Prepare OpenBao authority migration

workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Migrate authoritative OpenBao from CoulombCore to reef-railiance"
 domain: financials
 repo: railiance-master
-status: ready
+status: active
 owner: codex
 topic_slug: railiance
 created: "2026-07-30"
-updated: "2026-07-30"
+updated: "2026-08-03"
 depends_on:
   - NK-WP-0022
 state_hub_workstream_id: "0616a297-18c5-4c4e-a4fc-69135b3f9a15"
@@ -42,7 +42,7 @@ run on scale-to-zero Knative.
 
 ```task
 id: RAILIANCE-WP-0020-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "0d40e879-ae4e-45de-aa31-81bf110924dc"
 ```
@@ -56,11 +56,17 @@ all consumers that bypass ESO or depend on the public address.
 Done when source, empty target, and every consumer have a machine-readable
 dependency map plus explicit rollback owners.
 
+Completed 2026-08-03. The non-secret source, target, and consumer dependency
+map is recorded in
+`docs/evidence/openbao-migration-inventory-2026-08-03.json`. It includes six
+ClusterSecretStores, nine ExternalSecrets, state/auth counts, storage and
+version topology, and rollback ownership without secret values.
+
 ## T02 - Ratify migration, seal, and custody design
 
 ```task
 id: RAILIANCE-WP-0020-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "c266dce7-7d89-454a-a299-48fc169efea1"
 ```
@@ -75,11 +81,16 @@ its executive approval gate.
 Done when the procedure has preconditions, abort points, rollback commands,
 RTO/RPO, and no secret material in Git or State Hub.
 
+Completed 2026-08-03. The ratified procedure, custody boundary, consumer
+waves, abort points, rollback, retention, RTO, and RPO are documented in
+`docs/openbao-coulombcore-to-railiance01-runbook.md`. The empty target release
+was aligned to OpenBao 2.5.4, matching the source.
+
 ## T03 - Prove backup and isolated restore before cutover
 
 ```task
 id: RAILIANCE-WP-0020-T03
-status: todo
+status: wait
 priority: high
 state_hub_task_id: "88671108-cf8c-4de6-b1ce-06e99b1c3d70"
 ```
@@ -93,6 +104,14 @@ restart/unseal behavior.
 Done when restore evidence is machine-readable and rollback does not depend on
 the live source remaining healthy.
 
+2026-08-03: Created a fresh authoritative snapshot, encrypted it before
+offsite upload, removed plaintext staging, and recorded only fingerprints.
+A second fresh snapshot restored successfully into an isolated OpenBao 2.5.4
+pod on railiance01. The restored instance correctly resealed under the source
+Shamir barrier. The remaining semantic and repeated restart/unseal proof needs
+two of the three existing source shares through the attended custody ceremony;
+no supported automated custody route exposes those shares.
+
 ## T04 - Restore authoritative state on railiance01
 
 ```task