coulomb/qonto-assistant
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish Qonto security hardening plan

Browse source
This commit is contained in:
tegwick 2026-07-27 19:18:21 +02:00
parent a8a3f7dc25
commit 7595872b1b
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Security hardening and Knative runtime path for internet exposure" title: "Security hardening and Knative runtime path for internet exposure"
domain: infotech domain: infotech
repo: qonto-assistant repo: qonto-assistant
status: active status: finished
owner: claude owner: claude
topic_slug: the-custodian topic_slug: the-custodian
created: "2026-07-23" created: "2026-07-23"
updated: "2026-07-26" updated: "2026-07-27"
state_hub_workstream_id: "81a476ac-06d5-4e98-a2ed-1518b16863aa" state_hub_workstream_id: "81a476ac-06d5-4e98-a2ed-1518b16863aa"
--- ---
@ -269,7 +269,7 @@ assets are explicitly migration input.
```task ```task
id: QONTO-WP-0004-T07 id: QONTO-WP-0004-T07
status: todo status: done
priority: low priority: low
state_hub_task_id: "2a2da206-d182-4a72-aea4-56e58ae74c76" state_hub_task_id: "2a2da206-d182-4a72-aea4-56e58ae74c76"
``` ```
@ -278,3 +278,10 @@ Close when T03–T06 and T08 land or are explicitly deferred with a recorded
reason. T01/T02 already shipped without waiting on external dependencies, and reason. T01/T02 already shipped without waiting on external dependencies, and
T06 now counts as migration input rather than the final runtime shape. Run T06 now counts as migration input rather than the final runtime shape. Run
`statehub fix-consistency`. `statehub fix-consistency`.
**2026-07-27:** Closure review passed. T03–T06 and T08 are complete, the
ownership/runtime split is implemented by `rapp-qonto` and `rail-knative`,
the OpenBao-backed secret lane is live, and restricted Qonto egress is
enforced by a controlled proxy plus a fail-closed startup gate. Remaining
deployment, rollback, and reef risk evidence belongs to
`REEF-RAILIANCE-WP-0003`, not this source-repo hardening plan.