fix(workplans): migrate archived workplans off the retired RAILIANCE-WP prefix
Completes the migration begun on 2026-08-25, which covered active workplans only. The archived copies kept their historical identifiers, and three repositories shared one number space — so their task identifiers collided, blocking task-level projection reset for those workplans. Numbering continues each repository's active sequence rather than restarting, so no identifier is reused. Projection UUIDs are re-derived from the new canonical ids. Refs CUST-WP-0068, STATE-WP-0083-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
parent
a51b8eb418
commit
47d8ec8806
4 changed files with 68 additions and 68 deletions
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
id: RAILIANCE-WP-0003
|
||||
id: RPF-WP-0021
|
||||
type: workplan
|
||||
title: "Provision shared CNPG cluster apps-pg"
|
||||
domain: financials
|
||||
|
|
@ -11,12 +11,12 @@ planning_priority: high
|
|||
planning_order: 3
|
||||
created: "2026-05-19"
|
||||
updated: "2026-05-19"
|
||||
state_hub_workstream_id: "665b3b9b-608a-4be4-84b6-dcb8261ff57b"
|
||||
state_hub_workstream_id: "aa7fe3ff-a76c-5f26-a1e0-a35e48b28d60"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# RAILIANCE-WP-0003 - Provision shared CNPG cluster apps-pg
|
||||
# RPF-WP-0021 - Provision shared CNPG cluster apps-pg
|
||||
|
||||
## Goal
|
||||
|
||||
|
|
@ -157,10 +157,10 @@ Completed on 2026-05-19.
|
|||
### T01 — Inventory and capacity check
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T01
|
||||
id: RPF-WP-0021-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "37843f2f-0022-4725-ab07-29f6ae4c1749"
|
||||
state_hub_task_id: "a7cd3fc0-4469-55a6-aed0-a8cacb34c033"
|
||||
```
|
||||
|
||||
Confirm the substrate before adding a new cluster.
|
||||
|
|
@ -190,10 +190,10 @@ pre-condition gaps.
|
|||
### T02 — Create bootstrap credential secret
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T02
|
||||
id: RPF-WP-0021-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b4777198-e42f-4ca1-b562-a595559fdf08"
|
||||
state_hub_task_id: "7cac453b-2e85-56d9-abae-d983e382246b"
|
||||
```
|
||||
|
||||
Mint the one-time bootstrap secret that CNPG uses to create the initial
|
||||
|
|
@ -227,10 +227,10 @@ template is committed.
|
|||
### T03 — Add the CNPG Cluster manifest
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T03
|
||||
id: RPF-WP-0021-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0840583d-23b2-4b93-9002-7977e6896a12"
|
||||
state_hub_task_id: "223d5a77-b7c3-5d1a-a93c-4cb9628b457a"
|
||||
```
|
||||
|
||||
Add `helm/apps-pg-cluster.yaml` modeled on `helm/gitea-db-cluster.yaml`.
|
||||
|
|
@ -276,10 +276,10 @@ validates against the cluster.
|
|||
### T04 — Add NetworkPolicies for apps-pg
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T04
|
||||
id: RPF-WP-0021-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7237f0f2-28e6-4eee-981b-06d0115cb0d1"
|
||||
state_hub_task_id: "50713b54-38a8-543d-8c74-0e3fa186fbb8"
|
||||
```
|
||||
|
||||
Add `helm/apps-pg-networkpolicies.yaml` modeled on the gitea-db triplet
|
||||
|
|
@ -311,10 +311,10 @@ label.
|
|||
### T05 — Makefile targets, deploy, verify
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T05
|
||||
id: RPF-WP-0021-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "dc346e73-eadf-4eaa-8296-358df262f648"
|
||||
state_hub_task_id: "ba4984f9-c6c5-5eb2-b4c4-83cbec59298c"
|
||||
```
|
||||
|
||||
Add targets that mirror the `db-*` (gitea-db) family:
|
||||
|
|
@ -359,10 +359,10 @@ Smoke checks:
|
|||
### T06 — Reply to railiance-apps, document the consumer contract
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0003-T06
|
||||
id: RPF-WP-0021-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "8b78934d-0a3c-413c-a66f-295092282547"
|
||||
state_hub_task_id: "9ab43324-a18c-5fbf-9f6b-c359ec93e97a"
|
||||
```
|
||||
|
||||
Notify the requester and capture the pattern.
