coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Track OpenBao custody handoff gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093
This commit is contained in:
codex 2026-08-23 22:01:21 +02:00
parent f607d747da
commit 51361fbf8e
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
workplans/RAILIANCE-WP-0029-keycape-live-secret-exposure-recovery.md
View file

@ -112,3 +112,19 @@ Verify replacement operation and predecessor rejection for the signing key,
LLDAP binding, Authelia client, and privacyIDEA token. Retain only safe LLDAP binding, Authelia client, and privacyIDEA token. Retain only safe
fingerprints, resource versions, public JWKS metadata, boolean results, rollout fingerprints, resource versions, public JWKS metadata, boolean results, rollout
status, timestamps, and cleanup receipts. status, timestamps, and cleanup receipts.
## T06 — Publish the Railiance/OpenBao custody handoff
```task
id: RAILIANCE-WP-0029-T06
status: progress
priority: high
```
The platform/OpenBao owner must publish a non-secret receipt for both routing
lanes: canonical mount/path, field name, KV version semantics, least-privilege
policy and auth method, expiry/rotation/revocation semantics, and the approved
attended handoff identifier. Do not infer or invent any of these values. After
publication, update `docs/net-kingdom-credential-custody-contract.md`, ask
ops-warden to refresh lane resolvability, and pass only protected inputs to
NetKingdom's minimal resolver reconciliation flow.