Establish Railiance Fabric graph model

docs/first-rollout.md

@@ -0,0 +1,54 @@
+# First Rollout
+
+The first rollout is represented by the seed declarations under `fabric/`.
+Those files are intentionally centralized in Railiance Fabric for bootstrap;
+the long-term target is for each owning repo to carry its own `fabric/`
+declarations.
+
+## Seeded Repos
+
+| Repo | Seeded Service(s) | First Capability |
+|------|-------------------|------------------|
+| `railiance-platform` | OpenBao, CNPG, Valkey | runtime secrets, PostgreSQL, Redis-compatible cache |
+| `net-kingdom` | IAM Profile contract | IAM Profile issuer |
+| `key-cape` | IAM Profile API | IAM Profile issuer implementation |
+| `flex-auth` | flex-auth API, Topaz | authorization decisions |
+| `artifact-store` | object storage service | object storage, credential vending |
+| `repo-scoping` | scope generator | scope generation |
+| `the-custodian` | State Hub | coordination read model |
+
+## Promotion Path
+
+For each owning repo:
+
+1. Copy the matching seed files from `railiance-fabric/fabric/` into the owning
+   repo's own `fabric/` directory.
+2. Replace seed source links with repo-local source links.
+3. Validate the owning repo by itself.
+4. Validate the owning repo together with `railiance-fabric` and other
+   providers/consumers it depends on.
+5. Export the multi-repo graph for State Hub ingestion.
+6. Once repo-local declarations are authoritative, remove or mark the central
+   seed declarations as bootstrap-only.
+
+## Suggested Order
+
+1. `railiance-platform`: owns OpenBao, CNPG, and Valkey provider declarations.
+2. `key-cape`: owns the first concrete IAM Profile implementation.
+3. `flex-auth`: owns authorization decisions and concrete consumers of OpenBao
+   and IAM Profile capabilities.
+4. `the-custodian/state-hub`: owns coordination read-model declarations and is
+   the first export consumer.
+5. `repo-scoping`: owns scope-generation provider declarations.
+6. `artifact-store`: can promote planned object-storage declarations when its
+   interfaces stabilize.
+
+## Completion Signal
+
+The rollout is good enough for the next phase when:
+
+- each repo can validate its own declarations
+- the combined graph has no unresolved dependencies
+- State Hub can ingest a `FabricGraphExport`
+- dashboard/search views can answer provider, consumer, unresolved, and blast
+  radius questions from the ingested graph