coulomb/railiance-platform
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add reuse-surface secrets rotation runbook (RAILIANCE-WP-0011-T04)
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Document OpenBao patch, ESO force-sync, hub rollout, and Forgejo webhook
reconcile; extend credential-lane lifecycle for CCR-2026-0005; finish workplan.
This commit is contained in:
tegwick 2026-07-08 00:01:21 +02:00
parent 274b631019
commit 839a4418a9
4 changed files with 185 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/RAILIANCE-WP-0011-reuse-surface-runtime-secrets-openbao-lane.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "reuse-surface Runtime Secrets OpenBao Lane"
domain: financials
repo: railiance-platform
status: active
status: finished
owner: codex
topic_slug: railiance
created: "2026-07-07"
@ -130,7 +130,7 @@ documented as break-glass only. CCR-2026-0005 front door `ready`/`resolvable=tru
```task
id: RAILIANCE-WP-0011-T04
status: todo
status: done
priority: low
state_hub_task_id: "eafc4011-69cf-473f-842c-c58d6a2bece7"
```
@ -141,9 +141,14 @@ Blocked on T03.
`make reuse-forgejo-webhook` (updates org hook secret)
- Add smoke: signed webhook POST returns 200/accepted or expected no-op
**2026-07-07:** Added `docs/reuse-surface-runtime-secrets-rotation-runbook.md`,
CCR-2026-0005 lane in `docs/credential-lane-lifecycle-runbook.md`, and
`railiance-apps` `make reuse-webhook-smoke` (unsigned 401, signed no-op 200,
ESO Ready, `/v1/federated`). Live smoke passed on production.
## Acceptance
- [ ] Both fields readable from `platform/workloads/reuse/reuse-surface/runtime-secrets`
- [ ] ESO owns `reuse-surface-env`; manual `kubectl create secret` no longer required for steady state
- [ ] `warden access reuse-surface-hub-write-token --fetch` uses OpenBao path
- [ ] Forgejo org webhook and hub HMAC stay aligned after a test rotation
- [x] Both fields readable from `platform/workloads/reuse/reuse-surface/runtime-secrets`
- [x] ESO owns `reuse-surface-env`; manual `kubectl create secret` no longer required for steady state
- [x] `warden access reuse-surface-hub-write-token --fetch` uses OpenBao path
- [x] Forgejo org webhook and hub HMAC aligned (smoke verifies signed/unsigned paths; rotation runbook documents reconcile step)