coulomb/railiance-apps
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAPPS-WP-0016-T01: break-glass admin sealed and verified
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
forgejo_admin password lives only in OpenBao
platform/workloads/forgejo/break-glass-admin (v1); founder-run local
sign-in passed (HTTP 200, site admin). Value-free evidence committed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1031639@bnt-lap001
Assistant-Session: e5073fee-f4ae-4fc3-a75a-6c1fc83e0576
This commit is contained in:
tegwick 2026-10-17 11:41:51 +02:00
parent fe5cabecd6
commit 74213d80f0
4 changed files with 30 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.custodian-brief.md
View file

@ -2,7 +2,7 @@
# Custodian Brief — railiance-apps
**Domain:** financials
**Last synced:** 2026-10-17 09:25 UTC
**Last synced:** 2026-10-17 09:32 UTC
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
## Active Workstreams
@ -19,7 +19,7 @@ Progress: 0/5 done | workplan_id: `f6b1d6f6-0abb-5774-87b9-bf3cfb640a3b`
*(wait: Restricting local password sign-in is a founder decision once NetKingdom sign-in is proven.)*
- ! T04 — Decide on local password sign-in `728786c9`
*(wait: Waits for the NK-WP-0048-T16 option decision and net-kingdom's answer to the Apps needs-change record.)*
- · Tasks `98004ed0`
- ► Tasks `98004ed0`
### Coulomb-social persistent personal workspace release
Progress: 3/4 done | workplan_id: `79abacf8-361e-51ab-829d-40dec8e142d1`
@ -36,8 +36,8 @@ Progress: 2/3 done | workplan_id: `c7fdaa7e-cab8-5d1d-86c2-f1aad7927c57`
## Inbox Hygiene
**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 4 unread message(s) lack supersession chains.
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
**Missing thread_id:** 2 unread message(s) lack supersession chains.
---
## MCP Orientation (when available)

2
WORK-RECORDS.md
View file

@ -38,7 +38,7 @@
| task | RAPPS-WP-0015-T02 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
| task | RAPPS-WP-0015-T03 | done | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
| task | RAPPS-WP-0015-T04 | wait | — | workplans/RAPPS-WP-0015-coulomb-personal-content-release.md |
| task | RAPPS-WP-0016-T01 | todo | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
| task | RAPPS-WP-0016-T01 | progress | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
| task | RAPPS-WP-0016-T02 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
| task | RAPPS-WP-0016-T03 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |
| task | RAPPS-WP-0016-T04 | wait | — | workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md |

18
docs/evidence/2026-10-17-forgejo-breakglass-signin.json Normal file
View file

@ -0,0 +1,18 @@
{
"schema": "railiance-apps.forgejo-breakglass-signin.v1",
"task": "RAPPS-WP-0016-T01",
"forgejo": "https://forgejo.coulomb.social",
"account": "forgejo_admin",
"auth": "local password (API basic auth)",
"http_status": 200,
"login_matches": true,
"is_admin": true,
"custody": {
"openbao_path": "platform/workloads/forgejo/break-glass-admin",
"field": "PASSWORD",
"version": "1"
},
"verified_at": "2026-10-17T09:41:18Z",
"result": "pass",
"values_emitted": false
}

11
workplans/RAPPS-WP-0016-forgejo-netkingdom-login.md
View file

@ -48,9 +48,7 @@ side is key-cape `KEY-WP-0038`.
```task
id: RAPPS-WP-0016-T01
status: progress
needs_human: true
blocking_reason: "Tooling and runbook ready; founder runs make forgejo-breakglass-seal and make forgejo-breakglass-verify."
status: done
priority: high
state_hub_task_id: "98004ed0-83e6-5f6e-9b18-15b8b2aec2e7"
```
@ -65,11 +63,16 @@ sign-in and record it without the credential.
Acceptance: a recorded break-glass sign-in, with the recovery path written down.
This is the "never lock ourselves out" floor for every later step.
Done 2026-10-17: founder sealed `forgejo_admin` into OpenBao
`platform/workloads/forgejo/break-glass-admin` (version 1) and verified a local
sign-in (HTTP 200, site admin): `docs/evidence/2026-10-17-forgejo-breakglass-signin.json`.
Recovery path: `docs/forgejo-on-railiance01.md` § Break-glass administrator.
```task
id: RAPPS-WP-0016-T02
status: wait
depends_on: [RAPPS-WP-0016-T01, KEY-WP-0038-T02]
blocking_reason: "Needs break-glass in place and the NetKingdom client registered with its secret in custody."
blocking_reason: "Break-glass done (T01); needs the NetKingdom client registered with its secret in custody (KEY-WP-0038-T02)."
priority: high
state_hub_task_id: "13cd3aec-c87d-5d3f-a421-39d8ff131edd"
```