md

---
id: RBT-WP-0009
type: workplan
title: "Finalize the runbook-tutorials workplans"
domain: infotech
repo: runbook-tutorials
status: finished
flavor: implementation
owner: claude
topic_slug: stack
created: "2026-09-29"
updated: "2026-09-29"
depends_on: [RBT-WP-0002, RBT-WP-0004, RBT-WP-0005, RBT-WP-0007, RBT-WP-0008]
state_hub_workstream_id: "53103733-880f-58cc-a330-4b86375b20ad"
---

## Goal

Close every runbook-tutorials workplan before new functionality is introduced. "Closed" means finished, or moved to
`backlog` with the open decisions written down. Agreed with Bernd on 2026-09-29: the definition of done is *all workplans closed*
(no formal freeze ceremony; a security and code review remains an optional follow-up).

Decisions taken with the plan: keep old packs that still carry `exercise_status` loadable (ignored, deprecated); keep the
NetKingdom security bootstrap console as a permanent legacy pack; port the three NetKingdom packs to v0.2; move terminal mode to the
backlog and do only a small JSON export.

## Retire exercise_status

```task
id: RBT-WP-0009-T01
status: done
priority: high
state_hub_task_id: "298ba5c8-cd8c-5d0c-afdc-cd2c41b67774"
```

Done 2026-09-29. `exercise_status` mixed three things (RBT-WP-0008). Maturity, derived from run history, replaces it. Remove the "Record pack as
exercised" click and `apply_exercise` / `exercise_update`; drop the field from the shipped packs (both repositories) and from the UI
headers; make it optional and deprecated in both schemas so old packs still load; show maturity where the status was shown.
Also found and fixed while doing it: the CLI had no tests, and `rtut list` crashed from a shadowed import; `tests/test_cli.py` now covers it.

## Packaging, checks and CI

```task
id: RBT-WP-0009-T02
status: done
priority: high
state_hub_task_id: "14b17a9b-c3a3-5291-9328-e90c99caea49"
```

Done 2026-09-29. Declare the dependencies (`pyproject.toml`: PyYAML, jsonschema, pytest) so a fresh checkout can run; add `rtut check` (packs, attribute
sets, projects and templates in one go) and `make check`; replace the copied smoke-only CI with a job that runs the tests and the checks.
Also: the JSON schemas moved into the package (`rtut/schema/`) so a plain `pip install .` works (verified); `rtut check` validates packs, attribute
sets, projects and templates; `.forgejo/workflows/tests.yaml` runs tests and checks in a python:3.12 container. **The CI job has not run on a real
runner** (no way to trigger one from here); check its first execution.

## Documents and bookkeeping

```task
id: RBT-WP-0009-T03
status: done
priority: medium
state_hub_task_id: "fec1fc82-c686-524f-861f-ba0881f9408b"
```

Done 2026-09-29. Refresh `SCOPE.md` (it still says "bootstrap"), add a `docs/README.md` index, note in the specs that v0.1 and v0.2 changes from here on
become a new version, update the capability entry, and make the workplan statuses true (RBT-WP-0007 finished, RBT-WP-0002-T07 done,
RBT-WP-0006 and NK-WP-0011 to backlog).

## Evidence export

```task
id: RBT-WP-0009-T04
status: done
priority: medium
state_hub_task_id: "f6f2e2b2-7872-5565-9960-609a790b5356"
```

Done 2026-09-29, closing RBT-WP-0004-T04: a closed run's (and project run's) record can be downloaded as JSON from its page; an open run is
refused (409). Added `rtut seal <file>` so an exported record can be verified anywhere.

## Console mapping: is v0.2 expressive enough

```task
id: RBT-WP-0009-T05
status: done
priority: high
state_hub_task_id: "d90789fc-0497-5caa-979e-53289d20afc4"
```

Done 2026-09-29. Verdict: the structure maps, the behaviour does not fully; seven gaps (G1 to G7) are the v0.3 candidates. `docs/console-mapping.md`: map the security bootstrap console's 6 stages, 14 gates, roles, subsystems, integrations, 12 artefacts
and 7 runbooks onto v0.2 and say honestly where a special case is needed. This is the acceptance evidence for the model. It closes
RBT-WP-0005-T03, records the decision to keep the console as a permanent legacy pack (T05), and moves the extraction (T04) to the backlog.

## Port the NetKingdom packs to v0.2

```task
id: RBT-WP-0009-T06
status: done
priority: high
state_hub_task_id: "ca96aae8-bac5-5170-971f-d4b06e1ff252"
```

Done 2026-09-29 (net-kingdom commit 90112f3). `nk.ssh-certificates`, `nk.openbao-operating-path` and `nk.protected-system-flex-auth` become v0.2 packs with actors, datapoints,
stages, gates, idempotency and framing, so the real content uses the model and exercise evidence attaches to the format that stays.
Closes RBT-WP-0002-T06 and updates NK-WP-0044.
All three validate as v0.2; the 13 checks that need no cluster were re-run through the engine and pass; the OpenBao pack's optional record step is an
alternatives choice recommended by a datapoint; live flex-auth steps are manual-only for auto-confirm. The attended run against the cluster is
Bernd's (NK-WP-0044-T05).

## Close the workplans

```task
id: RBT-WP-0009-T07
status: done
priority: high
state_hub_task_id: "32408947-03bc-58cb-b57b-cb2ee097a3bc"
```

Done 2026-09-29. Set every status to what is true, move terminal mode and the evidence work that is not done to the backlog with the decisions written
down, archive the finished workplans, sync State Hub, and record a progress event. Work that needs Bernd's own environment
(NK-WP-0044-T05 attended runs, NK-WP-0009 T03-T05, the external STS issuer for T02) stays in net-kingdom and is named there.

## Acceptance Criteria

- No runbook-tutorials workplan is `active` with open `todo` work: each is `finished` or `backlog` with its decisions recorded.
- `exercise_status` is gone from the UI, the engine and the shipped packs; old packs still load.
- A fresh checkout can install and run the tests; CI runs them.
- The console mapping states plainly what v0.2 cannot express yet.
- The three NetKingdom packs validate as v0.2.