coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0064: record hub ids from fix-consistency
All checks were successful
CCR intake gate / gate (push) Successful in 11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4384@bnt-lap001
Assistant-Session: 80d1f3da-7a91-4519-9737-9ba128b4da64
This commit is contained in:
codex 2026-10-23 20:16:35 +02:00
parent 3894dc7c54
commit 76b45e0e16
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
workplans/RPF-WP-0064-isolated-original-openbao-restore.md
View file

@ -16,6 +16,7 @@ related:
- RPF-WP-0036
- RPF-WP-0035
- RAPP-OPENBAO-WP-0001
state_hub_workstream_id: "e19808db-52d6-508b-b70c-6775c4f78c4f"
---
# RPF-WP-0064 — Isolated original-OpenBao restore for secrets-engine consumer continuity
@ -55,6 +56,7 @@ live step stays `wait` until attended evidence exists.
id: RPF-WP-0064-T01
status: done
priority: high
state_hub_task_id: "02b16f20-8ab3-547b-b8ac-1334139d3450"
```
### Findings (2026-10-23, read-only source survey; no cluster, OpenBao or snapshot access)
@ -128,6 +130,7 @@ id: RPF-WP-0064-T02
status: todo
priority: high
depends_on: [RPF-WP-0064-T01]
state_hub_task_id: "51adc483-5102-5723-ab64-e7a2698befe8"
```
Design `scripts/openbao-isolated-restore/` (adapter plus doc). Fixed properties:
@ -172,6 +175,7 @@ id: RPF-WP-0064-T03
status: todo
priority: high
depends_on: [RPF-WP-0064-T02]
state_hub_task_id: "69ef4a3b-7b0a-5b7b-b49a-c688f9d19554"
```
Extend `docs/openbao-restore-drill-evidence.example.json` into a v2 receipt:
@ -197,6 +201,7 @@ id: RPF-WP-0064-T04
status: todo
priority: high
depends_on: [RPF-WP-0064-T03]
state_hub_task_id: "9c10caca-d772-5608-954e-6e9f78d59a39"
```
Run the full adapter against a synthetic OpenBao, initialized on purpose with
@ -216,6 +221,7 @@ priority: high
needs_human: true
depends_on: [RPF-WP-0064-T04]
blocking_reason: "Founder must sign (SSH, secrets-engine founder-admission pattern) an attempt admission naming the snapshot ciphertext sha256, image digest, adapter commit, window start/end, abort operator and phase A only (phase B separately). Needs T04 rehearsal receipt first."
state_hub_task_id: "a954eaf9-855b-5458-9f13-c6cfed289934"
```
## T06 — Owner confirmation of package pin
@ -226,6 +232,7 @@ status: wait
priority: low
depends_on: [RPF-WP-0064-T02]
blocking_reason: "rapp-openbao confirms the chart 0.28.2 / image 2.5.4 pin (and digest) used by production at the 2026-10-14 snapshot time is the one the isolated target runs. Role/KV/auth definitions stay railiance-platform-owned; no rapp-openbao change requested."
state_hub_task_id: "cb689628-9a5a-5f2b-a3ec-be37bd6cdb37"
```
## T07 — Attended original restore (phase A)
@ -237,6 +244,7 @@ priority: high
needs_human: true
depends_on: [RPF-WP-0064-T05, RPF-WP-0064-T06]
blocking_reason: "Requires the founder in attendance holding the offline railiance-backup.key, 2 of 3 original Shamir shares and the encrypted snapshot from railiance-backups/openbao/, inside the T05-signed window. No agent handles custody material."
state_hub_task_id: "96e88167-c484-527c-84aa-0464dd0f5597"
```
Run the admitted adapter once. The outcome is a T03 receipt verified
@ -252,6 +260,7 @@ status: wait
priority: medium
depends_on: [RPF-WP-0064-T07]
blocking_reason: "Needs the verified T07 receipt."
state_hub_task_id: "94139cb1-037a-58ef-883c-dde71fe6bfde"
```
Hand to secrets-engine (SECRETS-WP-0015-T04) and net-kingdom (NK-WP-0049-T18)