coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete live State Hub signing activation and rotation acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 18:12:37 +02:00
parent ae27a42b18
commit 5d6d8724b4
7 changed files with 167 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

37
history/2026-09-05-preflight-signing-activation-complete.md Normal file
View file

@ -0,0 +1,37 @@
# RPF-WP-0035-T04 completed — 2026-09-05
The user explicitly assigned this session to lead activation. The approved
CCR-2026-0015 lane was provisioned through the attended Warden/OpenBao envelope.
The dedicated kubeconfig reached the pinned primary cluster. Warden exited
successfully after each contained operation and its session cleanup.
Initial CAS-zero generation produced version 1. Exact path read, wrong service
account/namespace/audience, sibling and metadata denial, and coding-agent deny
precedence passed. ESO initially failed token lookup-self with 403. Inspection
of deployed ESO v0.16.1 source confirmed token lookup-self and revoke-self calls.
The policy was narrowly amended to permit these self-token operations; no KV
access was broadened. A drift-checked repair passed all custody checks and ESO
became Ready.
State Hub production source commit `49e3182` enabled its reviewed API-only
reference. Deployment used a fresh Forge clone of that exact revision, retained
the running image `main-cdff3b7` and existing release values, and server dry-run
showed only Deployment/state-hub changed. Helm revision 59 deployed successfully.
The single API replica matched the delivered key, returned healthy primary
identity, and produced a valid signed preflight with zero blockers for the
approved flex-auth to access-engine fixture. MCP had no key reference; the
shared environment Secret had no competing signing key.
The API deployment was scaled to zero, every matching pod terminated, and no
HPA was present. The guarded attended writer rotated with CAS 1 to version 2.
ESO refreshed; the API was restored to one replica. Forward recovery passed:
delivered key equality, health, valid new preflight, and predecessor rejection
specifically for invalid signature, not expiry. The protected predecessor
fixture was removed after verification. No repository rename was executed.
Evidence: `docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`.
CCR is active and T04 is done; other credential lanes retain their own gates.
Validation: 183 platform unit tests, 15 State Hub signing/rename API tests,
credential request validation and Helm lint passed. Live acceptance receipts
provide the operational evidence beyond these source tests.