coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Finish RPF-WP-0058 and hand its reader rotation to backlog RPF-WP-0071.
Some checks failed
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details
CCR intake gate / gate (push) Has been cancelled
Details

Browse source 
RPF-WP-0071 first builds a reusable attended rotation lane, then rotates or
revokes the reuse-surface source reader by 2027-01-13.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 236506@bnt-lap001
Assistant-Session: 09087018-91e1-48c5-ab2f-acfbb62c92e4
This commit is contained in:
codex 2026-11-03 14:16:15 +01:00
parent 02d75dcc74
commit 76daa8c8b2
4 changed files with 100 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
WORK-RECORDS.md
View file

@ -38,7 +38,7 @@
| workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md |
| workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md |
| workplan | RPF-WP-0057 | finished | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md |
| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| workplan | RPF-WP-0058 | finished | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
| workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md |
| workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md |
@ -51,6 +51,7 @@
| workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md |
| workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md |
| workplan | RPF-WP-0070 | finished | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| workplan | RPF-WP-0071 | backlog | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md |
| task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md |
| task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md |
| task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md |
@ -186,7 +187,7 @@
| task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0058-T04 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0058-T05 | wait | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0058-T05 | cancel | — | workplans/RPF-WP-0058-reuse-private-source-reader.md |
| task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
| task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
| task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md |
@ -246,6 +247,8 @@
| task | RPF-WP-0070-T03 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T04 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0070-T05 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md |
| task | RPF-WP-0071-T01 | todo | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md |
| task | RPF-WP-0071-T02 | wait | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md |
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
| intake | RPF-IN-0002 | open | — | intakes/intakes.md |
| intake | RPF-IN-0003 | open | — | intakes/intakes.md |

1
workplans/README.md
View file

@ -17,6 +17,7 @@ Completed plans retain their IDs and managed UUIDs, including archived plans.
| [RPF-WP-0053](RPF-WP-0053-coulomb-paired-backup-admission.md) (proposed) | T01, T02, T03, T04, T05 | Paired archive execution/custody, retrieval/recovery and monitoring admission |
| [RPF-WP-0055](RPF-WP-0055-keycape-client-secret-rotation-residual.md) (backlog) | T01 | Unpromoted rotation residual; do not implement without demand/risk promotion |
| [RPF-WP-0056](RPF-WP-0056-playwright-consumer-admission.md) (blocked) | T03, T06 | Pilot/setup implemented; Custodian coordination requested for identity, transport and real human/agent proof |
| [RPF-WP-0071](RPF-WP-0071-attended-credential-rotation-lane.md) (backlog) | T01, T02 | Build a cheap attended rotation lane first; T02 rotates or revokes the reuse-surface reader by 2027-01-13 (from RPF-WP-0058-T05) |
October 13 review corrected WP-0038-T04's stale `todo` state to the documented
`wait`. RPF-IN-0012 remains an open independent execution/wrapped-delivery review;

13
workplans/RPF-WP-0058-reuse-private-source-reader.md
View file

@ -4,11 +4,11 @@ type: workplan
title: Prepare the exact seven private-source reader for reuse-surface
domain: financials
repo: railiance-platform
status: active
status: finished
owner: codex
topic_slug: platform
created: '2026-10-15'
updated: '2026-10-15'
updated: '2026-11-03'
flavor: implementation
depends_on: []
state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6"
@ -147,7 +147,7 @@ and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1
```task
id: RPF-WP-0058-T05
status: wait
status: cancel
priority: high
due_date: "2027-01-13"
state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c"
@ -179,3 +179,10 @@ with process-memory password and verified token inventory absence. Preserve the
shared runtime writer/webhook fields and public registrations. Never remint or
recover orphan/ambiguous requests automatically; reconcile authoritative state
before any new approved action. No rotation/revocation is executed by this record.
2026-11-03: by founder decision, this obligation moved unchanged to
RPF-WP-0071-T02 (backlog, due 2027-01-13). Its T01 first builds a reusable
attended rotation lane, because a one-off rotation with today's tooling costs
too much. T05 is cancelled here only because it was handed over; it was not
dropped. No rotation or revocation has been executed. RPF-WP-0058 is
finished.

84
workplans/RPF-WP-0071-attended-credential-rotation-lane.md Normal file
View file

@ -0,0 +1,84 @@
---
id: RPF-WP-0071
type: workplan
title: "Make attended credential rotation cheap, then rotate the reuse-surface source reader"
domain: financials
repo: railiance-platform
status: backlog
flavor: implementation
owner: claude-code
topic_slug: platform
created: "2026-11-03"
updated: "2026-11-03"
related:
- RPF-WP-0058-T05
- RPF-WP-0055
---
Takes over RPF-WP-0058-T05, the rotate-or-revoke obligation for the dedicated
seven-source reader. RPF-WP-0058 is finished.
The founder put this in the backlog on 2026-11-03. On today's tooling a single
rotation costs too much effort: a CCR revision written by hand, a bespoke
CAS plan, several owner reviews and a long attended session, as on
2026-10-15. The tooling should improve before the next live run. The deadline
still holds. Promote this plan to `ready` early enough that T02 finishes
before 2027-01-13.
## Build a reusable attended rotation lane
```task
id: RPF-WP-0071-T01
status: todo
priority: high
```
Build one reviewed, repeatable lane for rotating a provider token that lives
in OpenBao KV. Start with Forgejo PATs; KeyCape client secrets
(RPF-WP-0055) are the next consumer. Reuse
`scripts/apply-reuse-surface-reader-custody.py` and its 2026-10-15 receipts
rather than starting over. The lane should give:
- a CCR rotation template that only needs the credential identity filled in;
- a read-only preflight: provider identity, exact grants, current PAT
metadata and KV version;
- a CAS write against the expected KV version that keeps sibling fields;
- a predecessor revoke only after native verification of the successor, and
never an automatic remint of an ambiguous request;
- one founder-attended command per run, with sanitized receipts in the existing
evidence format.
Tests use mocks and dev servers only; no live action.
## Rotate or revoke the dedicated seven-source reader by 2027-01-13
```task
id: RPF-WP-0071-T02
status: wait
priority: high
depends_on: [RPF-WP-0071-T01]
due_date: "2027-01-13"
```
The obligation and terms are unchanged from RPF-WP-0058-T05:
- Forgejo identity `reuse-surface-source`, team
`reuse-surface-source-readers`, and its exact named seven-repository PAT;
- OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`,
field `FORGEJO_SOURCE_TOKEN`.
Forgejo PATs do not expire on their own. This is a human-attended obligation,
not an expiry mechanism.
The deadline is bound to verified custody activation at
2026-10-15T03:06:09.579844+00:00 (bootstrap attempt
`bb2693a7640f00b4e401467e`, receipt SHA256
`f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171`; see
`docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json`). It falls
due at 2027-01-13T03:06:09.579844+00:00. The Hub `due_date` is a cache, and no
automatic reminder exists.
Run it through the T01 lane under a separately approved CCR. Alternatively,
use the separately approved exact-token recovery helper for Basic-auth
revocation with a process-memory password and verified absence from the token
inventory. Keep the shared runtime writer/webhook fields and the public
registrations. Never remint or recover orphan or ambiguous requests
automatically; reconcile authoritative state before any new approved action.
Done when the successor is natively verified, or the reader is revoked, and
the receipt is recorded.