CUST-WP-0075-T03: route human gates to hub decisions
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: fable Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
codex
parent
6cfc7e5f73
commit
4e007e46b9
7 changed files with 58 additions and 7 deletions
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-08-22"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
related:
|
||||
- AUDIT-WP-0008
|
||||
- WH-ENG-20260822-AUDIT-E2-01
|
||||
|
|
@ -180,6 +180,7 @@ live window after the Whitehat engagement cleanup.
|
|||
id: RPF-WP-0015-T03
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd
|
||||
blocked_on: message-from:railiance-infra
|
||||
blocking_reason: "Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner."
|
||||
priority: high
|
||||
|
|
@ -267,6 +268,8 @@ be retried. A future window requires a login adapter that proves isolated
|
|||
writable token-helper state and output suppression on persistence failure,
|
||||
followed by fresh owner receipts and a fresh human decision.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd (D5: Production risk acceptance and live-host authorizations) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## T04 — Route the contracts and approval gates
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-08-23"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
related:
|
||||
- KEY-WP-0011
|
||||
origin: routed
|
||||
|
|
@ -59,6 +59,7 @@ predecessor revocation, and sanitized evidence.
|
|||
id: RPF-WP-0027-T03
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocked_on: message-from:net-kingdom
|
||||
blocking_reason: "Attended resolver run: postchecks outstanding; NetKingdom asked to package the complete sequence as one receipt-producing command for the next attended session."
|
||||
priority: high
|
||||
|
|
@ -96,6 +97,8 @@ The Railiance-side custody contract is drafted at
|
|||
OpenBao path and field names unfilled pending owner confirmation; the routing
|
||||
lane remains unresolved and no credential fetch or retry is authorized.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## T04 — Execute the attended rotation
|
||||
|
||||
```task
|
||||
|
|
@ -129,6 +132,7 @@ status, timestamps, and cleanup receipts.
|
|||
id: RPF-WP-0027-T06
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "Platform/OpenBao owner must publish the non-secret routing receipt for both lanes through the attended handoff; values are never inferred."
|
||||
priority: high
|
||||
state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
|
||||
|
|
@ -147,6 +151,8 @@ Do not invent mount/path/field names. The KeyCape factor service lane from
|
|||
RPF-WP-0040 remains the separate active custody; it does not close these
|
||||
incident lanes.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Portfolio review — 2026-09-05
|
||||
|
||||
INTENT binding: secure custody and incident closure. The goal above is historical;
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: blocked
|
|||
flavor: implementation
|
||||
owner: codex
|
||||
created: "2026-09-05"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
related:
|
||||
- RPF-WP-0032
|
||||
- RPF-WP-0033
|
||||
|
|
@ -45,6 +45,7 @@ the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
|
|||
id: RPF-WP-0035-T02
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "KEY-WP-0009 finished; remaining gate is human: attended platform provisioning of the exact JWT mount/role/policy; KeyCape issuer/JWKS and service registration under KEY-WP-0009."
|
||||
priority: high
|
||||
state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e"
|
||||
|
|
@ -69,12 +70,15 @@ issuer/audience/subject/claims and unrelated secret access fail, bounded TTL
|
|||
and revocation are proven, the consumer explicitly opts into the verified
|
||||
contract, and rollback/cleanup receipts contain no secret material.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Implement the platform operator-write CCR contract and Fluid lane
|
||||
|
||||
```task
|
||||
id: RPF-WP-0035-T03
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
depends_on: [MASON-WP-0005-T02]
|
||||
blocking_reason: "Attended platform policy/schema apply after MASON-WP-0005 construction coordination confirms the capability schema."
|
||||
priority: high
|
||||
|
|
@ -101,6 +105,8 @@ only the exact matrix, negative/expiry/revocation checks pass, custody is seeded
|
|||
through the separate writer, and the verified route has a safe handoff receipt.
|
||||
The unattended adapter remains a separate demand and gets no operator session.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Accept the needed signing lane and deliver it to the owning runtime
|
||||
|
||||
```task
|
||||
|
|
@ -255,6 +261,7 @@ Rotation is a distinct, version-guarded operation.
|
|||
id: RPF-WP-0035-T07
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
|
||||
blocking_reason: "Founder HOLD (2026-09-21) on the legacy whynot-design npm pointer; custody disposition is an attended decision."
|
||||
priority: high
|
||||
state_hub_task_id: "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b"
|
||||
|
|
@ -297,12 +304,15 @@ disposition is recorded. Do not bring the legacy duplicate under a CCR. If the v
|
|||
ungoverned, treat it as an exposure with the same custody rules as RPF-WP-0027:
|
||||
never record the value, fingerprint, length or shape.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa (D3: Trust root and secret custody: unseal/recovery holders, break-glass, and the deferred rotation of exposed material) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Admit the separate approval client-side readers
|
||||
|
||||
```task
|
||||
id: RPF-WP-0035-T06
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "INFD-WP-0001-T07/T08 terminal; remaining gate is human approval of the scoped delivery proof; front door stays non-resolvable."
