coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden backup credentials and add durable image inventory publication
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 01:53:24 +02:00
parent 62423fd092
commit 0349a08e1b
13 changed files with 365 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

36
workplans/RPF-WP-0029-backup-credential-default-removal.md Normal file
View file

@ -0,0 +1,36 @@
---
id: RPF-WP-0029
type: workplan
title: "Remove backup credential default and verify governed replacement"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
---
# Remove backup credential default and verify governed replacement
Source: State Hub message `ee702ac9-9118-4b9b-963a-01943052b65a`. Reviewed against current repository state
on 2026-09-05. Repository implementation is complete; live closure remains pending.
## Remove source fallback and verify fail-closed behavior
```task
id: RPF-WP-0029-T01
status: done
priority: high
```
Removed the literal upload credential default from tools/cmd/forgejo-backup. Missing governed input now fails before cluster operations with a value-free diagnostic; encryption dry-runs skip upload authentication. Offline tests prove missing-input denial, explicit input, and mocked OpenBao resolution.
## Invalidate predecessor and prove replacement recovery
```task
id: RPF-WP-0029-T02
status: wait
priority: high
```
Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape.