coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Consolidate platform workplans and assess intent gaps

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
This commit is contained in:
codex 2026-09-05 11:14:42 +02:00
parent 9d958f8e09
commit 9f83e426c7
40 changed files with 2985 additions and 295 deletions
Download patch file Download diff file Expand all files Collapse all files

199
SCOPE.md
View file

@ -1,169 +1,114 @@
# SCOPE
> This file helps you quickly understand what this repository is about,
> when it is relevant, and when it is not.
> It is intentionally lightweight and may be incomplete.
Reviewed 2026-09-05 against repository source, dated operating evidence and
adjacent owner contracts. This is a scope assessment, not a fresh live audit.
[INTENT.md](INTENT.md) remains the stable aspiration.
---
## Purpose and boundary
## One-liner
Railiance's S3 shared stateful services: database provision and placement,
secret custody and delivery, and platform-data backup and recovery behind
versioned consumer interfaces. Cache, general object storage and messaging
remain demand-led capabilities; their inclusion in INTENT does not mean they
are deployed or justify running them without consumers.
S3 Platform Services layer of the Railiance OAS Stack — owns shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.
S3 owns the service promise, custody and acceptance evidence. A `rapp-*` repo
owns its deployable package; the cluster and host owners supply the runtime.
Identity integration means consuming identity claims, not operating an identity
or authorization authority. See [ADR-0001](docs/adr/ADR-0001-s3-platform-service-boundary.md).
---
## Current evidenced capability
## Core Idea
| Service | Implemented / evidenced | Limit and authority |
| --- | --- | --- |
| `apps-pg` | CNPG source, per-consumer database ACLs, 20-connection allowances, 15-second timeouts; daily backup, continuous WAL and 30-day retention; 56-second scratch restore and 14/14 boundary probes on 2026-08-20 | One instance; restart recovery, no HA or measured latency SLO. Ceiling 3, overflow `apps-pg-2` provisionable but demand-gated. S3 owns this CR and its controls. |
| `platform-pg` | Package-operated CNPG service, governed dynamic credentials, backup/restore evidence, Core Hub admission and private shadow evidence | `rapp-postgres` owns CR/provisioning/restore. S3 owns custody, placement policy and consumer disclosure. Published ceiling 4 declarations, counting the probe; reconcile current occupancy before admission. One instance is not HA. |
| OpenBao and credential delivery | CCR validation, policy/grant boundaries, approved apply interfaces, runtime KV/ESO and short-lived database lanes, ephemeral custody lifecycle | Package assets belong to `rapp-openbao`; custody/policy remains here. Existing helpers are not authority to mint arbitrary credentials. Operator-only access cutover and incident residuals remain open. |
| Backup storage consumption | Governed off-cluster S3 backup destination and credential lane used by CNPG; encrypted upload tooling for other backup consumers | Resource procurement belongs to `resource-control`/`reef-storage`. This does not establish a general S3 service or deployed MinIO. One successful restore does not establish a recurring recovery guarantee. |
| Cache / general object storage / messaging | Valkey deployment is gated; no supported consumer interface or deployed shared broker/general in-cluster object store is established by this review | Demand, reuse, ownership, service contract and recovery design must precede deployment. No engine/provider choice is made here. |
Railiance classifies repos along four orthogonal axes — `railiance-*`
(ownership), `rail-*` (execution contract), `rapp-*` (managed workload package),
`reef-*` (substrate boundary). This repo is `railiance-*`, at **S3** on the OAS
Stack dimension: the platform services that multiple applications share. Five
repos cover S1–S5; other `railiance-*` repos sit on other OAS dimensions rather
than on the stack. See `ArchitectureBlueprint.md` for the full backbone.
Evidence and contracts: [consumer interfaces](docs/s3-consumer-interfaces.md),
[apps-pg restore](docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md),
[apps-pg isolation](docs/evidence/RPF-WP-0019-isolation-2026-08-20.md),
[placement](docs/placement-policy.md), [tenancy](tenancy.yaml), and
[Core Hub capacity admission](docs/evidence/core-hub-postgres-capacity-admission-2026-08-20.md).
The former “apps-pg has no backup” and “both ceilings missing” scope statements
were stale. Dated evidence above must not be presented as current health.
The database operator is CloudNative PG. Bitnami postgresql-ha is retired
(no live release; `make pg-deploy` fail-closed, `RAILIANCE-WP-0016` item 14).
Valkey is a declared capability with no live instance and nothing left in S2
to extract; `make valkey-deploy` is gated until a consumer rapp exists.
## Responsibility split
OpenBao is a platform capability in this repo, but not every OpenBao-related
file belongs in the long-term S3 ownership home. The deployable package surface
now has a wave-1 repo home in `rapp-openbao`, while this repo retains custody,
policy, and lane governance.
| S3 retains | Other owner / handoff |
| --- | --- |
| Database service placement, custody and acceptance | `rapp-postgres`: package, admission enforcement and restore; consumers: schemas, migrations, workload SLOs and app verification |
| OpenBao service custody, ACL/role review, approved delivery and revocation proof | `rapp-openbao`: package; `key-cape`/`net-kingdom`: issuer, OIDC/MFA, directory/provider reconciliation |
| Platform acceptance of a credential lane | `secrets-engine`: lifecycle engine; `ops-mason`: construction coordination through engine APIs; `flex-auth`/access-engine and `approval-engine`: decisions and approval consumption |
| Service health semantics, recovery expectations and evidence production | `railiance-telemetry`: Q2 collection, retention and alert transport; it is not S3's monitoring implementation to build |
| Platform snapshot/unseal/readiness contribution to an outage | `railiance-infra`: host/reboot; `railiance-cluster`: Kubernetes/restart; consumer owner: synthetic load and application acceptance |
| Database/object-store/credential interfaces consumed by the forge | `railiance-forge`: forge backup orchestration, artifact retention and pruning; `activity-core`: automation execution |
| Scope accuracy and file-backed source records | `railiance-master`: fleet taxonomy and Q3 placement; `repo-manager`/State Hub: derived record identity and projection correctness |
---
DNS, host firewall, TLS/ingress primitives, Kubernetes runtime, CI templates,
application releases, business logic and identity/authorization decisions are
outside S3. Existing Forgejo helpers, ArgoCD bootstrap/application manifests,
and OpenBao package compatibility assets are retained migration surfaces, not
an expansion of that boundary. Transfer requires an accepting owner and tested
replacement entry points; source files are not deleted merely to tidy scope.
## In Scope
## Work that closes the intent gaps
- PostgreSQL via CloudNative PG operator (cnpg) — operator deployed, `databases` namespace active
- Valkey / Redis-compatible cache as a standalone Helm release (to be extracted from S2)
- Secret management infrastructure (OpenBao as the platform service,
SOPS/age for Git-at-rest bootstrap material)
- Identity services integration point (with net-kingdom)
- Message brokers (RabbitMQ, similar)
- Object storage (MinIO / S3-compatible)
- Backup and recovery services for platform data
The [current work index](workplans/README.md) groups six open workplans.
The [full assessment](history/2026-09-05-platform-intent-workplan-assessment.md)
records every reviewed plan and the consolidation mapping.
---
| Priority | Gap | Canonical work |
| --- | --- | --- |
| First | Reported credential exposures need final disposition and dependable operator custody | RPF-WP-0027: KeyCape/NetKingdom residual evidence and S3 custody; RPF-WP-0029: provider invalidation and replacement backup recovery |
| First | Private attended OpenBao access remains unproven end to end | RPF-WP-0025-T03; keep its window separate from incident/recovery actions |
| Next | Recovery procedures exist, but two cross-owner exercises still lack completion evidence | RPF-WP-0015-T02/T03: S3 contribution, with audit-core and S1/S2 executing their own parts |
| Next | Three requested credential lanes have designs but no live acceptance | RPF-WP-0035: one queue with separate consumer/issuer/approval gates |
| Next | Numeric availability/recovery promises, evidence freshness, recurring drills, emission and admission drift lack a complete S3 acceptance loop | RPF-WP-0036-T02–T05 |
| Next | Compatibility ownership, stale Hub aliases, and undeployed capability demand need explicit disposition | RPF-WP-0036-T06/T07 |
## Out of Scope
The ready work in RPF-WP-0036 can proceed while attended operations wait.
It must define achievable promises for the existing single-node substrate,
not declare HA through documentation. Any stronger availability target needs
an S1/S2 dependency and a package-level failover proof. Fleet-wide Q3 ownership
is an architecture question; it does not suspend S3's own recovery obligations.
