runbook-tutorials/workplans/RBT-WP-0009-finalize-the-runbook-tutorials-workplans.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on
RBT-WP-0009	workplan	Finalize the runbook-tutorials workplans	infotech	runbook-tutorials	active	implementation	claude	stack	2026-09-29	2026-09-29	RBT-WP-0002 RBT-WP-0004 RBT-WP-0005 RBT-WP-0006 RBT-WP-0007 RBT-WP-0008

Goal

Close every runbook-tutorials workplan before new functionality is introduced. "Closed" means finished, or moved to backlog with the open decisions written down. Agreed with Bernd on 2026-09-29: the definition of done is all workplans closed (no formal freeze ceremony; a security and code review remains an optional follow-up).

Decisions taken with the plan: keep old packs that still carry exercise_status loadable (ignored, deprecated); keep the NetKingdom security bootstrap console as a permanent legacy pack; port the three NetKingdom packs to v0.2; move terminal mode to the backlog and do only a small JSON export.

Retire exercise_status

id: RBT-WP-0009-T01
status: done
priority: high

Done 2026-09-29. exercise_status mixed three things (RBT-WP-0008). Maturity, derived from run history, replaces it. Remove the "Record pack as exercised" click and apply_exercise / exercise_update; drop the field from the shipped packs (both repositories) and from the UI headers; make it optional and deprecated in both schemas so old packs still load; show maturity where the status was shown. Also found and fixed while doing it: the CLI had no tests, and rtut list crashed from a shadowed import; tests/test_cli.py now covers it.

Packaging, checks and CI

id: RBT-WP-0009-T02
status: done
priority: high

Done 2026-09-29. Declare the dependencies (pyproject.toml: PyYAML, jsonschema, pytest) so a fresh checkout can run; add rtut check (packs, attribute sets, projects and templates in one go) and make check; replace the copied smoke-only CI with a job that runs the tests and the checks. Also: the JSON schemas moved into the package (rtut/schema/) so a plain pip install . works (verified); rtut check validates packs, attribute sets, projects and templates; .forgejo/workflows/tests.yaml runs tests and checks in a python:3.12 container. The CI job has not run on a real runner (no way to trigger one from here); check its first execution.

Documents and bookkeeping

id: RBT-WP-0009-T03
status: todo
priority: medium

Refresh SCOPE.md (it still says "bootstrap"), add a docs/README.md index, note in the specs that v0.1 and v0.2 changes from here on become a new version, update the capability entry, and make the workplan statuses true (RBT-WP-0007 finished, RBT-WP-0002-T07 done, RBT-WP-0006 and NK-WP-0011 to backlog).

Evidence export

id: RBT-WP-0009-T04
status: todo
priority: medium

Close RBT-WP-0004-T04: a closed run's record can be downloaded as JSON from its page (the record is non-secret by construction; the download is refused for a run that is still open).

Console mapping: is v0.2 expressive enough

id: RBT-WP-0009-T05
status: todo
priority: high

docs/console-mapping.md: map the security bootstrap console's 6 stages, 14 gates, roles, subsystems, integrations, 12 artefacts and 7 runbooks onto v0.2 and say honestly where a special case is needed. This is the acceptance evidence for the model. It closes RBT-WP-0005-T03, records the decision to keep the console as a permanent legacy pack (T05), and moves the extraction (T04) to the backlog.

Port the NetKingdom packs to v0.2

id: RBT-WP-0009-T06
status: todo
priority: high

nk.ssh-certificates, nk.openbao-operating-path and nk.protected-system-flex-auth become v0.2 packs with actors, datapoints, stages, gates, idempotency and framing, so the real content uses the model and exercise evidence attaches to the format that stays. Closes RBT-WP-0002-T06 and updates NK-WP-0044.

Close the workplans

id: RBT-WP-0009-T07
status: todo
priority: high

Set every status to what is true, move terminal mode and the evidence work that is not done to the backlog with the decisions written down, archive the finished workplans, sync State Hub, and record a progress event. Work that needs Bernd's own environment (NK-WP-0044-T05 attended runs, NK-WP-0009 T03-T05, the external STS issuer for T02) stays in net-kingdom and is named there.

Acceptance Criteria

• No runbook-tutorials workplan is active with open todo work: each is finished or backlog with its decisions recorded.
• exercise_status is gone from the UI, the engine and the shipped packs; old packs still load.
• A fresh checkout can install and run the tests; CI runs them.
• The console mapping states plainly what v0.2 cannot express yet.
• The three NetKingdom packs validate as v0.2.