Onboard tenant-engine to the staged-promotion contract

TEN-WP-0008. railiance/app.toml declares criticality=high, empty secrets,
isolated canary, and the live PostgreSQL digest as previous_stable.
Manifests render through kustomize (deploy/ and deploy/canary/). Stage 1
passed. Stage 2/3 Helm-only CLI gap requested as RAIL-BS-IN-0001 rather
than a dummy chart.

Assistant: grok
Assistant-Session: 01a04cea-e5e8-7081-a0fc-808ebbc35fa9

workplans/TEN-WP-0008-staged-promotion-onboarding.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Bring tenant-engine under the staged-promotion contract"
 domain: infotech
 repo: tenant-engine
-status: ready
-owner: claude
+status: finished
+owner: grok
 topic_slug: tenant-guardrails
 created: "2026-08-16"
-updated: "2026-08-21"
+updated: "2026-08-29"
 depends_on:
   - TEN-WP-0007
 unblocks: []
@@ -59,7 +59,7 @@ is a `railiance-bootstrap` decision to request, not one to make here.
 
 ```task
 id: TEN-WP-0008-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "0231e4d1-2e1a-4e77-92ba-2cfaf23692ab"
 ```
@@ -95,11 +95,16 @@ result as non-secret evidence.
 Done when the file validates against the schema and stage 1 passes in plan
 mode.
 
+**Done 2026-08-29:** `railiance/app.toml` validates; `bin/railiance run .`
+passed (`docs/evidence/TEN-WP-0008-stage1-result.json`). criticality=high
+(argument in `[app].description`); `secrets.references = []`; `/health` on
+8090; rollback strategy `image-digest`.
+
 ## T02 - Reconcile the deployment shape with the contract
 
 ```task
 id: TEN-WP-0008-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5f2ad011-1de8-45df-8e8f-dd6bcf51ece4"
 ```
@@ -138,11 +143,18 @@ contract still owns the exact canary mode and promotion commands. Current
 production digest:
 `sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24`.
 
+**Done 2026-08-29:** option 2 — kustomize wrap (`deploy/` production,
+`deploy/canary/` isolated). Stage commands are `kubectl apply -k`, verified
+by Stage 1 render. `bin/railiance deploy|promote --plan` still requires
+Helm; not papered over. Requested as `RAIL-BS-IN-0001`. Evidence:
+`docs/evidence/TEN-WP-0008-stage2-plan.json`,
+`docs/evidence/TEN-WP-0008-stage3-plan.json`.
+
 ## T03 - Record current production as the stable baseline
 
 ```task
 id: TEN-WP-0008-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "c4b79dc1-c280-428e-9dc5-b17c05b084c6"
 ```
@@ -156,11 +168,17 @@ copies of the truth rather than one.
 Done when the stable digest is recorded through the contract's own mechanism
 rather than only in `deploy/tenant-engine.yaml`.
 
+**Done 2026-08-29:** `[stages.stage3].previous_stable =
+tenant-engine@sha256:a8e8086ffc5b772c1391b166f5e1884b90f7d327b152c205eceae129df555c24`
+(current PostgreSQL runtime, same pin `make verify-pin` reads). Stage 3
+plan-mode precheck `previous-stable` passed. The T03 draft's `44ca65f3…`
+pin was stale after TEN-WP-0009.
+
 ## T04 - Hand the pattern back to the fleet
 
 ```task
 id: TEN-WP-0008-T04
-status: todo
+status: done
 priority: low
 state_hub_task_id: "b816a862-51e0-4abd-a2f3-ee40359526cc"
 ```
@@ -176,11 +194,16 @@ independently.
 
 Done when the note is sent.
 
+**Done 2026-08-29:** note to `flex-auth` (cost of onboarding a non-Helm
+workload) and `RAIL-BS-IN-0001` plus a State Hub message to
+`railiance-bootstrap`.
+
 ## Out of scope
 
 - **Changing the staged-promotion contract, CLI, or schema.** Request, do not
   implement.
 - **Building a drift-detection service.** The point of this workplan is that
   staged promotion should make one unnecessary.
-- **Re-deploying.** Production is healthy on `44ca65f3…`; onboarding describes
-  what is already running, it does not ship anything new.
+- **Re-deploying.** Production is healthy on `a8e8086ffc…` (TEN-WP-0009);
+  onboarding describes what is already running, it does not ship TEN-WP-0011
+  or any newer image.