runbook-tutorials/workplans/archived/260929-RBT-WP-0009-finalize-the-runbook-tutorials-workplans.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
RBT-WP-0009	workplan	Finalize the runbook-tutorials workplans	infotech	runbook-tutorials	finished	implementation	claude	stack	2026-09-29	2026-09-29	RBT-WP-0002 RBT-WP-0004 RBT-WP-0005 RBT-WP-0007 RBT-WP-0008	53103733-880f-58cc-a330-4b86375b20ad

Goal

Close every runbook-tutorials workplan before new functionality is introduced. "Closed" means finished, or moved to backlog with the open decisions written down. Agreed with Bernd on 2026-09-29: the definition of done is all workplans closed (no formal freeze ceremony; a security and code review remains an optional follow-up).

Decisions taken with the plan: keep old packs that still carry exercise_status loadable (ignored, deprecated); keep the NetKingdom security bootstrap console as a permanent legacy pack; port the three NetKingdom packs to v0.2; move terminal mode to the backlog and do only a small JSON export.

Retire exercise_status

id: RBT-WP-0009-T01
status: done
priority: high
state_hub_task_id: "298ba5c8-cd8c-5d0c-afdc-cd2c41b67774"

Done 2026-09-29. exercise_status mixed three things (RBT-WP-0008). Maturity, derived from run history, replaces it. Remove the "Record pack as exercised" click and apply_exercise / exercise_update; drop the field from the shipped packs (both repositories) and from the UI headers; make it optional and deprecated in both schemas so old packs still load; show maturity where the status was shown. Also found and fixed while doing it: the CLI had no tests, and rtut list crashed from a shadowed import; tests/test_cli.py now covers it.

Packaging, checks and CI

id: RBT-WP-0009-T02
status: done
priority: high
state_hub_task_id: "14b17a9b-c3a3-5291-9328-e90c99caea49"

Done 2026-09-29. Declare the dependencies (pyproject.toml: PyYAML, jsonschema, pytest) so a fresh checkout can run; add rtut check (packs, attribute sets, projects and templates in one go) and make check; replace the copied smoke-only CI with a job that runs the tests and the checks. Also: the JSON schemas moved into the package (rtut/schema/) so a plain pip install . works (verified); rtut check validates packs, attribute sets, projects and templates; .forgejo/workflows/tests.yaml runs tests and checks in a python:3.12 container. The CI job has not run on a real runner (no way to trigger one from here); check its first execution.

Documents and bookkeeping

id: RBT-WP-0009-T03
status: done
priority: medium
state_hub_task_id: "fec1fc82-c686-524f-861f-ba0881f9408b"

Done 2026-09-29. Refresh SCOPE.md (it still says "bootstrap"), add a docs/README.md index, note in the specs that v0.1 and v0.2 changes from here on become a new version, update the capability entry, and make the workplan statuses true (RBT-WP-0007 finished, RBT-WP-0002-T07 done, RBT-WP-0006 and NK-WP-0011 to backlog).

Evidence export

id: RBT-WP-0009-T04
status: done
priority: medium
state_hub_task_id: "f6f2e2b2-7872-5565-9960-609a790b5356"

Done 2026-09-29, closing RBT-WP-0004-T04: a closed run's (and project run's) record can be downloaded as JSON from its page; an open run is refused (409). Added rtut seal <file> so an exported record can be verified anywhere.

Console mapping: is v0.2 expressive enough

id: RBT-WP-0009-T05
status: done
priority: high
state_hub_task_id: "d90789fc-0497-5caa-979e-53289d20afc4"

Done 2026-09-29. Verdict: the structure maps, the behaviour does not fully; seven gaps (G1 to G7) are the v0.3 candidates. docs/console-mapping.md: map the security bootstrap console's 6 stages, 14 gates, roles, subsystems, integrations, 12 artefacts and 7 runbooks onto v0.2 and say honestly where a special case is needed. This is the acceptance evidence for the model. It closes RBT-WP-0005-T03, records the decision to keep the console as a permanent legacy pack (T05), and moves the extraction (T04) to the backlog.

Port the NetKingdom packs to v0.2

id: RBT-WP-0009-T06
status: done
priority: high
state_hub_task_id: "ca96aae8-bac5-5170-971f-d4b06e1ff252"

Done 2026-09-29 (net-kingdom commit 90112f3). nk.ssh-certificates, nk.openbao-operating-path and nk.protected-system-flex-auth become v0.2 packs with actors, datapoints, stages, gates, idempotency and framing, so the real content uses the model and exercise evidence attaches to the format that stays. Closes RBT-WP-0002-T06 and updates NK-WP-0044. All three validate as v0.2; the 13 checks that need no cluster were re-run through the engine and pass; the OpenBao pack's optional record step is an alternatives choice recommended by a datapoint; live flex-auth steps are manual-only for auto-confirm. The attended run against the cluster is Bernd's (NK-WP-0044-T05).

Close the workplans

id: RBT-WP-0009-T07
status: done
priority: high
state_hub_task_id: "32408947-03bc-58cb-b57b-cb2ee097a3bc"

Done 2026-09-29. Set every status to what is true, move terminal mode and the evidence work that is not done to the backlog with the decisions written down, archive the finished workplans, sync State Hub, and record a progress event. Work that needs Bernd's own environment (NK-WP-0044-T05 attended runs, NK-WP-0009 T03-T05, the external STS issuer for T02) stays in net-kingdom and is named there.

Acceptance Criteria

• No runbook-tutorials workplan is active with open todo work: each is finished or backlog with its decisions recorded.
• exercise_status is gone from the UI, the engine and the shipped packs; old packs still load.
• A fresh checkout can install and run the tests; CI runs them.
• The console mapping states plainly what v0.2 cannot express yet.
• The three NetKingdom packs validate as v0.2.