- OS-level concerns → railiance-infra (S1)
- Kubernetes runtime → railiance-cluster (S2)
- Developer tooling, CI/CD → railiance-enablement (S4)
- Application deployments → railiance-apps (S5)
- Standalone workload-package ownership for OpenBao deployment assets -> `rapp-openbao`, while S3 retains secrets custody and policy
- No re-configuration of S1/S2 concerns from this repo
---
## Relevant When
- Deploying or managing shared services that multiple S5 applications depend on
- Extracting platform services from application Helm subcharts (boundary enforcement)
- S2 cluster is operational and platform layer can now be established
- Defining which OpenBao concerns are workload package assets versus retained platform governance
---
## Not Relevant When
- S2 (cluster runtime) is not yet operational (pre-condition not met)
- Application-specific database schemas or migrations (those belong in S5 apps)
- Infrastructure or cluster work (wrong layer)
---
## Current State
- Status: maintained / emerging
- Implementation: CloudNative PG operator live; `databases` namespace holds the platform clusters; OpenBao is the S3 secrets service. Bitnami postgresql-ha is retired. Valkey is undeployed.
- Stability: emerging — CNPG clusters are live; cache and in-cluster object storage are not
- Usage: shared database and secrets layer; cnpg-system, databases, and openbao namespaces are live
- Deploys via ArgoCD: four Applications (`external-secrets`, `issue-core`,
`openbao-secretstore`, `target-revenue`) plus AppProjects under
`argocd/bootstrap/`; see `docs/argocd-gitops.md`
- Emits to `railiance-telemetry` (Q2 Observability) once the evidence plane
exists — seeded 2026-08-11, not yet implemented
- Open work: Valkey remains a declared-but-unbuilt cache; MinIO is likewise
declared, not deployed. OpenBao package boundary and PAT cutover are
closed. Platform rapp declarations conform (`RAILIANCE-WP-0015`).
Versioned consumer interfaces: `docs/s3-consumer-interfaces.md`.
Tenancy posture and database placement policy are declared
(`docs/tenancy-posture.md`, `docs/placement-policy.md`, `RPF-WP-0018`).
Two open items they surfaced: `apps-pg` has no backup configured, and
both shared clusters owe a declared consumer ceiling before their third
consumer. Decisions are now recorded as ADRs in `docs/adr/` (ADR-0003).
- Known drift: State Hub attributes ~11 capabilities to this repo, including
S1/S2/S4/S5 concerns it does not own. The four `capability` blocks in this
file are authoritative; the hub carries stale pre-split attributions
(`ArchitectureBlueprint.md` C1)
---
## How It Fits
- Upstream dependencies: railiance-cluster (S2) — k3s running, Helm available, smoke tests passing
- Downstream consumers: railiance-enablement (S4), railiance-apps (S5) — all depend on platform services
- Often used with: net-kingdom (identity services integration), railiance-cluster (prior layer)
- Emits to: railiance-telemetry (evidence plane) — S3 services are expected to
emit health and readiness through the standard emission contract rather than
per-service bespoke integrations
- Structural backbone: `ArchitectureBlueprint.md` in this repo records the four
repo-family axes, the stack, repository status, and the open placement
decisions that `railiance-master` owns
---
## Terminology
- Preferred terms: OAS Stack Level S3, platform services, boundary rule, migration (extracting from S2 subcharts)
- Potentially confusing terms: "migration" here means moving Helm releases between layers, not database schema migration; `rapp-openbao` packages OpenBao, but it does not own platform custody or policy
---
## Related / Overlapping
- `railiance-cluster` (S2) — pre-condition; PostgreSQL was previously managed here (being extracted to S3)
- `railiance-apps` (S5) — consumes database and cache services from S3
- `net-kingdom` — identity services integration point at the platform layer
---
## Provided Capabilities
## Provided capabilities
```capability
type: infrastructure
title: PostgreSQL via CloudNative PG (cnpg)
description: PostgreSQL database clusters managed by the CloudNative PG operator — shared database service for all platform applications. Operator deployed in cnpg-system namespace; database clusters defined in the databases namespace.
description: Shared database service and placement policy with apps-pg controls and rapp-postgres package integration. Current evidenced deployments are single-instance; HA is not established.
keywords: [postgresql, postgres, cnpg, cloudnative-pg, operator, database, kubernetes]
```
```capability
type: infrastructure
title: Valkey / Redis-compatible cache
description: Declared shared Redis-compatible cache. Not deployed on railiance01 as of 2026-08-15; no S2 instance remains to extract.
description: Declared shared cache capability, not a supported live service. Deployment stays gated on an accepted consumer and service contract.
keywords: [valkey, redis, cache, shared, session, queue]
```
```capability
type: data
title: Object storage (MinIO / S3-compatible)
description: S3-compatible object storage service (MinIO) for artifact storage, backups, and large file handling across platform applications.
description: Governed external S3 backup-storage consumption exists. A general shared object-storage service, including in-cluster MinIO, remains undeployed and demand-gated.
keywords: [minio, s3, object-storage, storage, artifacts, backup]
```
```capability
type: security
title: OpenBao platform secrets service
description: Canonical S3 secrets service for runtime secrets, dynamic credentials, audit, and future workload integrations. SOPS/age remains the bootstrap mechanism for Git-at-rest secrets.
description: S3 custody, policy and approved runtime credential delivery; package assets belong to rapp-openbao. SOPS/age supports bootstrap custody. New lanes need independent live acceptance.
keywords: [openbao, secrets, vault-compatible, secret-management, dynamic-credentials, audit, kubernetes-auth]
```
---
## Getting oriented
## Getting Oriented
- Start with: `CLAUDE.md` (session protocol, boundary rules)
- Key files / directories: `workplans/RAIL-PL-WP-0001-platform-baseline.md`, `workplans/RAIL-PL-WP-0002-openbao-platform-secrets-service.md`, `helm/` (platform Helm charts), `docs/openbao.md`, `Makefile`
- Pre-conditions: railiance-cluster (S2) converged with k3s running; cluster backup verified before migration steps (`sudo make backup` in railiance-cluster)
Read [AGENTS.md](AGENTS.md), [INTENT.md](INTENT.md), then
[workplans/README.md](workplans/README.md). Completed plans are preserved under
`workplans/archived/`; [WORK-RECORDS.md](WORK-RECORDS.md) is the generated current
index (archives omitted). Routine sync follows AGENTS.md. The dated `.custodian-brief.md` and Hub
legacy aliases are not additional authoritative obligations.

166
WORK-RECORDS.md
View file

@ -8,161 +8,35 @@
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | RPF-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md |
| workplan | RPF-WP-0001 | finished | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| workplan | RPF-WP-0002 | finished | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| workplan | RPF-WP-0003 | finished | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| workplan | RPF-WP-0004 | finished | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| workplan | RPF-WP-0005 | finished | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
| workplan | RPF-WP-0006 | finished | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
| workplan | RPF-WP-0007 | finished | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
| workplan | RPF-WP-0008 | finished | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
| workplan | RPF-WP-0009 | finished | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| workplan | RPF-WP-0010 | finished | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
| workplan | RPF-WP-0011 | finished | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| workplan | RPF-WP-0012 | finished | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md |
| workplan | RPF-WP-0013 | finished | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| workplan | RPF-WP-0014 | finished | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| workplan | RPF-WP-0016 | finished | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| workplan | RPF-WP-0017 | finished | — | workplans/RPF-WP-0017-attended-login-output-containment.md |
| workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
| workplan | RPF-WP-0015 | blocked | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| workplan | RPF-WP-0025 | blocked | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
| workplan | RPF-WP-0026 | finished | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
| workplan | RPF-WP-0027 | active | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| workplan | RPF-WP-0028 | finished | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
| workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| workplan | RPF-WP-0029 | blocked | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
| workplan | RPF-WP-0030 | finished | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| workplan | RPF-WP-0031 | finished | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
| workplan | RPF-WP-0032 | blocked | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
| workplan | RPF-WP-0033 | blocked | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
| workplan | RPF-WP-0034 | blocked | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
| task | RPF-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md |
| task | RPF-WP-ADHOC-2026-08-23-T02 | done | — | workplans/ADHOC-2026-08-23.md |
| task | RPF-WP-0001-T01 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T02 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T03 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T04 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T05 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T06 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T07 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T08 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T09 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0001-T10 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md |
| task | RPF-WP-0002-T01 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| task | RPF-WP-0002-T02 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| task | RPF-WP-0002-T03 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| task | RPF-WP-0002-T04 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| task | RPF-WP-0002-T05 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md |
| task | RPF-WP-0003-T01 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T02 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T03 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T04 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T05 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T06 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0003-T07 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md |
| task | RPF-WP-0004-T01 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T02 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T03 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T04 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T05 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T06 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T07 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0004-T08 | cancel | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md |
| task | RPF-WP-0005-T01 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
| task | RPF-WP-0005-T02 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
| task | RPF-WP-0005-T03 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
| task | RPF-WP-0005-T04 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md |
| task | RPF-WP-0006-T01 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
| task | RPF-WP-0006-T02 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
