coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064-T06: pin the live production OpenBao image digest in the restore adapter
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-24 10:17:11 +02:00
parent fb0b50234d
commit 1701a3fa2a
4 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

11
workplans/RPF-WP-0064-isolated-original-openbao-restore.md
View file

@ -351,13 +351,20 @@ so a snapshot older than a later source edit yields `refused`. Signing T05 still
```task
id: RPF-WP-0064-T06
status: wait
status: done
priority: low
depends_on: [RPF-WP-0064-T02]
blocking_reason: "rapp-openbao confirms the chart 0.28.2 / image 2.5.4 pin and digest used by production at the 2026-10-14 snapshot time (rehearsal pulled quay.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115 for tag 2.5.4; not yet owner-confirmed). The confirmed digest is then written to PINNED_IMAGE_DIGEST in scripts/openbao-isolated-restore/restore_adapter.py; original-material runs refuse until it is set. Role/KV/auth definitions stay railiance-platform-owned; no rapp-openbao change requested."
state_hub_task_id: "cb689628-9a5a-5f2b-a3ec-be37bd6cdb37"
```
2026-10-24: done from the live runtime. The founder read `openbao-0` read-only: spec image
`quay.io/openbao/openbao:2.5.4`, container imageID
`docker.io/openbao/openbao@sha256:436eaf9778cad75507ff70ea26ace30dcbe15606e619ac3823495663d7f7c115`,
equal to the T04 rehearsal pull (digests are registry-independent). Written to `PINNED_IMAGE_DIGEST`;
the offline suite (17) passes. This is the current production digest. That the same digest ran at the
2026-10-14 snapshot is not separately proven; the attended run will refuse on any restore incompatibility
rather than repair. rapp-openbao was informed and may object; no rapp-openbao change requested.
## T07 — Attended original restore (phase A)
```task