c62b187559
Map SSH certificate principal agt-custodian to a dedicated custodian-agt account on Railiance01 only, converged by ssh_ca_host (tag restricted_agent_account): locked password, home 0700, no supplementary groups, no sudoers entry, no authorized_keys, and an sshd Match drop-in (05-restricted-agents.conf) with publickey only and all forwarding, tunnel and user RC off. A separate goss spec asserts the posture, including that the account cannot read the k3s kubeconfig and the sshd -T effective config. Offline tests (optional real-sshd container check). Existing tegwick mappings unchanged; their retirement is RAIL-HO-WP-0014-T03. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
6.6 KiB
6.6 KiB
Work Records — railiance-infra
Generated by
statehub fix-consistency(CUST-WP-0061-T04, work-record stage 3). Do not edit by hand — edit the source file/block listed for each record and re-run fix-consistency to refresh this index. Archived workplans are omitted; closed decisions/intakes/engagements stay listed so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
|---|---|---|---|---|
| workplan | RAIL-HO-WP-ADHOC-2026-08-22 | finished | — | workplans/ADHOC-2026-08-22.md |
| workplan | RAIL-HO-WP-0006 | finished | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| workplan | RAIL-HO-WP-0007 | finished | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| workplan | RAIL-HO-WP-0008 | finished | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| workplan | RAIL-HO-WP-0009 | finished | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| workplan | RAIL-HO-WP-0010 | finished | — | workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md |
| workplan | RAIL-HO-WP-0011 | blocked | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| workplan | RAIL-HO-WP-0012 | blocked | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| workplan | RAIL-HO-WP-0013 | blocked | — | workplans/RAIL-HO-WP-0013-host-time-baseline.md |
| workplan | RAIL-HO-WP-0014 | active | — | workplans/RAIL-HO-WP-0014-custodian-agt-restricted-host-account.md |
| task | RAIL-HO-WP-ADHOC-2026-08-22-T01 | done | — | workplans/ADHOC-2026-08-22.md |
| task | RAIL-HO-WP-ADHOC-2026-08-22-T02 | done | — | workplans/ADHOC-2026-08-22.md |
| task | RAIL-HO-WP-ADHOC-2026-08-22-T03 | done | — | workplans/ADHOC-2026-08-22.md |
| task | RAIL-HO-WP-0006-T01 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T02 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T03 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T04 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T05 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T06 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T07 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T08 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0006-T09 | done | — | workplans/RAIL-HO-WP-0006-forgejo-registry-ref-cleanup.md |
| task | RAIL-HO-WP-0007-T01 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T02 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T03 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0007-T04 | done | — | workplans/RAIL-HO-WP-0007-first-reef-rollout-and-s1-canonicalization.md |
| task | RAIL-HO-WP-0008-T01 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T02 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0008-T03 | done | — | workplans/RAIL-HO-WP-0008-railiance01-resource-and-commercial-evidence.md |
| task | RAIL-HO-WP-0009-T01 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T02 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T03 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T04 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T05 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0009-T06 | done | — | workplans/RAIL-HO-WP-0009-firewall-declared-state-and-api-exposure.md |
| task | RAIL-HO-WP-0010-T01 | done | — | workplans/RAIL-HO-WP-0010-new-reef-ports-need-a-grant.md |
| task | RAIL-HO-WP-0011-T01 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T02 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T03 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T04 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T05 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T06 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T07 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T08 | wait | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0011-T09 | done | — | workplans/RAIL-HO-WP-0011-reproducible-s1-declaration-and-handoff.md |
| task | RAIL-HO-WP-0012-T01 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T02 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T03 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T04 | done | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T05 | wait | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0012-T06 | wait | — | workplans/RAIL-HO-WP-0012-s1-backup-recovery-loop.md |
| task | RAIL-HO-WP-0013-T01 | wait | — | workplans/RAIL-HO-WP-0013-host-time-baseline.md |
| task | RAIL-HO-WP-0013-T02 | wait | — | workplans/RAIL-HO-WP-0013-host-time-baseline.md |
| task | RAIL-HO-WP-0013-T03 | wait | — | workplans/RAIL-HO-WP-0013-host-time-baseline.md |
| task | RAIL-HO-WP-0013-T04 | wait | — | workplans/RAIL-HO-WP-0013-host-time-baseline.md |
| task | RAIL-HO-WP-0014-T01 | done | — | workplans/RAIL-HO-WP-0014-custodian-agt-restricted-host-account.md |
| task | RAIL-HO-WP-0014-T02 | wait | — | workplans/RAIL-HO-WP-0014-custodian-agt-restricted-host-account.md |
| task | RAIL-HO-WP-0014-T03 | wait | — | workplans/RAIL-HO-WP-0014-custodian-agt-restricted-host-account.md |