diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md index a1c97d9..36745ae 100644 --- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md +++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md @@ -9,7 +9,7 @@ flavor: implementation owner: codex topic_slug: railiance created: "2026-08-22" -updated: "2026-09-27" +updated: "2026-10-03" related: - AUDIT-WP-0008 - WH-ENG-20260822-AUDIT-E2-01 @@ -180,6 +180,7 @@ live window after the Whitehat engagement cleanup. id: RPF-WP-0015-T03 status: wait needs_human: true +decision_id: 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd blocked_on: message-from:railiance-infra blocking_reason: "Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner." priority: high @@ -267,6 +268,8 @@ be retried. A future window requires a login adapter that proves isolated writable token-helper state and output suppression on persistence failure, followed by fresh owner receipts and a fresh human decision. +2026-10-03: human gate routed to hub decision 2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd (D5: Production risk acceptance and live-host authorizations) by CUST-WP-0075; resolving that decision raises C-40 here. + ## T04 — Route the contracts and approval gates ```task diff --git a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md index fadcee6..8194126 100644 --- a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md +++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md @@ -9,7 +9,7 @@ flavor: implementation owner: codex topic_slug: railiance created: "2026-08-23" -updated: "2026-09-27" +updated: "2026-10-03" related: - KEY-WP-0011 origin: routed @@ -59,6 +59,7 @@ predecessor revocation, and sanitized evidence. id: RPF-WP-0027-T03 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocked_on: message-from:net-kingdom blocking_reason: "Attended resolver run: postchecks outstanding; NetKingdom asked to package the complete sequence as one receipt-producing command for the next attended session." priority: high @@ -96,6 +97,8 @@ The Railiance-side custody contract is drafted at OpenBao path and field names unfilled pending owner confirmation; the routing lane remains unresolved and no credential fetch or retry is authorized. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## T04 — Execute the attended rotation ```task @@ -129,6 +132,7 @@ status, timestamps, and cleanup receipts. id: RPF-WP-0027-T06 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocking_reason: "Platform/OpenBao owner must publish the non-secret routing receipt for both lanes through the attended handoff; values are never inferred." priority: high state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283" @@ -147,6 +151,8 @@ Do not invent mount/path/field names. The KeyCape factor service lane from RPF-WP-0040 remains the separate active custody; it does not close these incident lanes. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Portfolio review — 2026-09-05 INTENT binding: secure custody and incident closure. The goal above is historical; diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md index 3cd0242..dafc9fc 100644 --- a/workplans/RPF-WP-0035-credential-lane-implementation.md +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -8,7 +8,7 @@ status: blocked flavor: implementation owner: codex created: "2026-09-05" -updated: "2026-09-27" +updated: "2026-10-03" related: - RPF-WP-0032 - RPF-WP-0033 @@ -45,6 +45,7 @@ the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover. id: RPF-WP-0035-T02 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocking_reason: "KEY-WP-0009 finished; remaining gate is human: attended platform provisioning of the exact JWT mount/role/policy; KeyCape issuer/JWKS and service registration under KEY-WP-0009." priority: high state_hub_task_id: "e0c82ea9-05a5-537e-8fbf-67534263572e" @@ -69,12 +70,15 @@ issuer/audience/subject/claims and unrelated secret access fail, bounded TTL and revocation are proven, the consumer explicitly opts into the verified contract, and rollback/cleanup receipts contain no secret material. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Implement the platform operator-write CCR contract and Fluid lane ```task id: RPF-WP-0035-T03 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 depends_on: [MASON-WP-0005-T02] blocking_reason: "Attended platform policy/schema apply after MASON-WP-0005 construction coordination confirms the capability schema." priority: high @@ -101,6 +105,8 @@ only the exact matrix, negative/expiry/revocation checks pass, custody is seeded through the separate writer, and the verified route has a safe handoff receipt. The unattended adapter remains a separate demand and gets no operator session. