From 86209c756cb6879418a4d3507bd790078ee3d610 Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 26 Aug 2026 19:44:46 +0200 Subject: [PATCH] fix(workplans): resolve RPF-WP collisions created by the prefix migration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The RAILIANCE-WP migration numbered from RPF-WP-0001 without checking whether the target prefix was already in use. It was: this repository already had RPF-WP records, and the migration collided at 0018, 0019 and 0020, putting two unrelated workplans on each identifier. Central was left holding mixed records — rpf-wp-0018 carried the status of one file and the backing path of the other, because the reset processed two files claiming one identifier. The three files the migration displaced move to 0025-0027; the pre-existing records keep their numbers. Projection UUIDs are re-derived. Refs STATE-WP-0083-T05 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006 --- ...F-WP-0025-openbao-operator-only-access.md} | 18 +++++------ ...flex-auth-credential-grant-integration.md} | 18 +++++------ ...-keycape-live-secret-exposure-recovery.md} | 30 +++++++++---------- 3 files changed, 33 insertions(+), 33 deletions(-) rename workplans/{RPF-WP-0018-openbao-operator-only-access.md => RPF-WP-0025-openbao-operator-only-access.md} (88%) rename workplans/{RPF-WP-0019-flex-auth-credential-grant-integration.md => RPF-WP-0026-flex-auth-credential-grant-integration.md} (84%) rename workplans/{RPF-WP-0020-keycape-live-secret-exposure-recovery.md => RPF-WP-0027-keycape-live-secret-exposure-recovery.md} (88%) diff --git a/workplans/RPF-WP-0018-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md similarity index 88% rename from workplans/RPF-WP-0018-openbao-operator-only-access.md rename to workplans/RPF-WP-0025-openbao-operator-only-access.md index e69574a..67cbe2d 100644 --- a/workplans/RPF-WP-0018-openbao-operator-only-access.md +++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md @@ -1,5 +1,5 @@ --- -id: RPF-WP-0018 +id: RPF-WP-0025 type: workplan title: "Retract public OpenBao listener behind operator-only access" domain: financials @@ -12,10 +12,10 @@ updated: "2026-08-23" related: - RMASTER-WP-0020-T09 - RAPP-OPENBAO-WP-0002 -state_hub_workstream_id: "4fcb6026-2630-59a3-b5de-15f54efcf59d" +state_hub_workstream_id: "6dda6039-295e-5cac-aef6-3183c3218649" --- -# RPF-WP-0018 — OpenBao operator-only access +# RPF-WP-0025 — OpenBao operator-only access ## Goal @@ -25,10 +25,10 @@ destructive CoulombCore cleanup. ## T01 — Align the retained compatibility source ```task -id: RPF-WP-0018-T01 +id: RPF-WP-0025-T01 status: done priority: high -state_hub_task_id: "88d1342b-5093-5fbc-aa84-1608d163b979" +state_hub_task_id: "80f9638f-707f-5038-bc77-5962b535949e" ``` The retained platform manifest now matches the canonical package posture: @@ -39,10 +39,10 @@ rollback artifact. ## T02 — Add guarded retraction and rollback ```task -id: RPF-WP-0018-T02 +id: RPF-WP-0025-T02 status: done priority: high -state_hub_task_id: "03f0a5bd-7876-5784-bf02-11cbcdf005bb" +state_hub_task_id: "685aba0f-2594-5b99-903a-8c9cd16f6539" ``` `scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies @@ -53,10 +53,10 @@ It deletes only the Ingress and provides an exact rollback path. ## T03 — Complete the attended operator cutover ```task -id: RPF-WP-0018-T03 +id: RPF-WP-0025-T03 status: wait priority: high -state_hub_task_id: "b602226f-8eb5-5609-995f-94f9074b0895" +state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e" ``` KeyCape revision `d150be1` now admits exactly diff --git a/workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md b/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md similarity index 84% rename from workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md rename to workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md index 6ac0778..58fce80 100644 --- a/workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md +++ b/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md @@ -1,5 +1,5 @@ --- -id: RPF-WP-0019 +id: RPF-WP-0026 type: workplan title: "Adopt canonical flex-auth credential-grant checks" domain: financials @@ -13,10 +13,10 @@ related: - FLEX-WP-0012 origin: routed origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a" -state_hub_workstream_id: "6ded9d76-e3a8-5d52-9221-2c7935f3b364" +state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e" --- -# RPF-WP-0019 — canonical flex-auth credential-grant checks +# RPF-WP-0026 — canonical flex-auth credential-grant checks ## Goal @@ -27,10 +27,10 @@ consumer-specific flex-auth endpoint. ## T01 — Resolve translation ownership ```task -id: RPF-WP-0019-T01 +id: RPF-WP-0026-T01 status: done priority: high -state_hub_task_id: "9f0c7e4f-6351-51c1-8c5e-39f770668605" +state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9" ``` The operator explicitly approved Option A in State Hub decision @@ -41,10 +41,10 @@ normalization belong here, before the flex-auth policy boundary. ## T02 — Implement the canonical request and response ```task -id: RPF-WP-0019-T02 +id: RPF-WP-0026-T02 status: done priority: high -state_hub_task_id: "8c95e2b5-884c-5504-9998-5bdd8ae64b5d" +state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b" ``` Change the helper default to `/v1/check`, emit the coordinated @@ -60,10 +60,10 @@ evaluator provenance, and subject/resource binding back to the request. ## T03 — Verify and route the contract ```task -id: RPF-WP-0019-T03 +id: RPF-WP-0026-T03 status: done priority: medium -state_hub_task_id: "9d8c534d-72b7-5cac-ada1-72273fb3ab01" +state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60" ``` Exercise focused allow and deny tests, validate the complete repository suite, diff --git a/workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md similarity index 88% rename from workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md rename to workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md index c24f20b..4303b3f 100644 --- a/workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md +++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md @@ -1,5 +1,5 @@ --- -id: RPF-WP-0020 +id: RPF-WP-0027 type: workplan title: "Coordinate KeyCape live Secret exposure recovery" domain: financials @@ -13,10 +13,10 @@ related: - KEY-WP-0011 origin: routed origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d, acf98be3-ff6b-4270-bd21-0193bebd806b, aeb216b5-9f1b-404b-a483-fb08a00a49b1, and 71b1008a-7fd7-4500-85c6-e8893a6d80d4" -state_hub_workstream_id: "99bdb617-b577-5de3-a9d8-4990ac676e28" +state_hub_workstream_id: "b2c25a01-4a80-55c1-90cf-8538000f7e0e" --- -# RPF-WP-0020 — KeyCape live Secret exposure recovery +# RPF-WP-0027 — KeyCape live Secret exposure recovery ## Goal @@ -27,10 +27,10 @@ payload and never treat repository access as live mutation authority. ## T01 — Contain and establish the recovery boundary ```task -id: RPF-WP-0020-T01 +id: RPF-WP-0027-T01 status: done priority: high -state_hub_task_id: "4763622c-78aa-556a-ba8e-9b556a2e78fc" +state_hub_task_id: "53f47272-92ab-563b-9d69-5eafee733e6b" ``` Accepted the KeyCape/NetKingdom incident reports, stopped payload inspection, @@ -41,10 +41,10 @@ the public JWKS digest/kid. The legacy value-printing rotation helper is banned. ## T02 — Publish the governed bundle cutover ```task -id: RPF-WP-0020-T02 +id: RPF-WP-0027-T02 status: done priority: high -state_hub_task_id: "a897b2f5-b7ae-5dbf-9f51-54b2db5ca6fc" +state_hub_task_id: "3c55b1cd-8f6b-5a48-b416-18ab711954e3" ``` `docs/keycape-live-secret-exposure-recovery.md` defines owners, required @@ -55,10 +55,10 @@ predecessor revocation, and sanitized evidence. ## T03 — Collect exact owner acknowledgements ```task -id: RPF-WP-0020-T03 +id: RPF-WP-0027-T03 status: progress priority: high -state_hub_task_id: "44959415-a917-5dfb-a5ab-80ab166b9096" +state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1" ``` KeyCape supplied source revision `93704fd2424503007c20b458b62a7f7d994bb288`, @@ -95,10 +95,10 @@ lane remains unresolved and no credential fetch or retry is authorized. ## T04 — Execute the attended rotation ```task -id: RPF-WP-0020-T04 +id: RPF-WP-0027-T04 status: wait priority: high -state_hub_task_id: "d85eeb8a-3147-59e1-bc2a-e84244dde93d" +state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7" ``` Requires a fresh exact human GO, an at-most-30-minute window, named driver and @@ -108,10 +108,10 @@ and all T03 acknowledgements. No value may enter captured output. ## T05 — Prove predecessor denial and close ```task -id: RPF-WP-0020-T05 +id: RPF-WP-0027-T05 status: wait priority: high -state_hub_task_id: "e026d9e6-82d0-5322-a3ef-e69e7f613514" +state_hub_task_id: "9cb5fa67-012a-58cf-bafb-e7c7d4f9782d" ``` Verify replacement operation and predecessor rejection for the signing key, @@ -122,10 +122,10 @@ status, timestamps, and cleanup receipts. ## T06 — Publish the Railiance/OpenBao custody handoff ```task -id: RPF-WP-0020-T06 +id: RPF-WP-0027-T06 status: progress priority: high -state_hub_task_id: "0b666b58-b73a-5d2e-a4e5-c53769fef85e" +state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283" ``` The platform/OpenBao owner must publish a non-secret receipt for both routing