coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Schedule OpenBao retention closeout

Browse source
This commit is contained in:
codex 2026-08-04 00:53:34 +02:00
parent e24b3591a7
commit a89019eae1
4 changed files with 38 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -12,7 +12,7 @@
| workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
| workplan | RAILIANCE-WP-0018 | finished | — | workplans/RAILIANCE-WP-0018-first-wave-repo-family-materialization.md |
| workplan | RAILIANCE-WP-0019 | finished | — | workplans/RAILIANCE-WP-0019-knative-qonto-runtime-on-reef-railiance.md |
| workplan | RAILIANCE-WP-0020 | active | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| workplan | RAILIANCE-WP-0020 | backlog | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | ADHOC-2026-07-30-T01 | done | — | workplans/ADHOC-2026-07-30.md |
| task | RAILIANCE-WP-0017-T01 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
| task | RAILIANCE-WP-0017-T02 | done | — | workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md |
@ -44,4 +44,4 @@
| task | RAILIANCE-WP-0020-T05 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T06 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T07 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
| task | RAILIANCE-WP-0020-T08 | todo | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |

32
activity-definitions/openbao-retention-closeout.md Normal file
View file

@ -0,0 +1,32 @@
---
id: "e274defb-28f2-571e-abcb-c17b57eab473"
name: "RAILIANCE-WP-0020 OpenBao Retention Closeout"
type: activity-definition
version: "1.0"
enabled: true
owner: railiance-master
governance: custodian
status: active
created: "2026-08-04"
trigger:
type: scheduled
at: "2026-08-17T08:00:00+02:00"
timezone: Europe/Berlin
---
# RAILIANCE-WP-0020 OpenBao retention closeout
One-shot reactivation after the shortened 14-day reversible-retirement window.
It emits a claimable Activity Core ops run for the remaining cleanup task; it
does not delete CoulombCore resources automatically.
```rule
id: reactivate-openbao-retention-closeout
condition: ""
action:
task_template: "Reactivate RAILIANCE-WP-0020 for OpenBao retention closeout"
description: "Move RAILIANCE-WP-0020 from backlog to active, run the railiance01 disaster-recovery drill, verify retained rollback requirements, and request fresh explicit approval before any destructive CoulombCore cleanup. Remaining task: RAILIANCE-WP-0020-T08."
target_repo: railiance-master
priority: medium
labels: ["railiance", "openbao", "retention", "reactivation", "RAILIANCE-WP-0020-T08"]
```

4
docs/openbao-coulombcore-to-railiance01-runbook.md
View file

@ -21,7 +21,7 @@ not run on Knative or scale to zero.
- The source remains unsealed and authoritative until the target passes two
restart/unseal cycles and all private consumer waves pass. During cutover it
is write-frozen, then scaled to zero while its PVCs, audit PVC, manifests,
TLS material, and encrypted snapshot remain retained for at least 30 days.
TLS material, and encrypted snapshot remain retained for at least 14 days.
## Proven preparation
@ -94,7 +94,7 @@ railiance01 API and reviewer identity before use.
snapshot over the retained source without a new reviewed recovery plan.
- Target RTO is 60 minutes from an abort decision. RPO is the bounded final
write-freeze window; the intended RPO is zero acknowledged writes.
- Keep the stopped source state and final encrypted snapshot for at least 30
- Keep the stopped source state and final encrypted snapshot for at least 14
days. PVC, Raft, Secret, audit, or TLS deletion requires fresh explicit
approval after a successful railiance01 disaster-recovery drill.

4
workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Migrate authoritative OpenBao from CoulombCore to reef-railiance"
domain: financials
repo: railiance-master
status: active
status: backlog
owner: codex
topic_slug: railiance
created: "2026-07-30"
@ -237,7 +237,7 @@ post-retirement public probe returned HTTP 200 from railiance01 with valid TLS.
```task
id: RAILIANCE-WP-0020-T08
status: wait
status: todo
priority: medium
state_hub_task_id: "1dc50d98-64e8-4755-a52e-2b94b765019e"
```