|
||||
priority: high
|
||||
intervention_note: ""
|
||||
|
|
@ -419,12 +429,15 @@ receipts to HFACT-WP-0001-T03, SECRETS-WP-0009-T03 and APPROVAL-WP-0002-T01/T05.
|
|||
Audit receiver/sender custody remains AUDIT-WP-0009-T09 and must not be folded
|
||||
into this client-identity grant.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Admit the two factory audit-sender custody lanes
|
||||
|
||||
```task
|
||||
id: RPF-WP-0035-T08
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "AUDIT-WP-0009-T09/T11 done; remaining gate is human: attended first-provision via factory_audit_custody.py after consuming AUDIT-WP-0009-T09/T11 declarations."
|
||||
priority: high
|
||||
assignee: railiance-platform
|
||||
|
|
@ -450,6 +463,8 @@ Approval Engine's missing namespace remains its owner prerequisite.
|
|||
[Preparation evidence](../docs/evidence/2026-09-11-factory-audit-custody.json).
|
||||
Do not fold these senders into CCR-2026-0019 or the cancelled CCR-2026-0020.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Dependency review — 2026-09-06
|
||||
|
||||
### 2026-09-09 tenant question resolved — no change needed
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: blocked
|
|||
flavor: implementation
|
||||
owner: codex
|
||||
created: "2026-09-06"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "7beec1a7-aa82-5a36-9a66-6b60008a2455"
|
||||
---
|
||||
|
||||
|
|
@ -74,6 +74,7 @@ removed. Evidence: `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`.
|
|||
id: RPF-WP-0038-T04
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483
|
||||
blocking_reason: "Operator chooses the independent archive prefix and confirms retention/caller contract and bounded worker credential delivery before the primary archive retrieval."
|
||||
priority: high
|
||||
state_hub_task_id: "a4807df0-ec96-58f1-9cbd-42b1dcde0d6f"
|
||||
|
|
@ -121,6 +122,8 @@ the existing durable caller, inventory, quota and retention gates.
|
|||
scheduled secondary delivery. The planner and attended executor stay idle until
|
||||
durable caller/inventory/quota gates are closed.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Loose-end review — 2026-09-27
|
||||
|
||||
T04 now explicitly waits. Primary and essentials manual recovery are already proven. Durable scheduled caller/dependency binding, canonical verified inventory, quota/retention gates and owner activation are still absent. September 15 prohibits expiration and scheduled secondary cutover until those gates close; no retained backups or schedules were changed. New primary transfer receipts preserve archive_profile for the assurance adapter in WP-0036-T03.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: planning
|
|||
owner: railiance-platform
|
||||
topic_slug: railiance
|
||||
created: "2026-09-21"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
due: "2026-12-21"
|
||||
related: [RPF-WP-0022]
|
||||
state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c"
|
||||
|
|
@ -171,6 +171,7 @@ render lacks but that carries the tracking label, or a digest mismatch.
|
|||
id: RPF-WP-0043-T04
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
depends_on: [RPF-WP-0043-T03, RPF-WP-0044-T07]
|
||||
blocking_reason: "Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07."
|
||||
priority: high
|
||||
|
|
@ -209,6 +210,8 @@ Rollback:
|
|||
rapp-policy-nexus `make rollback REVISION=<revision from T03>`. Otherwise
|
||||
self-heal fights the rollback.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Declare the platform's own direct-apply gap
|
||||
|
||||
```task
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: planning
|
|||
owner: railiance-platform
|
||||
topic_slug: railiance
|
||||
created: "2026-09-21"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-03"
|
||||
related: [RPF-WP-0043, RPF-WP-0022]
|
||||
state_hub_workstream_id: "98140775-3b9a-5cf9-9af6-722502d487dc"
|
||||
---
|
||||
|
|
@ -187,6 +187,7 @@ Rollback:
|
|||
id: RPF-WP-0044-T03
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
blocking_reason: "Adopted 2026-09-21; the follow-on step (issue-core adoption, then automation) waits on the founder's go-ahead."
|
||||
priority: high
|
||||
state_hub_task_id: "6d5fc801-e361-579b-bcd8-6fe719a82e94"
|
||||
|
|
@ -230,12 +231,15 @@ Rollback (R1): `git revert` the merge commit and push, then
|
|||
`ssh railiance01 'kubectl -n argocd delete application openbao-secretstore'`
|
||||
(no finalizer; the ClusterSecretStore keeps running).