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Accept the needed signing lane and deliver it to the owning runtime ```task @@ -255,6 +261,7 @@ Rotation is a distinct, version-guarded operation. id: RPF-WP-0035-T07 status: wait needs_human: true +decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa blocking_reason: "Founder HOLD (2026-09-21) on the legacy whynot-design npm pointer; custody disposition is an attended decision." priority: high state_hub_task_id: "0dd7c9a5-65a0-53fc-b6c3-5ad96ee56f7b" @@ -297,12 +304,15 @@ disposition is recorded. Do not bring the legacy duplicate under a CCR. If the v ungoverned, treat it as an exposure with the same custody rules as RPF-WP-0027: never record the value, fingerprint, length or shape. +2026-10-03: human gate routed to hub decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa (D3: Trust root and secret custody: unseal/recovery holders, break-glass, and the deferred rotation of exposed material) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Admit the separate approval client-side readers ```task id: RPF-WP-0035-T06 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocking_reason: "INFD-WP-0001-T07/T08 terminal; remaining gate is human approval of the scoped delivery proof; front door stays non-resolvable." priority: high intervention_note: "" @@ -419,12 +429,15 @@ receipts to HFACT-WP-0001-T03, SECRETS-WP-0009-T03 and APPROVAL-WP-0002-T01/T05. Audit receiver/sender custody remains AUDIT-WP-0009-T09 and must not be folded into this client-identity grant. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Admit the two factory audit-sender custody lanes ```task id: RPF-WP-0035-T08 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocking_reason: "AUDIT-WP-0009-T09/T11 done; remaining gate is human: attended first-provision via factory_audit_custody.py after consuming AUDIT-WP-0009-T09/T11 declarations." priority: high assignee: railiance-platform @@ -450,6 +463,8 @@ Approval Engine's missing namespace remains its owner prerequisite. [Preparation evidence](../docs/evidence/2026-09-11-factory-audit-custody.json). Do not fold these senders into CCR-2026-0019 or the cancelled CCR-2026-0020. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Dependency review — 2026-09-06 ### 2026-09-09 tenant question resolved — no change needed diff --git a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md index 0f82fda..d4d8eb8 100644 --- a/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md +++ b/workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md @@ -8,7 +8,7 @@ status: blocked flavor: implementation owner: codex created: "2026-09-06" -updated: "2026-09-27" +updated: "2026-10-03" state_hub_workstream_id: "7beec1a7-aa82-5a36-9a66-6b60008a2455" --- @@ -74,6 +74,7 @@ removed. Evidence: `docs/evidence/forgejo-scaleway-restore-2026-09-06.json`. id: RPF-WP-0038-T04 status: wait needs_human: true +decision_id: 62aa95e4-3ccc-4867-8806-5e3db005b483 blocking_reason: "Operator chooses the independent archive prefix and confirms retention/caller contract and bounded worker credential delivery before the primary archive retrieval." priority: high state_hub_task_id: "a4807df0-ec96-58f1-9cbd-42b1dcde0d6f" @@ -121,6 +122,8 @@ the existing durable caller, inventory, quota and retention gates. scheduled secondary delivery. The planner and attended executor stay idle until durable caller/inventory/quota gates are closed. +2026-10-03: human gate routed to hub decision 62aa95e4-3ccc-4867-8806-5e3db005b483 (D1: Attended OpenBao provisioning window: one session clears the pending credential lanes) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Loose-end review — 2026-09-27 T04 now explicitly waits. Primary and essentials manual recovery are already proven. Durable scheduled caller/dependency binding, canonical verified inventory, quota/retention gates and owner activation are still absent. September 15 prohibits expiration and scheduled secondary cutover until those gates close; no retained backups or schedules were changed. New primary transfer receipts preserve archive_profile for the assurance adapter in WP-0036-T03. diff --git a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md index bca3b8f..66a95cc 100644 --- a/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md +++ b/workplans/RPF-WP-0043-policy-nexus-argocd-onboarding.md @@ -9,7 +9,7 @@ flavor: planning owner: railiance-platform topic_slug: railiance created: "2026-09-21" -updated: "2026-09-27" +updated: "2026-10-03" due: "2026-12-21" related: [RPF-WP-0022] state_hub_workstream_id: "ec41a4bd-df18-5b07-9b63-ccb80d9f001c" @@ -171,6 +171,7 @@ render lacks but that carries the tracking label, or a digest mismatch. id: RPF-WP-0043-T04 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e depends_on: [RPF-WP-0043-T03, RPF-WP-0044-T07] blocking_reason: "Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07." priority: high @@ -209,6 +210,8 @@ Rollback: rapp-policy-nexus `make rollback REVISION=`. Otherwise self-heal fights the rollback. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Declare the platform's own direct-apply gap ```task diff --git a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md index 6fe5f04..380b6d8 100644 --- a/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md +++ b/workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md @@ -9,7 +9,7 @@ flavor: planning owner: railiance-platform topic_slug: railiance created: "2026-09-21" -updated: "2026-09-27" +updated: "2026-10-03" related: [RPF-WP-0043, RPF-WP-0022] state_hub_workstream_id: "98140775-3b9a-5cf9-9af6-722502d487dc" --- @@ -187,6 +187,7 @@ Rollback: id: RPF-WP-0044-T03 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e blocking_reason: "Adopted 2026-09-21; the follow-on step (issue-core adoption, then automation) waits on the founder's go-ahead." priority: high state_hub_task_id: "6d5fc801-e361-579b-bcd8-6fe719a82e94" @@ -230,12 +231,15 @@ Rollback (R1): `git revert` the merge commit and push, then `ssh railiance01 'kubectl -n argocd delete application openbao-secretstore'` (no finalizer; the ClusterSecretStore keeps running). +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Adopt issue-core (from rapp-issue-core) ```task id: RPF-WP-0044-T04 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e blocked_on: message-from:rapp-issue-core blocking_reason: "Founder go-ahead plus rapp-issue-core's agreement (hub message) that ArgoCD owns production and make deploy stops being a production path." priority: high @@ -257,12 +261,15 @@ Zero diff against live for both the raw `manifests/` and the rendered output whitelist. Live check: `rapp-issue-core make verify-live`. Workload restore: `rapp-issue-core make rollback`. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Adopt target-revenue ```task id: RPF-WP-0044-T05 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e blocking_reason: "Adopted 2026-09-21; remaining preconditions and the next step wait on the founder's go-ahead." priority: medium state_hub_task_id: "d418068a-6fb0-5416-aac5-d23c93924d9c" @@ -282,12 +289,15 @@ Live check: `https://revenue.coulomb.social` health and the CNPG cluster healthy. Workload restore: `kubectl apply -k k8s/railiance` from the previous target-revenue commit. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Adopt external-secrets (highest risk) ```task id: RPF-WP-0044-T06 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e blocking_reason: "Founder go-ahead for the ESO adoption after adding CRD Prune=false,Delete=false and re-running the diff." priority: medium state_hub_task_id: "4ca54868-c31f-5e3d-b7d3-a15b84c15f80" @@ -307,12 +317,15 @@ current `Valid` state (two, `openbao-activity-core` and `openbao-email-connect`, are already `ValidationFailed`). Workload restore: `helm template` 0.16.1 with the same values, `kubectl apply --server-side`. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Turn the root back to the production lane ```task id: RPF-WP-0044-T07 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e depends_on: [RPF-WP-0044-T03, RPF-WP-0044-T04, RPF-WP-0044-T05, RPF-WP-0044-T06] blocking_reason: "Founder go-ahead to restore automated prune/selfHeal on railiance-apps-root once T03-T06 are proven." priority: medium @@ -325,12 +338,15 @@ change-gate decision's production row expects. From then on a merge to the railiance01 path is a live production change, and `RPF-WP-0043-T04` (policy-nexus) can use it. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Plan phase C: retire coulombcore's ArgoCD ```task id: RPF-WP-0044-T08 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e blocking_reason: "Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope." priority: low state_hub_task_id: "55d1382f-5862-5321-a1c9-96767764ba43" @@ -341,6 +357,8 @@ session's scope. Under Option A, retiring it also removes `argocd/applications/` Also hand back to the cluster layer: the phase A install is not declared in any repository and its pods have no resource requests (BestEffort). +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Loose-end review — 2026-09-27 T03/T05 passed their elapsed healthy observation gate: current ArgoCD status is Synced/Healthy with last healthy transitions on September 21; openbao is Valid and issue-core-runtime is SecretSynced. They now wait on the remaining automation go-aheads and, for target-revenue, hook-owner acceptance. T06 local preparation is complete: the inactive ESO draft protects all 20 CRDs from prune/delete. The pinned 0.16.1 chart renders 39 objects; server-side diff is exactly the 20 protective metadata annotations, with no spec changes. All 25 ClusterSecretStores are Valid. T04 still needs the repository credential/production-owner contract; T07 depends on the per-app gates. T08 has a concrete retirement procedure at `docs/argocd-coulombcore-retirement.md`, but its required live inventory is blocked: SSH works and Kubernetes rejects both default and explicit local k3s kubeconfigs. No controller or workload was changed. Evidence: `docs/evidence/2026-09-27-argocd-loose-end-status.json` and `docs/evidence/2026-09-27-eso-adoption-preparation.json`. diff --git a/workplans/RPF-WP-0048-activity-core-gitops-adoption.md b/workplans/RPF-WP-0048-activity-core-gitops-adoption.md index 5386455..bf8e9c9 100644 --- a/workplans/RPF-WP-0048-activity-core-gitops-adoption.md +++ b/workplans/RPF-WP-0048-activity-core-gitops-adoption.md @@ -8,7 +8,7 @@ status: blocked owner: codex topic_slug: railiance created: "2026-09-27" -updated: "2026-09-28" +updated: "2026-10-03" state_hub_workstream_id: "b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54" --- @@ -42,6 +42,7 @@ health, resource inventory, schedules and original deployment generations. id: RPF-WP-0048-T02 status: wait needs_human: true +decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e depends_on: [ACTIVITY-WP-0041] blocking_reason: "24h soak after adoption, then founder confirmation of the scoped identity and checks before automated sync; ACTIVITY-WP-0041 owns publication and the promotion guard." priority: high @@ -55,6 +56,8 @@ this workplan. No unattended merge credential or release executor is assumed jus because the Application exists. Confirm the scoped identity and checks before activating bounded routine promotion. Destructive pruning remains disabled. +2026-10-03: human gate routed to hub decision 89f1058f-33bc-47a8-8a49-0b44d426c67e (D2: ArgoCD owns production: go-ahead sequence for railiance-apps-root, issue-core, policy-nexus and activity-core automation) by CUST-WP-0075; resolving that decision raises C-40 here. + ## Make registry retention aware of digest-pinned releases ```task