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
id: RAILIANCE-WP-0004
|
||||
id: RPF-WP-0022
|
||||
type: workplan
|
||||
title: "Establish ArgoCD GitOps bootstrap contract"
|
||||
domain: financials
|
||||
|
|
@ -11,12 +11,12 @@ planning_priority: high
|
|||
planning_order: 4
|
||||
created: "2026-06-19"
|
||||
updated: "2026-06-25"
|
||||
state_hub_workstream_id: "e57e487b-8557-439d-8093-0457c73ede93"
|
||||
state_hub_workstream_id: "936d06c0-c1f9-5350-b426-bcc6c459db71"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# RAILIANCE-WP-0004 - Establish ArgoCD GitOps Bootstrap Contract
|
||||
# RPF-WP-0022 - Establish ArgoCD GitOps Bootstrap Contract
|
||||
|
||||
## Goal
|
||||
|
||||
|
|
@ -190,10 +190,10 @@ platform/operators/argocd/repositories/<repo-name>
|
|||
### T01 - Review intent and scope boundary
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T01
|
||||
id: RPF-WP-0022-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7cb56ad6-5435-41af-b416-e68fe661b7a0"
|
||||
state_hub_task_id: "e08723e2-f5f9-5ecb-985a-dcad60f817b7"
|
||||
```
|
||||
|
||||
Review `INTENT.md`, `SCOPE.md`, existing OpenBao delivery docs, and the
|
||||
|
|
@ -203,10 +203,10 @@ here only as a platform trust and secret-delivery contract.
|
|||
### T02 - Add ArgoCD bootstrap manifests
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T02
|
||||
id: RPF-WP-0022-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "68f7ef19-686d-4d16-bf75-ffcbba158023"
|
||||
state_hub_task_id: "6398b713-bc87-585c-ad7b-43cb73d824ad"
|
||||
```
|
||||
|
||||
Add AppProject manifests and the root app-of-apps Application under
|
||||
|
|
@ -218,10 +218,10 @@ material.
|
|||
### T03 - Define tenant onboarding and repository registration
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T03
|
||||
id: RPF-WP-0022-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "e6dc9176-af33-4216-9871-a61ad7e69943"
|
||||
state_hub_task_id: "005627fc-bec1-5c8e-b432-01baf8d0c393"
|
||||
```
|
||||
|
||||
Add documentation and templates for tenant Applications, per-repo ArgoCD
|
||||
|
|
@ -230,10 +230,10 @@ repository Secret registration, and the `issue-core` pilot example.
|
|||
### T04 - Confirm OpenBao-backed secret delivery
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T04
|
||||
id: RPF-WP-0022-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d859e4ef-d8d1-4403-8225-839925f8bedf"
|
||||
state_hub_task_id: "ae3bff13-181c-5571-a0f4-b6314d2dbcde"
|
||||
```
|
||||
|
||||
Document that OpenBao remains the runtime custody authority, External Secrets
|
||||
|
|
@ -243,10 +243,10 @@ file-reference workloads, and the OpenBao injector remains disabled.
|
|||
### T05 - Operator live bootstrap
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T05
|
||||
id: RPF-WP-0022-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "981f46c0-8dd7-4111-9a4f-2ca58ddb0664"
|
||||
state_hub_task_id: "5e09a3f5-43eb-589f-976e-c78bf8b81300"
|
||||
```
|
||||
|
||||
Apply the bootstrap and repository credentials to live ArgoCD after these repo
|
||||
|
|
@ -270,10 +270,10 @@ Do not paste credentials into the workplan, State Hub, or chat.
|
|||
### T06 - Notify first tenant
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0004-T06
|
||||
id: RPF-WP-0022-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "73bdda1d-8e25-48d2-ab92-b203c5050d45"
|
||||
state_hub_task_id: "b697cb6f-265d-54ba-a81f-5783785dad5d"
|
||||
```
|
||||
|
||||
Reply to `issue-core` with the GitOps contract pointer and confirm that it owns
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
id: RAILIANCE-WP-0006
|
||||
id: RPF-WP-0023
|
||||
type: workplan
|
||||
title: "Workload KV Access Lanes for ops-warden Fetch"
|
||||
domain: financials
|
||||
|
|
@ -17,12 +17,12 @@ depends_on_workplans:
|
|||
related_state_hub_messages:
|
||||
- "551031d1-335e-4db8-9535-820fea52d0a3"
|
||||
- "f76d3a9e-a98f-4081-885d-b79d94312699"
|
||||
state_hub_workstream_id: "96c8a93d-7a5a-4fa9-8f7b-865119551da3"
|
||||
state_hub_workstream_id: "b07930f7-ff0e-5fda-b7b9-3b56467173b1"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# RAILIANCE-WP-0006 - Workload KV Access Lanes for ops-warden Fetch
|
||||
# RPF-WP-0023 - Workload KV Access Lanes for ops-warden Fetch
|
||||
|
||||
## Goal
|
||||
|
||||
|
|
@ -94,10 +94,10 @@ without persisting the token in logs.
|
|||
## T01 - Capture ops-warden request and path contract
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T01
|
||||
id: RPF-WP-0023-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0c93496a-48bf-44e7-a75b-52e51e2639bc"
|
||||
state_hub_task_id: "95b44de2-5228-5b13-a604-d7624b3d7f7c"
|
||||
```
|
||||
|
||||
Record the ops-warden request, existing workload path convention, and proposed
|
||||
|
|
@ -120,10 +120,10 @@ values.
|
|||
## T02 - Add least-privilege OpenBao read policy
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T02
|
||||
id: RPF-WP-0023-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "9c06d531-2566-4767-aa2f-8339605f23d5"
|
||||
state_hub_task_id: "7f57507b-d660-5c66-ae19-8f936090cdf3"
|
||||
```
|
||||
|
||||
Create a concrete policy artifact for the whynot-design npm publish lane,
|
||||
|
|
@ -162,10 +162,10 @@ policy succeeded and no secret values were printed or recorded.
|
|||
## T03 - Define and apply auth bindings
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T03
|
||||
id: RPF-WP-0023-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "a217371a-0f85-40c6-b691-ac67834c86b5"
|
||||
state_hub_task_id: "7d44abc5-faee-5480-95b5-039f4212f0e3"
|
||||
```
|
||||
|
||||
Define the auth role that lets whynot-design or an approved operator identity
|
||||
|
|
@ -202,10 +202,10 @@ and `groups`, matching the platform-admin OIDC scope shape.
|
|||
## T04 - Provision the KV path without exposing the token
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T04
|
||||
id: RPF-WP-0023-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c43724a3-c83e-4ab6-b7d1-e427fd93a9a9"
|
||||
state_hub_task_id: "dd1a29b2-aa9b-5715-a3b9-1c4a4434be48"
|
||||
```
|
||||
|
||||
Have an approved operator create or confirm the OpenBao KV entry for the npm
|
||||
|
|
@ -235,10 +235,10 @@ chat, or workplans.
|
|||
## T05 - Verify caller-scoped fetch behavior
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T05
|
||||
id: RPF-WP-0023-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "dc1f470b-e78a-48a9-9957-965aed47861f"
|
||||
state_hub_task_id: "93933ad2-0a06-553c-82ef-5a83b86f5dc4"
|
||||
```
|
||||
|
||||
Prove that the authorized identity can read the token through the intended
|
||||
|
|
@ -270,10 +270,10 @@ groups bound-claim mismatch. `platform-root` was restored to the
|
|||
## T06 - Coordinate ops-warden catalog activation
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T06
|
||||
id: RPF-WP-0023-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8e84ec19-01db-4baf-a532-de87e51d4994"
|
||||
state_hub_task_id: "4b485888-de36-5795-ba39-3057dceda718"
|
||||
```
|
||||
|
||||
Send ops-warden the non-secret pointers needed to create and activate its
|
||||
|
|
@ -317,10 +317,10 @@ and that the sibling lanes remain draft for separate planning.
|
|||
## T07 - Decide whether to batch sibling workload-KV requests
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0006-T07
|
||||
id: RPF-WP-0023-T07
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "0b3ab5f5-e933-41f2-b29a-ab4ac50593aa"
|
||||
state_hub_task_id: "9a465321-673f-5087-acfa-e0608f021b8d"
|
||||
```
|
||||
|
||||
Ops-warden noted similar still-open access lanes for
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
id: RAILIANCE-WP-0007
|
||||
id: RPF-WP-0024
|
||||
type: workplan
|
||||
title: "Credential Change Proposal Review Workflow"
|
||||
domain: financials
|
||||
|
|
@ -15,12 +15,12 @@ depends_on_workplans:
|
|||
- RAIL-PL-WP-0002
|
||||
- RAILIANCE-WP-0005
|
||||
- RAILIANCE-WP-0006
|
||||
state_hub_workstream_id: "4d7ce243-f40a-4249-a46a-a24f75d6fe4c"
|
||||
state_hub_workstream_id: "6c2e61cf-7aa9-58ee-bb22-3514b9692eb5"
|
||||
---
|
||||
|
||||
> **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`).
|
||||
|
||||
# RAILIANCE-WP-0007 - Credential Change Proposal Review Workflow
|
||||
# RPF-WP-0024 - Credential Change Proposal Review Workflow
|
||||
|
||||
## Goal
|
||||
|
||||
|
|
@ -75,10 +75,10 @@ passwords, unseal/recovery material, and secret-bearing command output.
|
|||
## T01 - Record the approval workflow design
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T01
|
||||
id: RPF-WP-0024-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c82ee783-80f1-48da-a9ed-4565eac699fc"
|
||||
state_hub_task_id: "045e5d30-1dc6-5a2e-be93-b8d2311f6c3d"
|
||||
```
|
||||
|
||||
Document the desired operator workflow and why it should sit around OpenBao
|
||||
|
|
@ -99,10 +99,10 @@ interactive runbook role, and compromise/deactivation path.
|
|||
## T02 - Define the CCR schema and storage layout
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T02
|
||||
id: RPF-WP-0024-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "d50fb9e2-68c2-4a2b-8476-ce646d13e60a"
|
||||
state_hub_task_id: "8ec9d4c5-b832-5a9e-accb-8de589cd9d80"
|
||||
```
|
||||
|
||||
Create a versioned non-secret schema for credential change requests.
|
||||
|
|
@ -128,10 +128,10 @@ marks the bound claim as unconfirmed, so apply is blocked until review.
|
|||
## T03 - Add offline validation and rendering
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T03
|
||||
id: RPF-WP-0024-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "012f05cd-30ce-43dd-802b-4acc938db133"
|
||||
state_hub_task_id: "9d1cabba-8d37-5212-9cc9-69e9398fbfa3"
|
||||
```
|
||||
|
||||
Add a helper that validates CCR files and renders human review summaries.
|
||||
|
|
@ -157,10 +157,10 @@ lives in `tests/test_credential_change.py`.
|
|||
## T04 - Generate OpenBao apply plans from approved CCRs
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T04
|
||||
id: RPF-WP-0024-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "1b2e7752-815c-46f8-a2e2-212e8d04da80"
|
||||
state_hub_task_id: "7f827d6c-86c1-5d85-ac6a-6ef850636c93"
|
||||
```
|
||||
|
||||
Generate deterministic, reviewable OpenBao apply plans from CCRs.
|
||||
|
|
@ -195,10 +195,10 @@ status and confirmed auth binding.
|
|||
## T05 - Add chat/CLI approval commands
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T05
|
||||
id: RPF-WP-0024-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "e6d4d2d1-1881-4db7-92f8-05e3fdb846ae"
|
||||
state_hub_task_id: "41d76d6f-0c46-5792-a86e-dcca45004448"
|
||||
```
|
||||
|
||||
Make the workflow usable from chat and command line.
|
||||
|
|
@ -231,10 +231,10 @@ CCR id/path/policy/field/auth-role metadata plus the reviewer comment.
|
|||
## T06 - Build an interactive runbook for apply and verify
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T06
|
||||
id: RPF-WP-0024-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3c3fc38c-afa4-4367-b3e6-ba4b286ced30"
|
||||
state_hub_task_id: "d406e99b-31a3-5446-aa91-b19889698c2b"
|
||||
```
|
||||
|
||||
Wrap privileged application in an operator-friendly guided runbook.
|
||||
|
|
@ -263,10 +263,10 @@ State Hub without storing secret values.
|
|||
## T07 - Pilot with whynot-design and ops-warden
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T07
|
||||
id: RPF-WP-0024-T07
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "07a7d8bf-5528-41c8-a791-d6ccd0466a33"
|
||||
state_hub_task_id: "ab537d3f-87b0-5934-9da8-46400a232faf"
|
||||
```
|
||||
|
||||
Use the existing whynot-design npm token lane as the first end-to-end pilot.
|
||||
|
|
@ -334,10 +334,10 @@ resolvable. The remaining lifecycle work is now tracked separately in T08.
|
|||
## T08 - Add deactivation, rotation, and compromise flows
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T08
|
||||
id: RPF-WP-0024-T08
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "23d6ef9d-8dbc-4468-b486-5ec8ada71130"
|
||||
state_hub_task_id: "67f26581-7748-5d32-a280-4b0eeca01864"
|
||||
```
|
||||
|
||||
Support lifecycle states beyond initial creation.
|
||||
|
|
@ -365,10 +365,10 @@ values.
|
|||
## T09 - Add decision templates and guided review actions
|
||||
|
||||
```task
|
||||
id: RAILIANCE-WP-0007-T09
|
||||
id: RPF-WP-0024-T09
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c436fd8b-cd82-4600-81b0-87ec069d7ae6"
|
||||
state_hub_task_id: "b0d96db2-f66e-5786-ba73-3f47a26c010f"
|
||||
```
|
||||
|
||||
Remove the current friction where reviewers must know magic rationale prefixes
|
||||
Loading…
Add table
Add a link
Reference in a new issue