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Adopt issue-core (from rapp-issue-core)
|
||||
|
||||
```task
|
||||
id: RPF-WP-0044-T04
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
blocked_on: message-from:rapp-issue-core
|
||||
blocking_reason: "Founder go-ahead plus rapp-issue-core's agreement (hub message) that ArgoCD owns production and make deploy stops being a production path."
|
||||
priority: high
|
||||
|
|
@ -257,12 +261,15 @@ Zero diff against live for both the raw `manifests/` and the rendered output
|
|||
whitelist. Live check: `rapp-issue-core make verify-live`. Workload restore:
|
||||
`rapp-issue-core make rollback`.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Adopt target-revenue
|
||||
|
||||
```task
|
||||
id: RPF-WP-0044-T05
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
blocking_reason: "Adopted 2026-09-21; remaining preconditions and the next step wait on the founder's go-ahead."
|
||||
priority: medium
|
||||
state_hub_task_id: "d418068a-6fb0-5416-aac5-d23c93924d9c"
|
||||
|
|
@ -282,12 +289,15 @@ Live check: `https://revenue.coulomb.social` health and the CNPG cluster
|
|||
healthy. Workload restore: `kubectl apply -k k8s/railiance` from the previous
|
||||
target-revenue commit.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Adopt external-secrets (highest risk)
|
||||
|
||||
```task
|
||||
id: RPF-WP-0044-T06
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
blocking_reason: "Founder go-ahead for the ESO adoption after adding CRD Prune=false,Delete=false and re-running the diff."
|
||||
priority: medium
|
||||
state_hub_task_id: "4ca54868-c31f-5e3d-b7d3-a15b84c15f80"
|
||||
|
|
@ -307,12 +317,15 @@ current `Valid` state (two, `openbao-activity-core` and
|
|||
`openbao-email-connect`, are already `ValidationFailed`). Workload restore:
|
||||
`helm template` 0.16.1 with the same values, `kubectl apply --server-side`.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Turn the root back to the production lane
|
||||
|
||||
```task
|
||||
id: RPF-WP-0044-T07
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
depends_on: [RPF-WP-0044-T03, RPF-WP-0044-T04, RPF-WP-0044-T05, RPF-WP-0044-T06]
|
||||
blocking_reason: "Founder go-ahead to restore automated prune/selfHeal on railiance-apps-root once T03-T06 are proven."
|
||||
priority: medium
|
||||
|
|
@ -325,12 +338,15 @@ change-gate decision's production row expects. From then on a merge to the
|
|||
railiance01 path is a live production change, and `RPF-WP-0043-T04`
|
||||
(policy-nexus) can use it.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Plan phase C: retire coulombcore's ArgoCD
|
||||
|
||||
```task
|
||||
id: RPF-WP-0044-T08
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
blocking_reason: "Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope."
|
||||
priority: low
|
||||
state_hub_task_id: "55d1382f-5862-5321-a1c9-96767764ba43"
|
||||
|
|
@ -341,6 +357,8 @@ session's scope. Under Option A, retiring it also removes `argocd/applications/`
|
|||
Also hand back to the cluster layer: the phase A install is not declared in
|
||||
any repository and its pods have no resource requests (BestEffort).
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Loose-end review — 2026-09-27
|
||||
|
||||
T03/T05 passed their elapsed healthy observation gate: current ArgoCD status is Synced/Healthy with last healthy transitions on September 21; openbao is Valid and issue-core-runtime is SecretSynced. They now wait on the remaining automation go-aheads and, for target-revenue, hook-owner acceptance. T06 local preparation is complete: the inactive ESO draft protects all 20 CRDs from prune/delete. The pinned 0.16.1 chart renders 39 objects; server-side diff is exactly the 20 protective metadata annotations, with no spec changes. All 25 ClusterSecretStores are Valid. T04 still needs the repository credential/production-owner contract; T07 depends on the per-app gates. T08 has a concrete retirement procedure at `docs/argocd-coulombcore-retirement.md`, but its required live inventory is blocked: SSH works and Kubernetes rejects both default and explicit local k3s kubeconfigs. No controller or workload was changed. Evidence: `docs/evidence/2026-09-27-argocd-loose-end-status.json` and `docs/evidence/2026-09-27-eso-adoption-preparation.json`.
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ status: blocked
|
|||
owner: codex
|
||||
topic_slug: railiance
|
||||
created: "2026-09-27"
|
||||
updated: "2026-09-28"
|
||||
updated: "2026-10-03"
|
||||
state_hub_workstream_id: "b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54"
|
||||
---
|
||||
|
||||
|
|
@ -42,6 +42,7 @@ health, resource inventory, schedules and original deployment generations.
|
|||
id: RPF-WP-0048-T02
|
||||
status: wait
|
||||
needs_human: true
|
||||
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
|
||||
depends_on: [ACTIVITY-WP-0041]
|
||||
blocking_reason: "24h soak after adoption, then founder confirmation of the scoped identity and checks before automated sync; ACTIVITY-WP-0041 owns publication and the promotion guard."
|
||||
priority: high
|
||||
|
|
@ -55,6 +56,8 @@ this workplan. No unattended merge credential or release executor is assumed jus
|
|||
because the Application exists. Confirm the scoped identity and checks before
|
||||
activating bounded routine promotion. Destructive pruning remains disabled.
|
||||
|
||||
2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here.
|
||||
|
||||
## Make registry retention aware of digest-pinned releases
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue