coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(workplans): resolve RPF-WP collisions created by the prefix migration
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The RAILIANCE-WP migration numbered from RPF-WP-0001 without checking whether
the target prefix was already in use. It was: this repository already had
RPF-WP records, and the migration collided at 0018, 0019 and 0020, putting two
unrelated workplans on each identifier.

Central was left holding mixed records — rpf-wp-0018 carried the status of one
file and the backing path of the other, because the reset processed two files
claiming one identifier.

The three files the migration displaced move to 0025-0027; the pre-existing
records keep their numbers. Projection UUIDs are re-derived.

Refs STATE-WP-0083-T05

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-26 19:44:46 +02:00
parent 47d8ec8806
commit 86209c756c
3 changed files with 33 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/RPF-WP-0018-openbao-operator-only-access.md → workplans/RPF-WP-0025-openbao-operator-only-access.md
View file

@ -1,5 +1,5 @@
---
id: RPF-WP-0018
id: RPF-WP-0025
type: workplan
title: "Retract public OpenBao listener behind operator-only access"
domain: financials
@ -12,10 +12,10 @@ updated: "2026-08-23"
related:
- RMASTER-WP-0020-T09
- RAPP-OPENBAO-WP-0002
state_hub_workstream_id: "4fcb6026-2630-59a3-b5de-15f54efcf59d"
state_hub_workstream_id: "6dda6039-295e-5cac-aef6-3183c3218649"
---
# RPF-WP-0018 — OpenBao operator-only access
# RPF-WP-0025 — OpenBao operator-only access
## Goal
@ -25,10 +25,10 @@ destructive CoulombCore cleanup.
## T01 — Align the retained compatibility source
```task
id: RPF-WP-0018-T01
id: RPF-WP-0025-T01
status: done
priority: high
state_hub_task_id: "88d1342b-5093-5fbc-aa84-1608d163b979"
state_hub_task_id: "80f9638f-707f-5038-bc77-5962b535949e"
```
The retained platform manifest now matches the canonical package posture:
@ -39,10 +39,10 @@ rollback artifact.
## T02 — Add guarded retraction and rollback
```task
id: RPF-WP-0018-T02
id: RPF-WP-0025-T02
status: done
priority: high
state_hub_task_id: "03f0a5bd-7876-5784-bf02-11cbcdf005bb"
state_hub_task_id: "685aba0f-2594-5b99-903a-8c9cd16f6539"
```
`scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
@ -53,10 +53,10 @@ It deletes only the Ingress and provides an exact rollback path.
## T03 — Complete the attended operator cutover
```task
id: RPF-WP-0018-T03
id: RPF-WP-0025-T03
status: wait
priority: high
state_hub_task_id: "b602226f-8eb5-5609-995f-94f9074b0895"
state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
```
KeyCape revision `d150be1` now admits exactly

18
workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md → workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
View file

@ -1,5 +1,5 @@
---
id: RPF-WP-0019
id: RPF-WP-0026
type: workplan
title: "Adopt canonical flex-auth credential-grant checks"
domain: financials
@ -13,10 +13,10 @@ related:
- FLEX-WP-0012
origin: routed
origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
state_hub_workstream_id: "6ded9d76-e3a8-5d52-9221-2c7935f3b364"
state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e"
---
# RPF-WP-0019 — canonical flex-auth credential-grant checks
# RPF-WP-0026 — canonical flex-auth credential-grant checks
## Goal
@ -27,10 +27,10 @@ consumer-specific flex-auth endpoint.
## T01 — Resolve translation ownership
```task
id: RPF-WP-0019-T01
id: RPF-WP-0026-T01
status: done
priority: high
state_hub_task_id: "9f0c7e4f-6351-51c1-8c5e-39f770668605"
state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"
```
The operator explicitly approved Option A in State Hub decision
@ -41,10 +41,10 @@ normalization belong here, before the flex-auth policy boundary.
## T02 — Implement the canonical request and response
```task
id: RPF-WP-0019-T02
id: RPF-WP-0026-T02
status: done
priority: high
state_hub_task_id: "8c95e2b5-884c-5504-9998-5bdd8ae64b5d"
state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"
```
Change the helper default to `/v1/check`, emit the coordinated
@ -60,10 +60,10 @@ evaluator provenance, and subject/resource binding back to the request.
## T03 — Verify and route the contract
```task
id: RPF-WP-0019-T03
id: RPF-WP-0026-T03
status: done
priority: medium
state_hub_task_id: "9d8c534d-72b7-5cac-ada1-72273fb3ab01"
state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"
```
Exercise focused allow and deny tests, validate the complete repository suite,

30
workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md → workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
View file

@ -1,5 +1,5 @@
---
id: RPF-WP-0020
id: RPF-WP-0027
type: workplan
title: "Coordinate KeyCape live Secret exposure recovery"
domain: financials
@ -13,10 +13,10 @@ related:
- KEY-WP-0011
origin: routed
origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d, acf98be3-ff6b-4270-bd21-0193bebd806b, aeb216b5-9f1b-404b-a483-fb08a00a49b1, and 71b1008a-7fd7-4500-85c6-e8893a6d80d4"
state_hub_workstream_id: "99bdb617-b577-5de3-a9d8-4990ac676e28"
state_hub_workstream_id: "b2c25a01-4a80-55c1-90cf-8538000f7e0e"
---
# RPF-WP-0020 — KeyCape live Secret exposure recovery
# RPF-WP-0027 — KeyCape live Secret exposure recovery
## Goal
@ -27,10 +27,10 @@ payload and never treat repository access as live mutation authority.
## T01 — Contain and establish the recovery boundary
```task
id: RPF-WP-0020-T01
id: RPF-WP-0027-T01
status: done
priority: high
state_hub_task_id: "4763622c-78aa-556a-ba8e-9b556a2e78fc"
state_hub_task_id: "53f47272-92ab-563b-9d69-5eafee733e6b"
```
Accepted the KeyCape/NetKingdom incident reports, stopped payload inspection,
@ -41,10 +41,10 @@ the public JWKS digest/kid. The legacy value-printing rotation helper is banned.
## T02 — Publish the governed bundle cutover
```task
id: RPF-WP-0020-T02
id: RPF-WP-0027-T02
status: done
priority: high
state_hub_task_id: "a897b2f5-b7ae-5dbf-9f51-54b2db5ca6fc"
state_hub_task_id: "3c55b1cd-8f6b-5a48-b416-18ab711954e3"
```
`docs/keycape-live-secret-exposure-recovery.md` defines owners, required
@ -55,10 +55,10 @@ predecessor revocation, and sanitized evidence.
## T03 — Collect exact owner acknowledgements
```task
id: RPF-WP-0020-T03
id: RPF-WP-0027-T03
status: progress
priority: high
state_hub_task_id: "44959415-a917-5dfb-a5ab-80ab166b9096"
state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1"
```
KeyCape supplied source revision `93704fd2424503007c20b458b62a7f7d994bb288`,
@ -95,10 +95,10 @@ lane remains unresolved and no credential fetch or retry is authorized.
## T04 — Execute the attended rotation
```task
id: RPF-WP-0020-T04
id: RPF-WP-0027-T04
status: wait
priority: high
state_hub_task_id: "d85eeb8a-3147-59e1-bc2a-e84244dde93d"
state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7"
```
Requires a fresh exact human GO, an at-most-30-minute window, named driver and
@ -108,10 +108,10 @@ and all T03 acknowledgements. No value may enter captured output.
## T05 — Prove predecessor denial and close
```task
id: RPF-WP-0020-T05
id: RPF-WP-0027-T05
status: wait
priority: high
state_hub_task_id: "e026d9e6-82d0-5322-a3ef-e69e7f613514"
state_hub_task_id: "9cb5fa67-012a-58cf-bafb-e7c7d4f9782d"
```
Verify replacement operation and predecessor rejection for the signing key,
@ -122,10 +122,10 @@ status, timestamps, and cleanup receipts.
## T06 — Publish the Railiance/OpenBao custody handoff
```task
id: RPF-WP-0020-T06
id: RPF-WP-0027-T06
status: progress
priority: high
state_hub_task_id: "0b666b58-b73a-5d2e-a4e5-c53769fef85e"
state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
```
The platform/OpenBao owner must publish a non-secret receipt for both routing