[tylerhutcherson]

Ticket and stack

MOD-20121. This draft stacks on operator-docs #4256 at 430c680a53e1a1060e26b8f46abb3ed6c7c6b753; its parent branch and PR are unchanged. Public RAM setup is coordinated in #4330. Backend: redislabsdev/iris#2065, following MOD-20115 and MOD-20116. UI recovery/copy: cloud-ui #3346.

What changes

The older operator draft prescribes grant preparation and bundled Identity Service values that the new extraction stack no longer uses. This updates the full fresh-install walkthrough to separate Identity Service releases with matching runtime/validator credentials, static RAM worker read trust, a tenant-confined RAM Control Plane viewer, live source discovery, synchronous ready/off binding creation, explicit enable/recovery validation, and source-independent pause/delete. Ordinary application grants and RAM's own worker remain independent.

The control-plane OpenAPI artifact is copied byte-for-byte from backend Smithy-generated public output; its source hash and revision were updated together. Existing 13-operation/hash checks remain unchanged. The data-plane reference and SDK pins remain unchanged: normalized DP wire hash matches the locked published SDK input.

Independent deep and ponytail review corrected unsupported global IdS product_admin mapping, health URLs, extraction-overlay retention during upgrades, and the metadata JSON prerequisite. Reviewer/challenger agreement was 100%; all four source-backed fixes were verified. The latest docs-only follow-up refreshes the internal review record with completed local qualification and coordinated UI release requirements; public pages and generated artifacts are unchanged by that follow-up.

Qualification and publication hold

Keep this PR DRAFT. Do not merge or publish until the backend stack is merged/released and matching chart/image versions and endpoint requirements are verified. Both foundation PRs have merged; child #2065 remains unmerged and the stack is unreleased. Existing placeholder versions are intentional. Coordinate parent #4256, public RAM #4330 and this PR. Merging docs main publishes live automatically.

Locked production/API source af81d8655a5c2ff48003cc96fb7bce42daf1935f completed local qualification. Earlier qualified child 2ed416db157ebd12c3f5081ca9eaaf26c8375f0d completed 101 reported successes, 20 skips, no pending or failed checks, Bugbot SUCCESS and no unresolved review threads. This is historical CI evidence for that earlier head. Branch Checks run 39903123145 completed successfully at that exact SHA. The restack has no Smithy/API change; the generated CP artifact and source-lock.json remain unchanged at qualified API source af81. Reverify the lock/artifact against the eventual release before publication. Backend qualification record.

The existing contributor license/cla remains pending here, on #4330, #4256 and earlier docs drafts. No agreement was signed, asserted or changed. A human must resolve that condition if it persists; the documented status recheck did not clear it.

Current backend restack

Both foundation PRs have merged: MOD-20115 #2061 as 876853ddb2c111150c3f4040343597bb50bc7612 and MOD-20116 #2064 as f526654fd9a6e4c32ba0e5548f1b23f8af4ec5f3. The child #2065 is now e6555c27109800bb7c0cfc25657e8c0e08b56e2d, rebased onto main bc758425655d4ba952e907c7284081f4992bc1a8 after #2091 merged. The test-only repair adapts incoming daily startup checks to metadata-local binding cleanup; all ten feature commits are unchanged by the final rebase. Current backend CI is running; Bugbot skipped the unchanged reviewed patch, human approval remains and no review threads are unresolved. Keep merge/publication on hold until current CI, merge-queue and release gates are satisfied. The previous D8 snapshot passed CI (106 successful checks, 24 skipped) and Bugbot, but that is historical evidence. The canceled a542f186 run is not a complete passing result. Current backend review record.

The previously qualified backend snapshot is 7c73e2a1952904ff5dce9b5ed8d63aff78989077, on MOD-20116 d4921756c745bd6e6d7ee990e73830215dc746e5 and MOD-20115 be04ba2127fc6bc51b2bc5f005cd20e71b532bee. CI for that snapshot is complete. Child #2065 reports 97 successful checks, 20 skipped, no pending or failed checks, Bugbot SUCCESS and no unresolved review threads. All five deployed profiles passed on the child and MOD-20116. Child Branch Checks, MOD-20116 Branch Checks and MOD-20115 CI completed successfully at these exact heads. Earlier af81d8655/2ed416db1 local qualification and CI remain historical evidence. Previous snapshot review record.

