From 6dd362014b0c8a4230821e4f4a392f866e0b5a1b Mon Sep 17 00:00:00 2001
From: custodian-sync <custodian-sync@railiance.local>
Date: Sat, 25 Jul 2026 10:41:51 +0200
Subject: [PATCH] chore(consistency): renormalize lifecycle state [auto]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updated by fix-consistency on 2026-07-25:
  - workplan status: ready → active
---
 ...P-0012-rapp-openbao-extraction-boundary.md | 110 ++++++++++++++++++
 1 file changed, 110 insertions(+)
 create mode 100644 workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md

diff --git a/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md b/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md
new file mode 100644
index 0000000..ce6567d
--- /dev/null
+++ b/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md
@@ -0,0 +1,110 @@
+---
+id: RAILIANCE-WP-0012
+type: workplan
+title: "rapp-openbao extraction boundary"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-07-25"
+updated: "2026-07-25"
+state_hub_workstream_id: "6ec5f317-e6c6-48e8-a7d4-850c13541641"
+---
+
+# RAILIANCE-WP-0012 - rapp-openbao extraction boundary
+
+## Goal
+
+Prepare the first `rapp-*` extraction by separating the OpenBao workload package
+surface from the broader S3 platform ownership in `railiance-platform`.
+
+This workplan follows the first-wave `rapp-*` order defined in
+`/home/worsch/railiance-master/docs/rapp-first-wave-candidates.md`.
+
+## Boundaries
+
+This workplan may:
+
+- identify which OpenBao assets belong to a future `rapp-openbao`
+- record which OpenBao-related concerns remain platform-owned
+- prepare the handoff contract between the future wrapper and S3 platform policy
+
+It must not:
+
+- weaken `railiance-platform` as the owner of secrets custody and policy
+- move shared credential lane or approval machinery into the workload wrapper
+- require a repo rename or live deployment change before the package boundary is clear
+
+## T01 - Separate package assets from platform-governance assets
+
+```task
+id: RAILIANCE-WP-0012-T01
+status: todo
+priority: high
+state_hub_task_id: "498a89e1-67e1-4860-8c73-cc38dd92083c"
+```
+
+Classify the current OpenBao-related files into:
+
+- workload package assets for `rapp-openbao`
+- shared platform governance and policy that stays in `railiance-platform`
+
+Done when the distinction is written against real file paths and current usage.
+
+## T02 - Define the first `rapp-openbao` move set
+
+```task
+id: RAILIANCE-WP-0012-T02
+status: todo
+priority: high
+state_hub_task_id: "67526f71-0220-45fb-ab9d-8cef5628257c"
+```
+
+Prepare the first move set for the wrapper, including likely candidates such as:
+
+- Helm values and middleware for the OpenBao workload
+- UI overlay wrapper assets
+- workload-specific deploy/verify scripts
+- workload-health and recovery runbooks
+
+Done when the future wrapper has a concrete first file inventory.
+
+## T03 - Record the retained S3 platform responsibilities
+
+```task
+id: RAILIANCE-WP-0012-T03
+status: todo
+priority: high
+state_hub_task_id: "30036060-85ec-4a24-a428-9f31dd58f853"
+```
+
+Record what must remain in `railiance-platform`, including:
+
+- runtime secret custody as a platform capability
+- workload lane policy and approval flows
+- cross-workload secret delivery conventions
+- platform-wide operator guidance that is not OpenBao-package specific
+
+Done when the wrapper cannot be mistaken for the new S3 ownership home.
+
+## T04 - Prepare the repo-creation handoff for `rapp-openbao`
+
+```task
+id: RAILIANCE-WP-0012-T04
+status: wait
+priority: medium
+state_hub_task_id: "25bf2d11-4a85-4259-9027-79768a23a06c"
+```
+
+Blocked on T01-T03 and the creation of the future `rapp-openbao` repo.
+
+Prepare the minimal handoff needed to create the wrapper repo without breaking
+current operators or losing source-of-truth clarity inside `railiance-platform`.
+
+Done when the future package extraction can start from a stable boundary.
+
+## Notes
+
+This workplan is repo-local. The framework-level sequencing stays in
+`railiance-master/workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md`.