From 00191ee8419e9dff4cb3d339b9c43b037fab9fd1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 24 Jul 2026 00:28:09 +0200 Subject: [PATCH] QONTO-WP-0004: mark T06 done Co-Authored-By: Claude Sonnet 5 --- ...04-security-hardening-and-scale-to-zero.md | 36 ++++++++++++------- 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md index 32b9b91..ec7a2a0 100644 --- a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md +++ b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md @@ -171,24 +171,36 @@ cold-start; the backend scales back to 0 after the configured idle window. ```task id: QONTO-WP-0004-T06 -status: todo +status: done priority: medium state_hub_task_id: "7cd52269-ca0a-4b09-ab51-f02ed71604f2" ``` -Per `docs/SecurityPractice.md` §7: request I1 "Reinforced" (dedicated node -pool / sandboxed runtime) at minimum for the `qonto-assistant` deployment on -`railiance01`, given tenant-confidential financial-data classification, -internet reachability via the facade, and sole custody of the bank -credential. I2 "Dedicated" (own namespace/keys) is worth considering; the -placement decision belongs to whoever owns Railiance scheduling for this -workload, not this repo. +**2026-07-24:** Made the request concrete and reviewable (this task's own +stated scope — not to implement scheduling itself). Delivered: -**Depends on:** a Railiance-side placement decision — this task's job is to -make the request concrete and reviewable, not to implement scheduling. +- `deploy/k8s/qonto-assistant/` — dedicated namespace (not shared with + `activity-core`), `Deployment` at `replicas: 0` (meant to be scaled 0↔1 by + the facade, T05), `ClusterIP`-only `Service`, default-deny `NetworkPolicy`. + Modeled on `llm-connect`'s real deployment, tightened per + `docs/SecurityPractice.md` §7. Verified: `kubectl kustomize` renders all + six resources cleanly. +- **CCR-2026-0009** (in `railiance-platform`, `status: proposed`) — a + workload-scoped Kubernetes-auth access lane into the existing + `tenants/binky/qonto-api` credential, since CCR-2026-0008 is human/OIDC + admin access only and unusable by a running pod. Mirrors CCR-2026-0003's + llm-connect pattern. Paired draft `ClusterSecretStore` also added. Both + validated against `schemas/credential-change-request.schema.yaml`. +- `railiance/app.toml` — staged-promotion contract, `criticality = "critical"` + (mandatory human approval before Stage 2 exposure and Stage 3 promotion, + per the contract's own rule for production-critical workloads). Validated + against `railiance-cluster/schemas/railiance-app.schema.json`. -Done when: a placement decision is recorded (even if the decision is "I0 for -now, revisit before going live") and referenced back into this workplan. +**Still pending, explicitly not this task's to resolve:** CCR-2026-0009 +needs platform-operator + binky-tenant-owner approval; the actual isolation +tier (I1 vs I2) is Railiance's scheduling call once the manifests are +reviewed; whether the facade (T05) co-locates in this namespace is assumed +in `networkpolicy.yaml` but not yet decided. ## Task: Closure review