Milestone 4.P.5 — Production Platform, Recovery & Supply ChainCopy Anchor Link

Status: In progress / partial — repository foundations do not equal production closure. Outcome: The operator system is deployable, recoverable, observable, and promotable only after environment-specific evidence exists. Track: Track P — Operator Readiness, Evidence & Control Plane Dependencies: 4.P.0; 4.P.2 Estimated effort: 3 weeks Gate: G5 platform (partial)

Scope and present boundaryCopy Anchor Link

The intended platform contract covers digest-pinned workloads, probes, PDB/HPA, migration compatibility, rollback by digest, encrypted backups, restore and evidence-bundle recovery, backup freshness, signed images, Kyverno verifyImages, worker time limits, and platform health. Helm is the intended deployment mechanism; no Kustomize decision is required.

The console workload, service ownership, Ingress/gateway routing, TLS termination and renewal, browser promotion path, and production values must be specified and evidenced before the canonical operator runtime can be promoted. services/dashboard/ remains compatibility-only and is not a substitute workload.

Recovery and supply-chain contractCopy Anchor Link

Record target RPO/RTO per store only after a measured drill. The working planning targets are Postgres ≤5m/≤30m, ClickHouse ≤24h/≤60m, Redis as cache/no recovery target, MinIO ≤24h/≤60m, and outbox RPO 0 by sequence; these are targets, not evidence. Restore reports must include tenant-isolation queries, data classes, achieved RPO/RTO, image/schema/config digests, and rollback command. Admission reports must show unsigned-image rejection in a real staging cluster.

Verification gate and residual registerCopy Anchor Link

Keep Helm/chart and any compose restore evidence linked, but leave explicit open rows for console workload, Ingress, TLS, real PITR, measured RPO/RTO, and live Kyverno admission. Load/chaos verification belongs to 4.E.2. P6 consumes only artifact-backed runtime evidence.

Rollout and rollbackCopy Anchor Link

Trigger: failed restore, missing ingress/TLS, probe failure, digest mismatch, admission failure, or RPO/RTO breach. Reversal: roll back to a known-good digest and compatible schema/configuration, or disable the operator origin; never reverse an incompatible migration by data surgery. Verify: restore, tenant-isolation, admission, and runtime smoke artifacts are attached.

Findings addressedCopy Anchor Link

F4-011, F4-020, F4-032.

Exit checklistCopy Anchor Link

• Helm deployment evidence includes the canonical console workload.
• Ingress/gateway, TLS, cookie, and SSE timeout contracts are proven in staging.
• Real pgBackRest PITR restore and measured RPO/RTO report are attached.
• Live Kyverno unsigned-image rejection is evidenced; CI policy text alone is insufficient.
• Digest rollback and dependency-aware health/drain are exercised.
• Open rows are consumed by 4.E.2/4.E.3 rather than marked closed by prose.