| task | RPF-WP-0006-T03 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
| task | RPF-WP-0006-T04 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md |
| task | RPF-WP-0007-T01 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
| task | RPF-WP-0007-T02 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
| task | RPF-WP-0007-T03 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
| task | RPF-WP-0007-T04 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md |
| task | RPF-WP-0008-T01 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
| task | RPF-WP-0008-T02 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
| task | RPF-WP-0008-T03 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
| task | RPF-WP-0008-T04 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md |
| task | RPF-WP-0009-T01 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0009-T02 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0009-T03 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0009-T04 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0009-T05 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0009-T06 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md |
| task | RPF-WP-0010-T01 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
| task | RPF-WP-0010-T02 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
| task | RPF-WP-0010-T03 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md |
| task | RPF-WP-0011-T01 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| task | RPF-WP-0011-T02 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| task | RPF-WP-0011-T03 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| task | RPF-WP-0011-T04 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| task | RPF-WP-0011-T05 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md |
| task | RPF-WP-0012-T01 | done | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md |
| task | RPF-WP-0013-T01 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0013-T02 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0013-T03 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0013-T04 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0013-T05 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0013-T06 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md |
| task | RPF-WP-0014-T01 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
| task | RPF-WP-0014-T02 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
| task | RPF-WP-0014-T03 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md |
| workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| workplan | RPF-WP-0036 | ready | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T02 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T03 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md |
| task | RPF-WP-0016-T01 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0016-T02 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0016-T03 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0016-T04 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0016-T05 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0016-T06 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md |
| task | RPF-WP-0017-T01 | done | — | workplans/RPF-WP-0017-attended-login-output-containment.md |
| task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T04 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T05 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T06 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T07 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0019-T01 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| task | RPF-WP-0019-T02 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| task | RPF-WP-0019-T03 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| task | RPF-WP-0019-T04 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| task | RPF-WP-0020-T01 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
| task | RPF-WP-0020-T02 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
| task | RPF-WP-0020-T03 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
| task | RPF-WP-0020-T04 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
| task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
| task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
| task | RPF-WP-0025-T03 | wait | — | workplans/RPF-WP-0025-openbao-operator-only-access.md |
| task | RPF-WP-0026-T01 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
| task | RPF-WP-0026-T02 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
| task | RPF-WP-0026-T03 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md |
| task | RPF-WP-0027-T01 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T02 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T03 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T04 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T03 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T04 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T05 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0027-T06 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0028-T01 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
| task | RPF-WP-0028-T02 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md |
| task | RPF-WP-0027-T06 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md |
| task | RPF-WP-0029-T01 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
| task | RPF-WP-0029-T02 | wait | — | workplans/RPF-WP-0029-backup-credential-default-removal.md |
| task | RPF-WP-0030-T01 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| task | RPF-WP-0030-T02 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| task | RPF-WP-0030-T03 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| task | RPF-WP-0030-T04 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| task | RPF-WP-0030-T05 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md |
| task | RPF-WP-0031-T01 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
| task | RPF-WP-0031-T02 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md |
| task | RPF-WP-0032-T01 | done | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
| task | RPF-WP-0032-T02 | wait | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md |
| task | RPF-WP-0033-T01 | done | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
| task | RPF-WP-0033-T02 | wait | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md |
| task | RPF-WP-0034-T01 | done | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
| task | RPF-WP-0034-T02 | wait | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md |
| task | RPF-WP-0035-T01 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T02 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T03 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0035-T04 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md |
| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T02 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T03 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T04 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T05 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T06 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |
| task | RPF-WP-0036-T07 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md |

13
docs/credential-lane-designs/README.md
View file

@ -4,14 +4,15 @@ Reviewed against local owner source on 2026-09-05. These are proposed designs,
not approvals or executable CCRs. No live credentials or OpenBao objects were
created. Files here are deliberately outside the production CCR/policy scan.
