Implement S3 service assurance and admission checks
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex
parent
8f828c7609
commit
234b1b559f
21 changed files with 1728 additions and 30 deletions
|
|
@ -1,7 +1,7 @@
|
|||
# Current platform work
|
||||
|
||||
Reviewed 2026-09-05. Six open workplans: five blocked on explicit owner/live
|
||||
gates and one ready for local work. Completed designs and implementations are
|
||||
Reviewed 2026-09-05. Six open workplans: six blocked on explicit owner/live
|
||||
gates; RPF-WP-0036 now has its repository implementation. Completed designs and implementations are
|
||||
under `archived/`; their IDs and UUIDs are preserved. The number of blocked
|
||||
plans is not a count of missing implementations or independent incidents.
|
||||
|
||||
|
|
@ -12,10 +12,10 @@ plans is not a count of missing implementations or independent incidents.
|
|||
| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
|
||||
| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; fresh synthetic-load/outage approvals and custody readiness | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
|
||||
| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | One implementation queue for secrets-engine JWT, Fluid operator KV and preflight signing | Three independent task gates; no new approval inherited from the completed designs. |
|
||||
| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | **Ready:** service guarantees, recurring evidence, S3 emission, admission consistency, ownership handoff and demand review | Local design/checking can progress while live work waits. |
|
||||
| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | Implemented local assurance/admission; waits for recurring restore evidence, Q2 reception and owner handoff | Run the assurance commands; live acceptance and external ownership remain gated. |
|
||||
|
||||
Start with RPF-WP-0036-T02/T05 for work that does not require a live credential
|
||||
or outage. Treat credential exposure closure as the highest-priority attended
|
||||
RPF-WP-0036-T02/T05/T07 are complete; T03/T04/T06 retain the remaining
|
||||
acceptance gates. Treat credential exposure closure as the highest-priority attended
|
||||
work; task order does not combine or waive approvals.
|
||||
|
||||
[Assessment and disposition of every plan](../history/2026-09-05-platform-intent-workplan-assessment.md)
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Close S3 service assurance and ownership gaps"
|
||||
domain: financials
|
||||
repo: railiance-platform
|
||||
status: ready
|
||||
status: blocked
|
||||
owner: codex
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-05"
|
||||
|
|
@ -39,7 +39,7 @@ This certifies the source review, not live service health or external acceptance
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "eebcd5c7-4cfd-5084-9a21-ca1e4e748bdd"
|
||||
```
|
||||
|
|
@ -61,7 +61,7 @@ and package dependency rather than a blanket new-cluster project here.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T03
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "d64446fb-870b-5ae9-9628-f1fb9d06c5a4"
|
||||
```
|
||||
|
|
@ -84,7 +84,7 @@ pass as restore proof. Record independent recovery-key access without values.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T04
|
||||
status: todo
|
||||
status: wait
|
||||
priority: high
|
||||
state_hub_task_id: "5351e0e4-6263-58f0-afb2-7c78c4cd6f68"
|
||||
```
|
||||
|
|
@ -105,7 +105,7 @@ finish before the receiver, but end-to-end acceptance cannot.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T05
|
||||
status: todo
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "5cded2e9-7edd-57bd-9f7e-7977b75004dc"
|
||||
```
|
||||
|
|
@ -127,7 +127,7 @@ under this task without its own owner-reviewed migration.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T06
|
||||
status: todo
|
||||
status: wait
|
||||
priority: medium
|
||||
state_hub_task_id: "3b74f79c-7366-5d00-bf0e-31c0464a8f33"
|
||||
```
|
||||
|
|
@ -154,7 +154,7 @@ the assessment and this task does not assert acceptance for another repo.
|
|||
|
||||
```task
|
||||
id: RPF-WP-0036-T07
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "b32709d2-581d-5750-a04c-e3494a42d27e"
|
||||
```
|
||||
|
|
@ -171,3 +171,53 @@ it to S3 by implication.
