From cb428442ebcaf5a961384bc81b85c9821e576e54 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Mon, 3 Aug 2026 21:30:17 +0200
Subject: [PATCH] Advance OpenBao migration to consumer waves

---
 WORK-RECORDS.md                               |  4 ++--
 tools/openbao-attended-unseal-target.sh       | 13 ++++++++++++
 ...020-openbao-migration-to-reef-railiance.md | 20 +++++++++++++++++--
 3 files changed, 33 insertions(+), 4 deletions(-)
 create mode 100755 tools/openbao-attended-unseal-target.sh

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 2e13d4e..6ae667c 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -40,8 +40,8 @@
 | task | RAILIANCE-WP-0020-T01 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T02 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T03 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
-| task | RAILIANCE-WP-0020-T04 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
-| task | RAILIANCE-WP-0020-T05 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| task | RAILIANCE-WP-0020-T04 | done | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
+| task | RAILIANCE-WP-0020-T05 | progress | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T06 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T07 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
 | task | RAILIANCE-WP-0020-T08 | wait | — | workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md |
diff --git a/tools/openbao-attended-unseal-target.sh b/tools/openbao-attended-unseal-target.sh
new file mode 100755
index 0000000..e46ec54
--- /dev/null
+++ b/tools/openbao-attended-unseal-target.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+remote=(ssh -tt railiance01)
+unseal='kubectl -n openbao exec -it openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao operator unseal'
+status='kubectl -n openbao exec openbao-0 -- env BAO_ADDR=http://127.0.0.1:8200 bao status'
+
+echo "Private railiance01 target: enter rotated source share 1 of 2 at the hidden prompt."
+"${remote[@]}" "$unseal"
+echo "Private railiance01 target: enter a different rotated source share at the hidden prompt."
+"${remote[@]}" "$unseal"
+echo "Private railiance01 target status:"
+"${remote[@]}" "$status"
diff --git a/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md b/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
index 68c539a..753ec6a 100644
--- a/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
+++ b/workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md
@@ -123,7 +123,7 @@ output was non-empty. Machine-readable evidence is in
 
 ```task
 id: RAILIANCE-WP-0020-T04
-status: wait
+status: done
 priority: high
 state_hub_task_id: "d04d7fdd-bd00-407a-8954-101b680ed327"
 ```
@@ -136,11 +136,22 @@ change public DNS or consumers yet.
 Done when target semantic probes match the source and repeated restart/unseal
 tests pass through a private endpoint.
 
+Completed 2026-08-03. A final source snapshot was encrypted and uploaded
+offsite (plaintext SHA-256
+`ac5e27536c01c3a019c3dde1069866569112c76d8ab42ec2bdb45724cc9b13f8`,
+encrypted SHA-256
+`22003d8fcb12ef17d6edafad9358ed2b0e538b21a8daee86445d9b85482f9161`).
+The still-empty railiance01 target was restored privately, temporary init
+material and plaintext staging were removed, and two attended target
+restart/unseal cycles passed. The target is active on OpenBao 2.5.4 with the
+source cluster ID and a non-empty persistent audit file. CoulombCore remains
+live and no public DNS changed.
+
 ## T05 - Migrate consumers to local workload identity
 
 ```task
 id: RAILIANCE-WP-0020-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "f0a82e4e-8074-4a22-b1e9-f01ec0ff76a1"
 ```
@@ -154,6 +165,11 @@ rollout, and reversal before continuing.
 Done when all railiance01 consumers use the local private service and no
 runtime dependency requires the CoulombCore API.
 
+2026-08-03: Wave 1 (`reuse`) moved to
+`http://openbao.openbao.svc:8200`. The ClusterSecretStore remained Valid, a
+forced ExternalSecret refresh completed as SecretSynced/Ready, and the
+declarative owner change was committed in `railiance-platform@33b36e8`.
+
 ## T06 - Cut over public OpenBao DNS and operator access
 
 ```task