coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close three-lane ESO recovery with live verification and cleanup evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 19:00:19 +02:00
parent 3759850cc4
commit 08a406f2f8
6 changed files with 288 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/RPF-WP-0036-platform-service-assurance.md
View file

@ -221,3 +221,11 @@ The output explicitly says unmonitored and unsupported guarantees.
Evidence: `docs/evidence/RPF-WP-0036-assurance-2026-09-05.json`.
The plan is blocked on these explicit live/owner gates, not finished merely
because its repository implementation and tests pass.
2026-09-05 ESO recovery follow-up: RPF-WP-0037 resolved all three delivery
failures using exact Kubernetes authentication. Custody values were unchanged,
negative checks and repeated refresh passed, obsolete invalid delivery tokens
were removed, and all 27 ExternalSecrets now report Ready. The earlier dated
assurance snapshot is retained as historical evidence. T04 still waits on the
accepted Q2 receiver and controlled failure/absence transport proof.

26
workplans/RPF-WP-0037-eso-static-token-recovery.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Recover three active ESO lanes from static-token authentication failure"
domain: financials
repo: railiance-platform
status: active
status: finished
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -21,7 +21,7 @@ consumers. RPF-WP-0036-T04 retains the separate telemetry acceptance gate.
```task
id: RPF-WP-0037-T01
status: progress
status: done
priority: high
state_hub_task_id: "e0e7ff05-01bf-58db-a18e-4c5e48a697fc"
```
@ -35,7 +35,7 @@ before any resync if custody disagrees with the deployed Secret.
```task
id: RPF-WP-0037-T02
status: todo
status: done
priority: high
state_hub_task_id: "01dd799d-f967-57d6-9cf0-9b01971e5bf1"
```
@ -50,7 +50,7 @@ each store. Persist source before apply. Do not overwrite workload key material.
```task
id: RPF-WP-0037-T03
status: todo
status: done
priority: high
state_hub_task_id: "ee47707c-289b-5bea-a2ad-fdf40fed7034"
```
@ -60,3 +60,21 @@ unchanged deployed key material and healthy consumers. Record safe receipts and
retire obsolete bootstrap instructions. Remove obsolete static token references
from stores; retain old token Secret objects until their invalidity is proven.
Commit and synchronize file-backed work and report any remaining gates.
## Completion — 2026-09-05
All three lanes migrated and passed fresh reconciliation, exact reads,
wrong-SA/namespace/audience rejection, bounded TTL and sibling/write denial.
OpenBao workload values matched deployed Secrets before and after migration;
no application credential rotation or consumer rollout was requested. Native
admin lookup proved old tokens invalid; after proving zero store references,
all three obsolete token Secrets were removed with deletion preconditions.
All 27 cluster ExternalSecrets are Ready and all three consumers have one ready
replica. 187 tests and credential request validation passed. Current source,
CCR-2026-0005 delivery binding and bootstrap guidance are updated.
Evidence: `docs/evidence/RPF-WP-0037-eso-auth-recovery-2026-09-05.json`.
Runbook: `docs/eso-auth-recovery.md`.
RPF-WP-0036-T04 retains the independent Q2 signal-delivery acceptance gate;
backup credential recovery and operator-only cutover remain in WP-0029/0025.