| Design | Owning platform workplan | Consumer dependency | Main unresolved input |
| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input |
| --- | --- | --- | --- |
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 | STATE-WP-0085-T09 | Deployment binding, owner-approved custody and rotation window |
| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority |
| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support |
| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window |
Each workplan separates completed design work from the owner review,
implementation, and live acceptance still required. Proposed object names can
The completed design workplans are archived. RPF-WP-0035 is the canonical
queue for owner review, implementation, and live acceptance still required.
State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can
be reviewed now; none represents a surveyed or active object. Before any secret
or access request, use `warden route find` / `warden route show` as required by
AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git,

10
docs/credential-lane-designs/state-hub-preflight-signing.md
View file

@ -102,3 +102,13 @@ For a non-compromise failed deployment, keep operations fenced and restore the
prior chart/key version only with owner approval, then verify all replicas.
Keep protected historical KV versions until the retention decision; no automatic
destroy, provider rename, or weakening of preflight checks is part of this lane.
## Demand review — 2026-09-05
STATE-WP-0085-T09 completed its adoption-plan deliverable on 2026-08-31.
The still-proposed FLEX-WP-0020-T05 cutover carries the signing prerequisite.
State Hub is now explicitly transitional in its INTENT; State Hub/repo-manager
and the migration owner must confirm the target runtime and continued need
before provisioning this design. RPF-WP-0035-T04 is the current platform task;
RPF-WP-0034 is the archived design record. No demand withdrawal or activation
is inferred from retirement planning alone.

269
history/2026-09-05-platform-intent-workplan-assessment.md Normal file
View file

@ -0,0 +1,269 @@
# Railiance Platform intent, scope and workplan assessment — 2026-09-05
## Conclusion
The backlog mostly serves INTENT, but its presentation confused completed
implementation, waiting live acceptance, and work belonging to other owners.
The largest missing part of the intent is a continuing service-assurance loop:
clear promises, fresh recovery evidence, monitored capacity and observable
failure. It is not a lack of additional credential designs or a reason to
install every aspirational stateful service.
The review starts from platform commit `9d958f8e09a057d6ad688dc77001368b5feea029`.
It covers all 37 file-backed workplans and 168 task records, with detailed
inspection of every unfinished task, its source contracts and available owner
updates. Completed records were triaged by deliverable/boundary, not recertified
as current production health. The scope of work is assessment and consolidation;
no credentials were read, no live infrastructure changed, no external messages
sent, and no transfer acceptance was fabricated. INTENT is unchanged.
## What changed
Before: 29 finished plans, 2 active, 5 blocked, 1 archived; 31 files at the
workplan root, including 24 already finished. Task states: 150 done, 7 wait,
4 progress, 1 cancel and 6 historical `cancelled` tasks in the retired baseline.
Those legacy task spellings are preserved rather than silently rewriting the
historical baseline.
After: 32 finished plans, 5 blocked, 1 ready, 1 archived (39 records total).
Only six current workplans remain at the root; 27 completed plans moved to
`workplans/archived/260905-*` with their IDs and managed UUIDs intact. No source
record was deleted. The three design plans finish because their design work is
delivered and each implementation task is explicitly superseded in RPF-WP-0035.
They do not claim live lane completion. RPF-WP-0036 adds the missing assurance
work with six actionable follow-ups rather than six more umbrella workplans.
The number of blocked plans remains five: three lane waits became one queue,
and two apparently active plans were corrected to blocked because their
remaining work waits on owners/live windows. A smaller number achieved by
marking unperformed live work done would hide obligations, not consolidate them.
`SCOPE.md` now describes actual service boundaries, dated evidence and unsupported
guarantees. `workplans/README.md` is the short current queue. The accompanying
[inventory](2026-09-05-platform-workplan-inventory.json) preserves before/after
statuses, task dispositions, source revisions and every archive path.
## Important findings
### 1. Two claimed platform gaps were already closed
SCOPE said apps-pg had no backup and both shared clusters lacked ceilings.
RPF-WP-0019 and its 2026-08-20 evidence show daily backup/continuous WAL,
30-day retention, a 56-second scratch restore, 14/14 isolation/control probes,
and a three-consumer apps-pg ceiling with a provisionable overflow cell.
The consumer interface records platform-pg's four-declaration ceiling.
Evidence: [apps-pg restore](../docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md),
[isolation](../docs/evidence/RPF-WP-0019-isolation-2026-08-20.md), and
[interfaces](../docs/s3-consumer-interfaces.md). These are dated proofs, not a
fresh claim about backup age today. Do not reopen the completed bootstrap work.
### 2. Recovery/availability promises remain weaker than the aspiration
Both published shared database interfaces declare one instance and no HA.
CNPG's presence is not a multi-node availability guarantee. Database restore
artifacts exist; the examined OpenBao snapshot/preparation receipts and restore
templates do not establish a current recurring isolated-restore guarantee.
The earlier reboot returned the same PVC and is not proof of node-loss recovery.
S3 needs per-service accepted availability/RPO/RTO, retention and evidence-age
budgets, recovery custody/operator availability, and recurring proof of restore.
No numeric promise should be invented from one elapsed-time observation.
RPF-WP-0036-T02/T03 closes this gap while preserving the two specific pending
experiments in RPF-WP-0015. Fleet Q3 ownership remains for railiance-master;
S3 cannot use that uncertainty to decline its own recovery responsibility.
### 3. The security incident records need evidence reconciliation, not another rotation
KEY-WP-0011 is finished and NK-WP-0033-T04 records the bundle replacement.
Platform RPF-WP-0027-T04 was stale; it is now done by that existing owner evidence.
NK-WP-0033's 2026-08-27 update also records the resolver binding reconciliation,
but no complete green receipt and no retained predecessor for the negative test.
T03/T05/T06 remain waiting on current evidence disposition and exact custody.
The incident owner must decide how the missing predecessor proof is treated;
manual observations cannot be promoted into a fabricated receipt.
Provider/resolver/MFA verification belongs to NetKingdom and KeyCape; S3 owns
custody and its acceptance. RPF-WP-0029 remains a separate, high-priority backup
credential exposure until provider invalidation and replacement recovery are
proved. Neither a source fix nor this consolidation closes an exposure.
### 4. Observability is a shared dependency with a retained S3 obligation
`docs/placement-policy.md` labels capacity monitoring unmonitored. The reviewed
railiance-telemetry source is still seeded and owns the standard emission and
transport contract. Platform must define what its service signals mean, emit
safe metadata, and prove a failed/stale check reaches a named recipient. It
should not build a second monitoring plane, nor mark emission complete because
another repo has not delivered the receiver. RPF-WP-0036-T04 makes this split
and its end-to-end acceptance explicit.
### 5. Consumer admission records drift even though their controls exist
The placement policy mixes desired tenant-engine placement with statements of
live co-residency and predates Core Hub admission. The interface and package
source must be joined before deciding occupancy, overflow or retention impact.
This is an evidence/disclosure gap, not permission to move workloads.
RPF-WP-0036-T05 reconciles it using existing package admission checks.
### 6. Credential designs fit S3, but their end-to-end applications do not
The three new designs remain useful. Their platform-owned portions are custody,
exact policy/auth bindings, delivery and negative verification. Issuer/JWKS,
application CAS/session behavior, lifecycle/approval consumption, and runtime
rotation fencing belong to their respective owners. RPF-WP-0035 is the single
implementation queue, with separate gates for each lane.
The signing demand has a material qualification: STATE-WP-0085-T09 finished its
plan-generation scope on 2026-08-31. FLEX-WP-0020-T05 still needs signing for its
proposed live rename. State Hub's INTENT now places it in retirement planning.
Reconfirm the runtime and demand with State Hub/repo-manager and the consumer
before creating another transitional secret lane. Do not infer demand is
withdrawn merely because the service is transitional.
### 7. Some operational code remains in the wrong long-term ownership home
Forgejo pruning, image-inventory integration and backup orchestration belong
with railiance-forge, using S3's custody/storage interfaces and activity-core's
execution. OpenBao package wrappers belong to rapp-openbao. ArgoCD bootstrap,
generic delivery paths and individual app manifests need S2/S4/S5 splits.
These are retained compatibility assets; deleting or moving them without
accepting owners and tested callers would break working operations.
