--- id: RBT-WP-0009 type: workplan title: "Finalize the runbook-tutorials workplans" domain: infotech repo: runbook-tutorials status: finished flavor: implementation owner: claude topic_slug: stack created: "2026-09-29" updated: "2026-09-29" depends_on: [RBT-WP-0002, RBT-WP-0004, RBT-WP-0005, RBT-WP-0007, RBT-WP-0008] state_hub_workstream_id: "53103733-880f-58cc-a330-4b86375b20ad" --- ## Goal Close every runbook-tutorials workplan before new functionality is introduced. "Closed" means finished, or moved to `backlog` with the open decisions written down. Agreed with Bernd on 2026-09-29: the definition of done is *all workplans closed* (no formal freeze ceremony; a security and code review remains an optional follow-up). Decisions taken with the plan: keep old packs that still carry `exercise_status` loadable (ignored, deprecated); keep the NetKingdom security bootstrap console as a permanent legacy pack; port the three NetKingdom packs to v0.2; move terminal mode to the backlog and do only a small JSON export. ## Retire exercise_status ```task id: RBT-WP-0009-T01 status: done priority: high state_hub_task_id: "298ba5c8-cd8c-5d0c-afdc-cd2c41b67774" ``` Done 2026-09-29. `exercise_status` mixed three things (RBT-WP-0008). Maturity, derived from run history, replaces it. Remove the "Record pack as exercised" click and `apply_exercise` / `exercise_update`; drop the field from the shipped packs (both repositories) and from the UI headers; make it optional and deprecated in both schemas so old packs still load; show maturity where the status was shown. Also found and fixed while doing it: the CLI had no tests, and `rtut list` crashed from a shadowed import; `tests/test_cli.py` now covers it. ## Packaging, checks and CI ```task id: RBT-WP-0009-T02 status: done priority: high state_hub_task_id: "14b17a9b-c3a3-5291-9328-e90c99caea49" ``` Done 2026-09-29. Declare the dependencies (`pyproject.toml`: PyYAML, jsonschema, pytest) so a fresh checkout can run; add `rtut check` (packs, attribute sets, projects and templates in one go) and `make check`; replace the copied smoke-only CI with a job that runs the tests and the checks. Also: the JSON schemas moved into the package (`rtut/schema/`) so a plain `pip install .` works (verified); `rtut check` validates packs, attribute sets, projects and templates; `.forgejo/workflows/tests.yaml` runs tests and checks in a python:3.12 container. **The CI job has not run on a real runner** (no way to trigger one from here); check its first execution. ## Documents and bookkeeping ```task id: RBT-WP-0009-T03 status: done priority: medium state_hub_task_id: "fec1fc82-c686-524f-861f-ba0881f9408b" ``` Done 2026-09-29. Refresh `SCOPE.md` (it still says "bootstrap"), add a `docs/README.md` index, note in the specs that v0.1 and v0.2 changes from here on become a new version, update the capability entry, and make the workplan statuses true (RBT-WP-0007 finished, RBT-WP-0002-T07 done, RBT-WP-0006 and NK-WP-0011 to backlog). ## Evidence export ```task id: RBT-WP-0009-T04 status: done priority: medium state_hub_task_id: "f6f2e2b2-7872-5565-9960-609a790b5356" ``` Done 2026-09-29, closing RBT-WP-0004-T04: a closed run's (and project run's) record can be downloaded as JSON from its page; an open run is refused (409). Added `rtut seal ` so an exported record can be verified anywhere. ## Console mapping: is v0.2 expressive enough ```task id: RBT-WP-0009-T05 status: done priority: high state_hub_task_id: "d90789fc-0497-5caa-979e-53289d20afc4" ``` Done 2026-09-29. Verdict: the structure maps, the behaviour does not fully; seven gaps (G1 to G7) are the v0.3 candidates. `docs/console-mapping.md`: map the security bootstrap console's 6 stages, 14 gates, roles, subsystems, integrations, 12 artefacts and 7 runbooks onto v0.2 and say honestly where a special case is needed. This is the acceptance evidence for the model. It closes RBT-WP-0005-T03, records the decision to keep the console as a permanent legacy pack (T05), and moves the extraction (T04) to the backlog. ## Port the NetKingdom packs to v0.2 ```task id: RBT-WP-0009-T06 status: done priority: high state_hub_task_id: "ca96aae8-bac5-5170-971f-d4b06e1ff252" ``` Done 2026-09-29 (net-kingdom commit 90112f3). `nk.ssh-certificates`, `nk.openbao-operating-path` and `nk.protected-system-flex-auth` become v0.2 packs with actors, datapoints, stages, gates, idempotency and framing, so the real content uses the model and exercise evidence attaches to the format that stays. Closes RBT-WP-0002-T06 and updates NK-WP-0044. All three validate as v0.2; the 13 checks that need no cluster were re-run through the engine and pass; the OpenBao pack's optional record step is an alternatives choice recommended by a datapoint; live flex-auth steps are manual-only for auto-confirm. The attended run against the cluster is Bernd's (NK-WP-0044-T05). ## Close the workplans ```task id: RBT-WP-0009-T07 status: done priority: high state_hub_task_id: "32408947-03bc-58cb-b57b-cb2ee097a3bc" ``` Done 2026-09-29. Set every status to what is true, move terminal mode and the evidence work that is not done to the backlog with the decisions written down, archive the finished workplans, sync State Hub, and record a progress event. Work that needs Bernd's own environment (NK-WP-0044-T05 attended runs, NK-WP-0009 T03-T05, the external STS issuer for T02) stays in net-kingdom and is named there. ## Acceptance Criteria - No runbook-tutorials workplan is `active` with open `todo` work: each is `finished` or `backlog` with its decisions recorded. - `exercise_status` is gone from the UI, the engine and the shipped packs; old packs still load. - A fresh checkout can install and run the tests; CI runs them. - The console mapping states plainly what v0.2 cannot express yet. - The three NetKingdom packs validate as v0.2.