diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 08b1018..6f073ce 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -38,7 +38,7 @@ | workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md | | workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | | workplan | RPF-WP-0057 | finished | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | -| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| workplan | RPF-WP-0058 | finished | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | | workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | | workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | @@ -51,6 +51,7 @@ | workplan | RPF-WP-0068 | finished | — | workplans/RPF-WP-0068-email-connect-platform-smtp.md | | workplan | RPF-WP-0069 | active | — | workplans/RPF-WP-0069-bounded-executor-lanes.md | | workplan | RPF-WP-0070 | finished | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | +| workplan | RPF-WP-0071 | backlog | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md | | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | @@ -186,7 +187,7 @@ | task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0058-T04 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | -| task | RPF-WP-0058-T05 | wait | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0058-T05 | cancel | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | | task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | | task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | | task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | @@ -246,6 +247,8 @@ | task | RPF-WP-0070-T03 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T04 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | | task | RPF-WP-0070-T05 | done | — | workplans/RPF-WP-0070-mas-evidence-recovery.md | +| task | RPF-WP-0071-T01 | todo | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md | +| task | RPF-WP-0071-T02 | wait | — | workplans/RPF-WP-0071-attended-credential-rotation-lane.md | | intake | RPF-IN-0001 | closed | — | intakes/intakes.md | | intake | RPF-IN-0002 | open | — | intakes/intakes.md | | intake | RPF-IN-0003 | open | — | intakes/intakes.md | diff --git a/workplans/README.md b/workplans/README.md index b3bcaa9..8875148 100644 --- a/workplans/README.md +++ b/workplans/README.md @@ -17,6 +17,7 @@ Completed plans retain their IDs and managed UUIDs, including archived plans. | [RPF-WP-0053](RPF-WP-0053-coulomb-paired-backup-admission.md) (proposed) | T01, T02, T03, T04, T05 | Paired archive execution/custody, retrieval/recovery and monitoring admission | | [RPF-WP-0055](RPF-WP-0055-keycape-client-secret-rotation-residual.md) (backlog) | T01 | Unpromoted rotation residual; do not implement without demand/risk promotion | | [RPF-WP-0056](RPF-WP-0056-playwright-consumer-admission.md) (blocked) | T03, T06 | Pilot/setup implemented; Custodian coordination requested for identity, transport and real human/agent proof | +| [RPF-WP-0071](RPF-WP-0071-attended-credential-rotation-lane.md) (backlog) | T01, T02 | Build a cheap attended rotation lane first; T02 rotates or revokes the reuse-surface reader by 2027-01-13 (from RPF-WP-0058-T05) | October 13 review corrected WP-0038-T04's stale `todo` state to the documented `wait`. RPF-IN-0012 remains an open independent execution/wrapped-delivery review; diff --git a/workplans/RPF-WP-0058-reuse-private-source-reader.md b/workplans/RPF-WP-0058-reuse-private-source-reader.md index e079978..390d9cc 100644 --- a/workplans/RPF-WP-0058-reuse-private-source-reader.md +++ b/workplans/RPF-WP-0058-reuse-private-source-reader.md @@ -4,11 +4,11 @@ type: workplan title: Prepare the exact seven private-source reader for reuse-surface domain: financials repo: railiance-platform -status: active +status: finished owner: codex topic_slug: platform created: '2026-10-15' -updated: '2026-10-15' +updated: '2026-11-03' flavor: implementation depends_on: [] state_hub_workstream_id: "b55a8aec-7457-563b-990b-4a55ca04d2f6" @@ -147,7 +147,7 @@ and helper cleanup. See docs/evidence/2026-10-15-reuse-private-reader-custody-r1 ```task id: RPF-WP-0058-T05 -status: wait +status: cancel priority: high due_date: "2027-01-13" state_hub_task_id: "f0780e75-b0bd-5bf5-b926-c8413abb885c" @@ -179,3 +179,10 @@ with process-memory password and verified token inventory