Finish Core Hub private shadow onboarding

workplans/RPF-WP-0021-core-hub-platform-onboarding.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Unblock rapp-core-hub publication and platform onboarding"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-20"
-updated: "2026-08-20"
+updated: "2026-08-21"
 related:
   - CORE-WP-0011
   - RAPPCOREHUB-WP-0001
@@ -154,7 +154,7 @@ deletion, and names `core_hub_owner` as owner.
 
 ```task
 id: RPF-WP-0021-T03
-status: progress
+status: done
 priority: high
 ```
 
@@ -182,22 +182,22 @@ Prefer the mounted-file approach for steady state. A time-bounded automatic
 restart contract may be used for the relocation only if rollback and lease
 overlap are proven and the temporary limitation is recorded.
 
-Progress 2026-08-20: package chart `0.3.0` implements the bounded relocation
-contract. Static API, runtime database, and migration database credentials are
-mounted from three disjoint Secrets; the database URL is constructed only in
-the supervised child environment. A PID 1 watcher fingerprints mounted files
-without logging values and exits 75 on change so Kubernetes restarts the API
-on the refreshed lease. The migration Job mounts only its role. Seven package
-tests prove separation, URL encoding, no credential output, and rotation exit;
-Helm lint, family validation, normal server dry-run, and migration-enabled
-server dry-run pass. T03 remains `progress` until T04 proves a live ESO refresh,
-container replacement, and readiness before the old runtime lease expires.
+Completed 2026-08-21. Static API, runtime database, and migration database
+credentials are mounted from three disjoint Secrets; the database URL exists
+only in the supervised child environment, and the migration Job mounts only
+its role. Live proof exposed that chart `0.3.0` watcher exit 75 could accumulate
+planned Kubelet restarts into CrashLoopBackOff. Chart `0.3.1` (`rapp-core-hub`
+commit `7cfa8bb`) instead keeps PID 1 alive and restarts only the application
+child after reading the refreshed files. Nine package tests and live proof
+showed a changed Secret resourceVersion and child PID with stable pod UID,
+container restart count `0 -> 0`, restored readiness, and the five-minute
+refresh interval restored.
 
 ## T04 — Declare and apply the OpenBao/ESO lanes
 
 ```task
 id: RPF-WP-0021-T04
-status: progress
+status: done
 priority: high
 ```
 
@@ -241,11 +241,20 @@ configuration still waits for the attended OpenBao authority; concurrent
 tenant-engine workplan edits in that repository were preserved and excluded
 from this commit.
 
+Completed 2026-08-21 after the operator approved State Hub decision
+`4f70311b-a4c4-4959-b1a1-cdd1be97d523` and completed attended OpenBao OIDC.
+The policy, auth role, database roles, two namespace-limited stores, and three
+disjoint ExternalSecrets are live and Ready. The existing API token moved
+directly from source Kubernetes custody into OpenBao without appearing in
+output. Outside-namespace store denial, exact-path Kubernetes-auth denial,
+runtime DDL denial, migration DDL success, ESO sync, and live lease rotation
+all passed. `CCR-2026-0013` is verified.
+
 ## T05 — Support the private shadow restore and verification
 
 ```task
 id: RPF-WP-0021-T05
-status: wait
+status: done
 priority: high
 ```
 
@@ -266,14 +275,23 @@ PostgreSQL port; it was deleted after the check. No dump or restore was
 attempted ahead of the T04 credential gate. Evidence:
 `docs/evidence/core-hub-shadow-preflight-2026-08-20.md`.
 
+Completed 2026-08-21. A consistent logical archive restored all eight source
+tables and 39 rows at Alembic revision `20260627_0002`; the restored tables
+were reconciled into the accepted `core_hub` schema with owner and runtime
+grants verified. Helm release revision 2 deployed chart `0.3.1` with Ingress
+disabled, and the migration Job completed. The hardened private verifier and
+authenticated smoke `20260820224419-43dc05` passed all health, readiness,
+catalog, denial, and protected-operation checks. Detailed non-secret evidence:
+`docs/evidence/core-hub-private-shadow-2026-08-21.md`.
+
 ## Acceptance
 
 - [x] Private Forgejo repo exists, validated commit `4403c9b` is preserved,
       and the registered workplan prefix is consistent.
 - [x] Core Hub is an accepted, capacity-reviewed `rapp-postgres` consumer.
-- [ ] Static API-token and dynamic database credentials have distinct,
+- [x] Static API-token and dynamic database credentials have distinct,
       least-privilege delivery paths.
-- [ ] Database credential rotation cannot leave a running pod using an expired
+- [x] Database credential rotation cannot leave a running pod using an expired
       environment value.
-- [ ] Private shadow restore, reconciliation, migration, and consumer smokes
+- [x] Private shadow restore, reconciliation, migration, and consumer smokes
       pass without enabling public Ingress.