docs: record dark deployment preflight

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md

@@ -0,0 +1,74 @@
+# Dark deployment preflight — 2026-08-22
+
+Evidence for `SBOM-WP-0002-T01`. This preflight made no caller switch and did
+not create a production database, credential, namespace, workload, or Service.
+
+## Product artifact
+
+- Product commit: `0941a2e` (`feat: package dark deployment runtime`).
+- Forgejo Actions: `image.yaml #1`, status `Success`, duration 54 seconds.
+- Published image:
+  `forgejo.coulomb.social/coulomb/sbom-nexus@sha256:85245c395edc123cad9ad58f2b3d2443137e2dee132628b62307072e82d868dd`.
+- Local product verification: Ruff passed; 13 tests passed and the conditional
+  PostgreSQL test skipped without its opt-in DSN.
+- The image contains `alembic.ini` plus migration sources and successfully ran
+  `alembic upgrade head` as the image's non-root user.
+
+## Placement decision
+
+Read-only live inspection found four declarations on `platform-pg`:
+`audit-core`, `core-hub`, `isolation-probe`, and `tenant-engine`. That is the
+accepted cell ceiling. The dark deployment therefore targets the reviewed
+`platform-pg-2` overflow cell. It does not request a ceiling exception.
+
+`apps-pg` has two of three declared consumer slots and healthy daily backups,
+but its documented consumer path still uses static application credentials.
+SBOM Nexus requires separate short-lived runtime and migration leases through
+the canonical OpenBao database broker, so the package follows the
+`rapp-postgres` declaration path instead.
+
+## Runtime package
+
+Repo Manager's canonical wrap flow produced `/home/worsch/rapp-sbom-nexus`.
+The reviewed local package commit is `5749b81` and includes:
+
+- private Deployment and ClusterIP Service with no Ingress;
+- immutable image digest pin;
+- real `/state/health` startup/readiness/liveness probes;
+- mounted `SBOM_NEXUS_DATABASE_URL_FILE`, never a DSN in Git;
+- separate OpenBao runtime and migration ExternalSecrets;
+- one-shot Alembic migration job for revision `0001`;
+- default-deny plus DNS/PostgreSQL-only egress policies;
+- PostgreSQL handoff for `platform-pg-2`, 12 runtime and 2 migration
+  connections, bounded timeouts, and 30-day retention;
+- digest, PostgreSQL health, and migration-head live verification.
+
+Verification results:
+
+- package tests: 4 passed;
+- family declaration: 14 declarations, 0 errors, one unrelated derived reef
+  projection warning;
+- PostgreSQL consumer rendering: passed;
+- Railiance01 server-side dry-run: all 11 resources admitted, with the dry-run
+  stream using the existing `default` namespace because a dry-run Namespace is
+  not persisted for later documents;
+- no cluster resources were applied.
+
+## Governed gates
+
+Warden returned `founder_required` for both first-time operations:
+
+1. operator OIDC/MFA to create `coulomb/rapp-sbom-nexus` in Forgejo;
+2. one-time secret provisioning for the `platform-pg-2` bootstrap and the
+   exact-scope SBOM Nexus OpenBao/External Secrets credential lane.
+
+No bypass was attempted and no credential value was printed, stored, or
+written to a repository. State Hub handoffs:
+
+| Owner | Message | Requested result |
+| --- | --- | --- |
+| `rapp-postgres` | `bc19f295-84dd-43bb-a648-1f7baa85087b` | admit the overflow consumer, database/roles, backup, OpenBao roles and exact-scope token |
+| `repo-manager` | `c24b56f4-90be-4d2e-bca8-4100ab4cc9e6` | publish and register the verified managed workload package after OIDC/MFA |
+
+`T01` remains in progress until those gates are satisfied, the dark workload is
+healthy on PostgreSQL, and a restore is verified against the deployed topology.

docs/production-cutover-plan.md

@@ -26,6 +26,19 @@ State Hub rows.
 | 6. Stabilize | Nexus | two successful daily fires and one Monday with weekly flood at zero | return façade flags to State Hub |
 | 7. Retire | Nexus | retention decision and final backup | restore retained State Hub snapshot store during window |
 
+## Dark deployment placement
+
+The application is packaged separately as `rapp-sbom-nexus` and remains a
+private `rail-kubernetes` workload on `reef-railiance`. The application image
+is built from this repository and pinned by digest in the package.
+
+`platform-pg` is at its declared four-consumer ceiling. The reviewed database
+handoff therefore targets the named `platform-pg-2` overflow cell rather than
+quietly exceeding that ceiling. `apps-pg` still has one declared slot, but its
+current consumer flow uses static application credentials; SBOM Nexus requires
+the canonical OpenBao runtime/migration lease split. The database owner must
+admit and provision the overflow consumer before the dark apply.
+
 ## Contract ownership
 
 ### SBOM Nexus

workplans/SBOM-WP-0002-production-cutover.md

@@ -37,11 +37,16 @@ bounded daily catch-up before retiring State Hub SBOM ownership.
 id: SBOM-WP-0002-T01
 status: progress
 priority: high
+needs_human: true
+intervention_note: "Warden requires operator OIDC/MFA for first rapp-sbom-nexus Forgejo repository creation and one-time secret provisioning for platform-pg-2/OpenBao."
 state_hub_task_id: "95a520d4-30c2-5c87-8054-6bfe549c2686"
 ```
 
 Provision database credentials through the governed route, migrate schema,
 deploy the API without callers, and capture health plus backup/restore evidence.
+Image publication, package rendering, family validation, and server-side dry-run
+are complete; see
+`docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md`.
 
 ## Synchronize repository projections