build: keep generated orientation brief local and untracked
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
codex
parent
b06d1f0b37
commit
53d34bc4f4
3 changed files with 11 additions and 159 deletions
|
|
@ -1,159 +0,0 @@
|
|||
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
||||
# Custodian Brief — railiance-platform
|
||||
|
||||
**Domain:** financials
|
||||
**Last synced:** 2026-10-18 10:49 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Implement Platform bindings for the browser SecurityCase successor
|
||||
Progress: 1/4 done | workplan_id: `43110f82-ef9f-5a46-a305-f0e287b7b226`
|
||||
|
||||
**Open tasks:**
|
||||
- ► T01 — Bind the broker to reviewed acknowledged type sources `afec2053`
|
||||
- · T03 — Implement mint, guarded destruction and authenticated evidence `b5d73ec6`
|
||||
- · T04 — Implement and admit the delivery lane and capability `84f8b0a4`
|
||||
|
||||
### Prepare the exact seven private-source reader for reuse-surface
|
||||
Progress: 4/5 done | workplan_id: `b55a8aec-7457-563b-990b-4a55ca04d2f6`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Rotate or revoke dedicated seven-source reader within 90 days `f0780e75`
|
||||
|
||||
### Coordinate audit-core temporary custody and recovery exercises
|
||||
Progress: 3/4 done | workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Define the coordinated railiance01 reboot exercise `ba729d18`
|
||||
*(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)*
|
||||
|
||||
### Self-service CCR intake: clients file and progress CCRs without a platform worker
|
||||
Progress: 4/5 done | workplan_id: `bad0cc9b-e8ad-572b-8d0d-fb3adb208b4a`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T05 — Client documentation and first self-service CCR `27797fa5`
|
||||
|
||||
### Admit hourly receiver cadence and exact Qonto collector custody
|
||||
Progress: 3/4 done | workplan_id: `d57eeafb-c406-5e1e-841c-5d1288aacabf`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Collect actual producer and independent observer acceptance `7d8e5315`
|
||||
|
||||
### Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI
|
||||
Progress: 3/4 done | workplan_id: `04f7c4aa-0a24-5d61-994d-2487ca6bfb91`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Deploy the overlay `94cdfd1c`
|
||||
|
||||
### Coordinate KeyCape live Secret exposure recovery
|
||||
Progress: 4/6 done | workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Collect exact owner acknowledgements `714ae011`
|
||||
*(wait: Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule).)*
|
||||
- ! T06 — Publish the Railiance/OpenBao custody handoff `3b9748c4`
|
||||
*(wait: Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists.)*
|
||||
|
||||
### Admit the Playwright pilot and establish scoped consumer group access
|
||||
Progress: 5/6 done | workplan_id: `31933d08-c877-5fda-aff9-6220c3705c92`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Connect platform identities and prove managed consumer operation `a82762eb`
|
||||
*(wait: User admitted all identified platform humans and coding agents; their supported Kubernetes authentication/group-mapping route remains unimplemented.)*
|
||||
|
||||
### ArgoCD phase B: adopt the four existing Applications on railiance01
|
||||
Progress: 5/8 done | workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Adopt issue-core (from rapp-issue-core) `0e619658`
|
||||
- ! Adopt external-secrets (highest risk) `4ca54868`
|
||||
*(wait: Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required.)*
|
||||
- ! Turn the root back to the production lane `844ff115`
|
||||
*(wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)*
|
||||
|
||||
### Onboard rapp-policy-nexus to the ArgoCD production lane
|
||||
Progress: 3/5 done | workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Adopt policy-nexus (live, founder go-ahead) `8638fa73`
|
||||
*(wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)*
|
||||
- ! Prepare the Application and the dry-run evidence `2afb1aac`
|
||||
*(wait: Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.)*
|
||||
|
||||
### Close Forgejo primary backup coverage on Scaleway
|
||||
Progress: 3/4 done | workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Establish primary full-archive delivery and application recovery `a4807df0`
|
||||
*(wait: Durable scheduled caller, verified inventory and quota/retention gates remain open; September 15 prohibits expiration and scheduled secondary cutover.)*
|
||||
|
||||
### Close S3 service assurance and ownership gaps
|
||||
Progress: 4/7 done | workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Make backup freshness and recurring recovery evidence checkable `d64446fb`
|
||||
*(wait: D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required.)*
|
||||
- ! Produce S3 signals and prove their delivery to the evidence owner `5351e0e4`
|
||||
*(wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)*
|
||||
- ! Obtain acceptance for compatibility assets and derived-record cleanup `3b74f79c`
|
||||
*(wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)*
|
||||
|
||||
### Adopt activity-core application runtime into railiance01 GitOps
|
||||
Progress: 2/3 done | workplan_id: `b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Observe adoption and enforce bounded promotion readiness `63b44949`
|
||||
|
||||
### Implement reviewed credential lanes with separate owner gates
|
||||
Progress: 7/13 done | workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Accept and provision secrets-engine service JWT login `e0c82ea9`
|
||||
*(wait: Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.)*
|
||||
- ! Implement the platform operator-write CCR contract and Fluid lane `f47e5bc5`
|
||||
*(wait: Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.)*
|
||||
- ! Dispose of the ungoverned whynot-design npm duplicate `0dd7c9a5`
|
||||
*(wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)*
|
||||
- ! Admit the two factory audit-sender custody lanes `0ef52c26`
|
||||
*(wait: Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.)*
|
||||
- ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018) `af2d4dba`
|
||||
*(wait: Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed.)*
|
||||
- ► Implement and prove the separately approved task execution entitlement `914bf383`
|
||||
|
||||
### Coordinate KeyCape live Secret exposure recovery
|
||||
Progress: 4/6 done | workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Collect exact owner acknowledgements `e019c166`
|
||||
*(wait: Canonical RPF-WP-0027-T03: complete platform custody acknowledgements remain missing.)*
|
||||
- ! T06 — Publish the Railiance/OpenBao custody handoff `69326850`
|
||||
*(wait: Canonical RPF-WP-0027-T06: complete field/auth/expiry/handoff contract absent; September 15 operator block remains in force.)*
|
||||
|
||||
### Coordinate audit-core temporary custody and recovery exercises
|
||||
Progress: 2/4 done | workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T02 — Define the runtime database lease recovery exercise `caba7fcd`
|
||||
*(wait: Canonical RPF-WP-0015-T02: approved sender identity, fresh bounded attended window, named abort operator and live recovery receipt required.)*
|
||||
- ! T03 — Define the coordinated railiance01 reboot exercise `09cf4065`
|
||||
*(wait: Canonical RPF-WP-0015-T03: fresh outage approval, off-host snapshot, quorum/access evidence and owner execution required.)*
|
||||
|
||||
### Retract public OpenBao listener behind operator-only access
|
||||
Progress: 2/3 done | workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
|
||||
|
||||
**Open tasks:**
|
||||
- ! T03 — Complete the attended operator cutover `99f8b41f`
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Stale unread:** 14 message(s) older than 3 day(s) — triage at session start.
|
||||
**Missing thread_id:** 15 unread message(s) lack supersession chains.
|
||||
|
||||
---
|
||||
## MCP Orientation (when available)
|
||||
|
||||
If the state-hub MCP server is reachable, call:
|
||||
`get_domain_summary("financials")`
|
||||
This provides richer cross-domain context.
|
||||
If the MCP call fails, use this file as your orientation source.
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
|
|
@ -33,3 +33,6 @@ tools/vendor/bin/kubectl
|
|||
|
||||
# Derived local Repo Manager cache
|
||||
.repo-manager/
|
||||
|
||||
# Generated workstation orientation; keep local, regenerate from State Hub.
|
||||
/.custodian-brief.md
|
||||
|
|
|
|||
8
SCOPE.md
8
SCOPE.md
|
|
@ -171,3 +171,11 @@ WORK-RECORDS.md with the selected source paths. Existing generated-only guards
|
|||
and exact-scope secret scans remain in place. This is repository maintenance,
|
||||
not a runtime service, authorization decision, deployment or publication.
|
||||
Other index generators and hub-derived briefs retain their owner boundaries.
|
||||
|
||||
|
||||
## Local orientation brief
|
||||
|
||||
`.custodian-brief.md` is a generated local orientation snapshot. It remains on
|
||||
disk for offline use and is root-ignored rather than versioned. Regenerate it
|
||||
with the State Hub brief renderer; workplans and other authored repository
|
||||
records remain authoritative. Brief refreshes must not create Git commits.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue