coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(openbao): progress public listener retraction

Browse source
This commit is contained in:
codex 2026-08-18 15:30:34 +02:00
parent 8e54207167
commit 190fa7b0dc
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -48,7 +48,7 @@
| task | RMASTER-WP-0020-T06 | done | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RMASTER-WP-0020-T07 | done | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RMASTER-WP-0020-T08 | wait | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RMASTER-WP-0020-T09 | wait | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RMASTER-WP-0020-T09 | progress | — | workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RMASTER-WP-0021-T01 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
| task | RMASTER-WP-0021-T02 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |
| task | RMASTER-WP-0021-T03 | done | — | workplans/RMASTER-WP-0021-rapp-declaration-schema.md |

16
workplans/RMASTER-WP-0020-openbao-migration-to-reef-railiance.md
View file

@ -8,7 +8,7 @@ status: blocked
owner: codex
topic_slug: railiance
created: "2026-07-30"
updated: "2026-08-15"
updated: "2026-08-18"
depends_on:
- NK-WP-0022
related:
@ -276,7 +276,7 @@ the workplan to `active`; it still must not delete anything.
```task
id: RMASTER-WP-0020-T09
status: wait
status: progress
priority: high
state_hub_task_id: "287920d3-b038-495f-b521-d16cfc7ba941"
```
@ -299,6 +299,18 @@ the runbook no longer treats public DNS as the steady state, and the
declaration carries `operator` (or `private`) rather than an implicit
public grant.
2026-08-18: `railiance-platform` confirmed from live cluster state that
`bao.coulomb.social` resolves to Railiance01 and is published by the
`openbao/openbao-ui-gateway` Traefik Ingress with a trusted certificate,
HSTS, and rate limiting. This is the deliberate T06 migration-continuity
surface, not accidental drift. The later operator-accepted ADR-0008 decision
is nevertheless controlling: the snapshot records this name as a routed
close, no exposure grant exists, and the target remains
`public_ingress: false`. T09 is therefore in progress and routed back to the
owning repo to retract the public listener while preserving the ClusterIP and
establishing the named operator tunnel. No destructive T08 cleanup is
authorized by this ruling.
## Safety constraints
- Never initialize or overwrite either OpenBao instance without verified