# Dark deployment preflight — 2026-08-22

Evidence for `SBOM-WP-0002-T01`. This preflight made no caller switch and did
not create a production database, credential, namespace, workload, or Service.

## Product artifact

- Product commit: `0941a2e` (`feat: package dark deployment runtime`).
- Forgejo Actions: `image.yaml #1`, status `Success`, duration 54 seconds.
- Published image:
  `forgejo.coulomb.social/coulomb/sbom-nexus@sha256:85245c395edc123cad9ad58f2b3d2443137e2dee132628b62307072e82d868dd`.
- Local product verification: Ruff passed; 13 tests passed and the conditional
  PostgreSQL test skipped without its opt-in DSN.
- The image contains `alembic.ini` plus migration sources and successfully ran
  `alembic upgrade head` as the image's non-root user.

## Placement decision

Read-only live inspection found four declarations on `platform-pg`:
`audit-core`, `core-hub`, `isolation-probe`, and `tenant-engine`. That is the
accepted cell ceiling. The dark deployment therefore targets the reviewed
`platform-pg-2` overflow cell. It does not request a ceiling exception.

`apps-pg` has two of three declared consumer slots and healthy daily backups,
but its documented consumer path still uses static application credentials.
SBOM Nexus requires separate short-lived runtime and migration leases through
the canonical OpenBao database broker, so the package follows the
`rapp-postgres` declaration path instead.

## Runtime package

Repo Manager's canonical wrap flow produced `/home/worsch/rapp-sbom-nexus`.
The reviewed local package commit is `5749b81` and includes:

- private Deployment and ClusterIP Service with no Ingress;
- immutable image digest pin;
- real `/state/health` startup/readiness/liveness probes;
- mounted `SBOM_NEXUS_DATABASE_URL_FILE`, never a DSN in Git;
- separate OpenBao runtime and migration ExternalSecrets;
- one-shot Alembic migration job for revision `0001`;
- default-deny plus DNS/PostgreSQL-only egress policies;
- PostgreSQL handoff for `platform-pg-2`, 12 runtime and 2 migration
  connections, bounded timeouts, and 30-day retention;
- digest, PostgreSQL health, and migration-head live verification.

Verification results:

- package tests: 4 passed;
- family declaration: 14 declarations, 0 errors, one unrelated derived reef
  projection warning;
- PostgreSQL consumer rendering: passed;
- Railiance01 server-side dry-run: all 11 resources admitted, with the dry-run
  stream using the existing `default` namespace because a dry-run Namespace is
  not persisted for later documents;
- no cluster resources were applied.

## Governed gates

Warden returned `founder_required` for both first-time operations:

1. operator OIDC/MFA to create `coulomb/rapp-sbom-nexus` in Forgejo;
2. one-time secret provisioning for the `platform-pg-2` bootstrap and the
   exact-scope SBOM Nexus OpenBao/External Secrets credential lane.

No bypass was attempted and no credential value was printed, stored, or
written to a repository. State Hub handoffs:

| Owner | Message | Requested result |
| --- | --- | --- |
| `rapp-postgres` | `bc19f295-84dd-43bb-a648-1f7baa85087b` | admit the overflow consumer, database/roles, backup, OpenBao roles and exact-scope token |
| `repo-manager` | `c24b56f4-90be-4d2e-bca8-4100ab4cc9e6` | publish and register the verified managed workload package after OIDC/MFA |

`T01` remains in progress until those gates are satisfied, the dark workload is
healthy on PostgreSQL, and a restore is verified against the deployed topology.

## Post-preflight status

Later on 2026-08-22, the Forgejo package gate was completed and the package was
registered. A namespace-first apply correction passed five package tests and a
server-side dry-run, then was published as `rapp-sbom-nexus` commit `dd110d1`.

The database owner accepted the declaration under `RAPP-POSTGRES-WP-0005`
(State Hub workplan `d6d36add-27d9-5b5d-b6fe-ce80eb7b6dab`). The distinct
`platform-pg-2` cell and bootstrap secret were created and the cell reached 1/1
Ready. Acceptance remains blocked because:

- Warden still requires the attended founder act for the OpenBao connection,
  dynamic runtime/migration roles, exact two-path policy, and renewable parent
  token;
- continuous archiving is `False` and the first base backup is
  `walArchivingFailing`; the value-safe pod log reports S3 `HeadBucket` 403 for
  the governed `platform-pg-2` prefix.

The backup diagnosis and request for a successful base backup plus scratch
restore were sent to `rapp-postgres` as message
`31b72f4b-fcf8-4454-82b7-2dbf325c573e`. The SBOM Nexus workload remains
undeployed and no caller ingress is enabled.