sbom-nexus/docs/evidence/SBOM-WP-0002-T01-dark-deployment-preflight-2026-08-22.md

Dark deployment preflight — 2026-08-22

Evidence for SBOM-WP-0002-T01. This preflight made no caller switch and did not create a production database, credential, namespace, workload, or Service.

Product artifact

• Product commit: 0941a2e (feat: package dark deployment runtime).
• Forgejo Actions: image.yaml #1, status Success, duration 54 seconds.
• Published image: forgejo.coulomb.social/coulomb/sbom-nexus@sha256:85245c395edc123cad9ad58f2b3d2443137e2dee132628b62307072e82d868dd.
• Local product verification: Ruff passed; 13 tests passed and the conditional PostgreSQL test skipped without its opt-in DSN.
• The image contains alembic.ini plus migration sources and successfully ran alembic upgrade head as the image's non-root user.

Placement decision

Read-only live inspection found four declarations on platform-pg: audit-core, core-hub, isolation-probe, and tenant-engine. That is the accepted cell ceiling. The dark deployment therefore targets the reviewed platform-pg-2 overflow cell. It does not request a ceiling exception.

apps-pg has two of three declared consumer slots and healthy daily backups, but its documented consumer path still uses static application credentials. SBOM Nexus requires separate short-lived runtime and migration leases through the canonical OpenBao database broker, so the package follows the rapp-postgres declaration path instead.

Runtime package

Repo Manager's canonical wrap flow produced /home/worsch/rapp-sbom-nexus. The reviewed local package commit is 5749b81 and includes:

• private Deployment and ClusterIP Service with no Ingress;
• immutable image digest pin;
• real /state/health startup/readiness/liveness probes;
• mounted SBOM_NEXUS_DATABASE_URL_FILE, never a DSN in Git;
• separate OpenBao runtime and migration ExternalSecrets;
• one-shot Alembic migration job for revision 0001;
• default-deny plus DNS/PostgreSQL-only egress policies;
• PostgreSQL handoff for platform-pg-2, 12 runtime and 2 migration connections, bounded timeouts, and 30-day retention;
• digest, PostgreSQL health, and migration-head live verification.

Verification results:

• package tests: 4 passed;
• family declaration: 14 declarations, 0 errors, one unrelated derived reef projection warning;
• PostgreSQL consumer rendering: passed;
• Railiance01 server-side dry-run: all 11 resources admitted, with the dry-run stream using the existing default namespace because a dry-run Namespace is not persisted for later documents;
• no cluster resources were applied.

Governed gates

Warden returned founder_required for both first-time operations:

1. operator OIDC/MFA to create coulomb/rapp-sbom-nexus in Forgejo;
2. one-time secret provisioning for the platform-pg-2 bootstrap and the exact-scope SBOM Nexus OpenBao/External Secrets credential lane.

No bypass was attempted and no credential value was printed, stored, or written to a repository. State Hub handoffs:

Owner	Message	Requested result
rapp-postgres	bc19f295-84dd-43bb-a648-1f7baa85087b	admit the overflow consumer, database/roles, backup, OpenBao roles and exact-scope token
repo-manager	c24b56f4-90be-4d2e-bca8-4100ab4cc9e6	publish and register the verified managed workload package after OIDC/MFA

T01 remains in progress until those gates are satisfied, the dark workload is healthy on PostgreSQL, and a restore is verified against the deployed topology.