|
|||
review trigger, or start a bounded consumer-backed delivery plan with explicit
|
||||
acceptance criteria. “No accepted demand; keep deploy gated” is a valid result.
|
||||
No Valkey, MinIO, RabbitMQ or new provider purchase is authorized by this plan.
|
||||
|
||||
## Implementation and remaining acceptance — 2026-09-05
|
||||
|
||||
T02 completed with `assurance/service-records.json` and ADR-0004: all three
|
||||
CNPG cells, OpenBao and both backup delivery surfaces disclose unsupported
|
||||
availability/RPO/RTO guarantees, existing evidence, retention and named decision
|
||||
owners. Numeric commitments have not been invented or approved for other owners.
|
||||
|
||||
T05 completed with the owner-native admission checker, hash-bound baseline and
|
||||
placement registry. It reuses local/package validators and rejects unowned
|
||||
consumers, fifth consumers, unhonoured retention and source disclosure drift.
|
||||
Corrected tenant-engine's completed PostgreSQL cutover and the deployed SBOM
|
||||
overflow cell. Live metadata matches one instance, 1Gi limit, 100 connections
|
||||
and 30-day retention on all three deployed cells. Dated owner evidence remains
|
||||
the authority for database/application cutover; this run moved no workloads.
|
||||
|
||||
T07 completed with ADR-0005: reuse approved backup storage only for backup;
|
||||
evaluate artifact-store's existing S3 interface for artifact demand; defer
|
||||
cache, general object store and broker deployment with concrete demand/review
|
||||
triggers. The fleet Q3 question is retained in T06's prepared master handoff;
|
||||
no external architecture assignment or provisioning occurred.
|
||||
|
||||
T03/T04 have working read-only `assurance-capture`, `assurance-check` and
|
||||
`assurance-admission` entry points plus adversarial tests. The collector pins
|
||||
the cluster UID and reads selected status, native aggregate connection counts,
|
||||
metrics and unauthenticated seal status. It captures no Secrets, SQL text from
|
||||
sessions, application rows or logs. Healthy/stale/missing/unavailable/failed
|
||||
are distinct; unknown fields, future timestamps and wrong clusters fail closed.
|
||||
The output explicitly says unmonitored and unsupported guarantees.
|
||||
|
||||
- **T03 waits:** fresh owner-validated isolated restore/snapshot/offsite receipts,
|
||||
independent recovery access, approved cadence and execution evidence. Existing
|
||||
live experiments stay in RPF-WP-0015; offsite exposure stays in RPF-WP-0029.
|
||||
No restore, snapshot creation, upload, scheduler or seal/unseal was run.
|
||||
- **T04 waits:** accepted Q2 receiving contract and controlled failure/absence
|
||||
delivery to a named recipient. The local producer is not a ratified Q2
|
||||
contract. Live metadata also surfaced failed ESO resources: forgejo-mailer,
|
||||
reuse-surface-runtime and target-revenue-runtime. Their current/obsolete scope
|
||||
and exact repair require consumer/platform acceptance before lane mutation;
|
||||
failures remain visible rather than excluded.
|
||||
- **T06 waits:** ownership acceptance and scoped alias/brief repair. The exact
|
||||
path/hash/caller inventory, dated retention decision through 2026-10-05 and
|
||||
prepared owner requests are in `assurance/ownership-handoffs.json` and
|
||||
`docs/platform-ownership-handoffs.md`. The installed brief generator still
|
||||
includes open legacy aliases; rerunning it alone cannot satisfy acceptance.
|
||||
No messages or external handoff acceptance were fabricated.
|
||||
|
||||
Evidence: `docs/evidence/RPF-WP-0036-assurance-2026-09-05.json`.
|
||||
The plan is blocked on these explicit live/owner gates, not finished merely
|
||||
because its repository implementation and tests pass.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue