coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete live State Hub signing activation and rotation acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 18:12:37 +02:00
parent ae27a42b18
commit 5d6d8724b4
7 changed files with 167 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

24
docs/credential-lane-designs/state-hub-preflight-activation.md
View file

@ -35,7 +35,7 @@ cross-namespace store references. Coding-agent data AND metadata are denied.
```sh
warden access openbao-platform-admin-login --exec -- \
/usr/bin/python3 /home/worsch/railiance-platform/scripts/state_hub_preflight_lane.py \
provision --expected-version 0 --kubeconfig /home/worsch/.kube/config \
provision --expected-version 0 --kubeconfig /home/worsch/.kube/config-railiance01 \
--receipt /tmp/statehub-preflight-provision.json --confirm 'APPLY CCR-2026-0015'
```
@ -107,3 +107,25 @@ preserving every unrelated live rule. It does not deploy the pending Policy
Nexus source-only change as part of this lane. The global source policy retains
its desired rules; live parity for that other lane remains a platform assurance
observation, not an acceptance claim here.
## Accepted activation — 2026-09-05
T04 completed; CCR-2026-0015 is active. Version 1 was generated with CAS zero,
then version 2 was generated with CAS 1 during the all-API-replicas outage.
Both custody receipts passed exact read and scope/identity denials. ESO is Ready;
Helm revision 59 enabled the API-only binding with the existing image. The
post-rotation API probe passed key equality, primary health, new signed preflight
and predecessor signature rejection. No repository rename was executed.
ESO v0.16.1 required token self-validation and cleanup despite the deliberate
absence of the default policy. The exact read policy now additionally permits
`auth/token/lookup-self` read and `auth/token/revoke-self` update. It adds no KV
metadata, parent list or secret write. Source evidence:
https://github.com/external-secrets/external-secrets/blob/v0.16.1/pkg/provider/vault/auth.go
The bounded `repair-policy` action refuses drift and does not regenerate a key.
Use the dedicated kubeconfig above, whose port-forward endpoint is 16444;
the default config's 16443 listener was unavailable. Always verify the pinned
cluster UID. Protected predecessor fixture was removed after acceptance.
Receipts: `docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`.

4
docs/credential-lane-designs/state-hub-preflight-signing.md
View file

@ -1,6 +1,8 @@
# State Hub repository-rename preflight signing lane
Status: implementation staged, not provisioned. Owner: railiance-platform, RPF-WP-0035-T04.
Status: active; accepted 2026-09-05. Owner: railiance-platform, RPF-WP-0035-T04.
CCR-2026-0015 is active at key version 2. See
`state-hub-preflight-activation.md` for the accepted implementation and evidence.
Demand: State Hub message `cd52ba10-de41-46ce-aa8b-9b44050da8f7`,
STATE-WP-0085-T09. Provisioning this lane does not authorize any repository rename.