From 7595872b1b7e118440b9771cf39d67e3d4f3e108 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 27 Jul 2026 19:18:21 +0200 Subject: [PATCH] Finish Qonto security hardening plan --- ...-WP-0004-security-hardening-and-scale-to-zero.md | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md index c20635f..062b803 100644 --- a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md +++ b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md @@ -4,11 +4,11 @@ type: workplan title: "Security hardening and Knative runtime path for internet exposure" domain: infotech repo: qonto-assistant -status: active +status: finished owner: claude topic_slug: the-custodian created: "2026-07-23" -updated: "2026-07-26" +updated: "2026-07-27" state_hub_workstream_id: "81a476ac-06d5-4e98-a2ed-1518b16863aa" --- @@ -269,7 +269,7 @@ assets are explicitly migration input. ```task id: QONTO-WP-0004-T07 -status: todo +status: done priority: low state_hub_task_id: "2a2da206-d182-4a72-aea4-56e58ae74c76" ``` @@ -278,3 +278,10 @@ Close when T03–T06 and T08 land or are explicitly deferred with a recorded reason. T01/T02 already shipped without waiting on external dependencies, and T06 now counts as migration input rather than the final runtime shape. Run `statehub fix-consistency`. + +**2026-07-27:** Closure review passed. T03–T06 and T08 are complete, the +ownership/runtime split is implemented by `rapp-qonto` and `rail-knative`, +the OpenBao-backed secret lane is live, and restricted Qonto egress is +enforced by a controlled proxy plus a fail-closed startup gate. Remaining +deployment, rollback, and reef risk evidence belongs to +`REEF-RAILIANCE-WP-0003`, not this source-repo hardening plan.