absence. Preserve the shared runtime writer/webhook fields and public registrations. Never remint or recover orphan/ambiguous requests automatically; reconcile authoritative state before any new approved action. No rotation/revocation is executed by this record. + +2026-11-03: by founder decision, this obligation moved unchanged to +RPF-WP-0071-T02 (backlog, due 2027-01-13). Its T01 first builds a reusable +attended rotation lane, because a one-off rotation with today's tooling costs +too much. T05 is cancelled here only because it was handed over; it was not +dropped. No rotation or revocation has been executed. RPF-WP-0058 is +finished. diff --git a/workplans/RPF-WP-0071-attended-credential-rotation-lane.md b/workplans/RPF-WP-0071-attended-credential-rotation-lane.md new file mode 100644 index 0000000..1e9eab3 --- /dev/null +++ b/workplans/RPF-WP-0071-attended-credential-rotation-lane.md @@ -0,0 +1,84 @@ +--- +id: RPF-WP-0071 +type: workplan +title: "Make attended credential rotation cheap, then rotate the reuse-surface source reader" +domain: financials +repo: railiance-platform +status: backlog +flavor: implementation +owner: claude-code +topic_slug: platform +created: "2026-11-03" +updated: "2026-11-03" +related: + - RPF-WP-0058-T05 + - RPF-WP-0055 +--- + +Takes over RPF-WP-0058-T05, the rotate-or-revoke obligation for the dedicated +seven-source reader. RPF-WP-0058 is finished. + +The founder put this in the backlog on 2026-11-03. On today's tooling a single +rotation costs too much effort: a CCR revision written by hand, a bespoke +CAS plan, several owner reviews and a long attended session, as on +2026-10-15. The tooling should improve before the next live run. The deadline +still holds. Promote this plan to `ready` early enough that T02 finishes +before 2027-01-13. + +## Build a reusable attended rotation lane + +```task +id: RPF-WP-0071-T01 +status: todo +priority: high +``` + +Build one reviewed, repeatable lane for rotating a provider token that lives +in OpenBao KV. Start with Forgejo PATs; KeyCape client secrets +(RPF-WP-0055) are the next consumer. Reuse +`scripts/apply-reuse-surface-reader-custody.py` and its 2026-10-15 receipts +rather than starting over. The lane should give: +- a CCR rotation template that only needs the credential identity filled in; +- a read-only preflight: provider identity, exact grants, current PAT + metadata and KV version; +- a CAS write against the expected KV version that keeps sibling fields; +- a predecessor revoke only after native verification of the successor, and + never an automatic remint of an ambiguous request; +- one founder-attended command per run, with sanitized receipts in the existing + evidence format. +Tests use mocks and dev servers only; no live action. + +## Rotate or revoke the dedicated seven-source reader by 2027-01-13 + +```task +id: RPF-WP-0071-T02 +status: wait +priority: high +depends_on: [RPF-WP-0071-T01] +due_date: "2027-01-13" +``` + +The obligation and terms are unchanged from RPF-WP-0058-T05: +- Forgejo identity `reuse-surface-source`, team + `reuse-surface-source-readers`, and its exact named seven-repository PAT; +- OpenBao KV `platform/workloads/reuse/reuse-surface/forgejo-source-read`, + field `FORGEJO_SOURCE_TOKEN`. +Forgejo PATs do not expire on their own. This is a human-attended obligation, +not an expiry mechanism. + +The deadline is bound to verified custody activation at +2026-10-15T03:06:09.579844+00:00 (bootstrap attempt +`bb2693a7640f00b4e401467e`, receipt SHA256 +`f5ddd86299cdf31ca895f76b84d7fc14d2ac791e5982632c5c989a32221a0171`; see +`docs/evidence/2026-10-15-reuse-private-reader-custody-r1.json`). It falls +due at 2027-01-13T03:06:09.579844+00:00. The Hub `due_date` is a cache, and no +automatic reminder exists. + +Run it through the T01 lane under a separately approved CCR. Alternatively, +use the separately approved exact-token recovery helper for Basic-auth +revocation with a process-memory password and verified absence from the token +inventory. Keep the shared runtime writer/webhook fields and the public +registrations. Never remint or recover orphan or ambiguous requests +automatically; reconcile authoritative state before any new approved action. +Done when the successor is natively verified, or the reader is revoked, and +the receipt is recorded.