Historical backend local qualification

• At af81, all 99 reported checks and Bugbot passed before expanded local qualification. Packaged KinD ci-auth then passed all four cases in 873.105 seconds, including both projected probe-token rotations with strict unchanged worker UID, wrong-audience rejection and three RAM promotion jobs. Its report has complete: true, exit 0 and no missing/unsuccessful cases.
• Race validation passed 675 repeated authentication/fencing/transport executions and 18 real-HTTP method executions using real RAM/Playbook CPs and DPs, IdS, Redis and the shared worker. A/B plus C added after startup, denied activation, foreign sources/destinations, stale versions and source-independent stop are covered. External issuer, SM/AWS resolution and model responses remain fixtures; this is not deployed Neptune qualification.
• Engine stress passed exact admission bounds, drain/recovery, 16 cloud accounts/108 bindings/2,368 exact ledger/proposal-request pairs and 520 pairs in four bindings in one on-prem tenant. The exact final stress source passed its race runtime rerun. Source/target HTTP and model responses are substitutes; sampled runtime peaks and finite progress establish neither fleet capacity nor sustained fairness.
• Reviewed UI b38 and installed @redislabsdev/cloud-ui-irisultra@0.0.19 each passed three on-prem browser cases: live-source lifecycle, stale-version recovery and late-source discovery. These are three source/destination pairs in one configured tenant, not multiple on-prem accounts.
• App-qa console observations are read-only baseline evidence at backend 044628e4, with one account and no eligible sources. Current-candidate cloud A/B/C and lifecycle mutations were unavailable there; no account/infrastructure was provisioned to force them.

These results do not establish live-model quality, production licensing, deployed Neptune reachability, published-version support, fleet capacity or spending limits.

Coordinated UI release

Cloud UI #3346 must remain unmerged until the candidate backend is deployed in the Cloud environments where extraction is exposed; its master merge starts QA/production workflows. After backend rollout, run a Cloud preview smoke with an eligible RAM source to verify binding creation and activation before UI release. The older app-qa baseline with no eligible sources does not satisfy this gate.

The installed 0.0.19 bundle preserves the tested happy path but lacks #3346's blocked/off recovery and copy corrections. Separately for on-prem UI consumption, normal post-merge MFE publication must be followed by an explicit update of the actual Iris package.json and lockfile pin, a rebuilt/released UI gateway, and a packaged smoke without a local bundle override. There is no automatic cross-repository pin updater. Passing with a reviewed local bundle is not proof that a published image includes those corrections.

Documentation validation

• Existing Playbooks suite: 138 passed with locked published Python/TypeScript SDKs. Strict TypeScript compilation and SDK-source checks passed.
• All 14 YAML and 46 Bash operator examples parse; frontmatter unchanged.
• Full Hugo 0.143.1 build: 19,928 pages, no Playbook-page warnings. Corrected health/upgrade/JSON guidance was checked in rendered output. Existing ignored Node/client-example inputs were reused; generated examples used the repository processor.
• Complete documented Playbook + standalone IdS and public RAM + standalone IdS base/overlays pass Helm 3.20.2 strict lint/rendering. Assertions cover service/ServiceAccount names, projected audiences, static read/propose scopes, CP tenant confinement, ordinary introspection, shared Secret mounts and HTTPS validators; no substitute base fixture was used.
• Exact rendered IdS OIDC policy uses scoped roleBindings and the configured tenant. Backend TestControlConfigValidatesOperatorJWTBlocks passed; Helm rendering alone is not proof of Go startup-policy validity.
• Generated CP SHA256 remains b4e5ad6ff318dcd8e9f60bb75fb2d109058891d0e211e62f9781b24f221cf7f6; final-child byte comparison passed. DP wire SHA256 remains 991a428a09c362b4b45e1f90bf32c5d9980c6933d2f31d12b2dd730d5a6f34b3.
• Current docs head 2cf762f940f6acee5a9cb7b49799253e45f4f341 passed remote build/test/staging CI: 99 successful checks, 1 skipped. The fresh SDK/reference/example/type workflow passed all 138 tests in 239.95 seconds and the locked SDK-source check; full-site builds and staging deployments also passed. license/cla is the only pending status; no review finding is open.

The review-record-only follow-up passed focused content/link/provenance checks and git diff --check, with independent backend-owner approval. It leaves public pages, generated artifacts, source lock and SDK pins unchanged; earlier page/SDK validation remains applicable. Normal commit hooks were preserved.

Current docs branch revision: 2cf762f940f6acee5a9cb7b49799253e45f4f341. Build/test/staging checks are complete at this revision. CLA, draft and coordinated-release holds remain in place.

@hristopopovredis

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

Staging links:
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/authentication/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/configuration/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/deploy/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/extraction/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/operations/
https://redis.io/docs/staging/docs/MOD-20121-playbook-extraction-lifecycle/operate/iris/agent-playbook/self-managed/prerequisites/

[github-actions]

🧠 Redis Memory

Found 5 related items from repository history:

• PR — MOD-20121: Align Playbook extraction authentication setup

  MOD-20121

• PR — MOD-18528: Document Playbook bindings and RAM service-subject authentication

  Summary

• PR — WIP: Redis Agent Playbooks self-managed operator docs

  MOD-19679 — Self-managed Redis Agent Playbooks operator documentation.

• PR — WIP: Redis Agent Playbooks developer docs

  MOD-19391 — Redis Agent Playbooks developer documentation.

• PR — WIP: Playbook developer docs

  Adds the Agent Playbooks developer docs under /develop/ai/context-engine/agent-playbook/ for docs-team and product review. The guides cove

Memory updated at 2cf762f