RPF-WP-0036-T06 carries a concrete acceptance-based handoff, not an assertion
that delegation already happened. The old architecture backlog RPF-WP-0011
stays closed; its unrelated fleet rows are not resurrected here.
### 8. Aspirational services need demand decisions, not speculative deployment
Cache, object storage and messaging fit INTENT. Valkey has no supported current
consumer interface and its deployment is deliberately gated. External S3 backup
consumption exists, so “no object storage” is too broad, while “MinIO provided”
is also unsupported. No shared messaging service is established by this review.
RPF-WP-0036-T07 must decide reuse, defer with a trigger, or accept a bounded
consumer-backed delivery plan for each. Resource purchase/engine selection and
provider deployment are not part of this assessment.
## Ownership and handoff assessment
These are recommended/respected responsibility boundaries, not newly accepted
external assignments. Existing task references show where owner work already
exists; missing acceptance stays a platform follow-up rather than disappearing.
| Platform task/surface | Owner work elsewhere | What stays here / completion boundary |
| --- | --- | --- |
| RPF-WP-0015-T02 | audit-core AUDIT-WP-0008 synthetic load/app proof; rapp-postgres database acceptance | Lease/ESO preconditions and restart-free recovery evidence for the exact consumer; fresh live window |
| RPF-WP-0015-T03 | railiance-infra reboot, railiance-cluster recovery, audit-core app proof; existing reviewed procedure receipts | Snapshot/custody/quorum/ESO/database readiness contribution, not whole-host execution ownership |
| RPF-WP-0025-T03 | rapp-openbao RAPP-OPENBAO-WP-0002; net-kingdom NK-WP-0032; S1/S2 DNS/network; ops-bridge tunnel | Exact OpenBao callback and private attended access acceptance; source readiness does not prove cutover |
| RPF-WP-0027-T03/T05 | KEY-WP-0011 delivered; NK-WP-0033-T03/T05 residual command/evidence disposition | Accept provider evidence; do not repeat its completed rotation or take over resolver operations |
| RPF-WP-0027-T06 | NetKingdom operator handoff and eventual routing consumer | Canonical confirmed custody coordinates, scope, lifecycle and receipt |
| RPF-WP-0029-T02 | Provider owner for invalidation; RAIL-HO-WP-0012 for S1 backup; railiance-forge for forge recovery | Governed replacement custody and accepted invalidation/upload/restore evidence |
| RPF-WP-0035-T02 | KEY-WP-0009 issuer; SECRETS-WP-0008-T06 login and SECRETS-WP-0007-T04 apply authority | Exact JWT role/policy and custody acceptance, not lifecycle engine implementation |
| RPF-WP-0035-T03 | MASON-WP-0005 construction; FT-WP-0002 client; IAM group/assurance owners | Operator-write CCR/validator and exact OpenBao scope; no Telegram application logic |
| RPF-WP-0035-T04 | State Hub runtime/rotation, FLEX-WP-0020-T05 cutover, repo-manager retirement coordination | Confirm demand; scoped signing-key custody and delivery; no repository rename |
| RPF-WP-0036-T04 | railiance-telemetry Q2 receiving/emission contract | S3 signal semantics and producer/receipt acceptance |
| RPF-WP-0036-T06 | Forge/package/S2/S4/S5 accepting owners; repo-manager/State Hub derived records | Exact inventory, stable contracts, tested handoff; preserve responsibility until accepted |
| RPF-WP-0036-T07 | Resource-control/reef-storage procurement; artifact-store existing surface; railiance-master Q3 placement | Demand/reuse review and S3 service obligations; no fleet architecture program here |
## Task-level consolidation and status corrections
| Source task | Disposition | Successor / reason |
| --- | --- | --- |
| RPF-WP-0032-T02 | wait → cancel (superseded) | RPF-WP-0035-T02; original JWT design preserved |
| RPF-WP-0033-T02 | wait → cancel (superseded) | RPF-WP-0035-T03; original operator KV design preserved |
| RPF-WP-0034-T02 | wait → cancel (superseded) | RPF-WP-0035-T04; original signing design preserved and demand qualified |
| RPF-WP-0015-T02/T03 | progress → wait | Procedures prepared; live experiments/owner gates outstanding |
| RPF-WP-0027-T03/T06 | progress → wait | Current evidence disposition and confirmed custody still outstanding |
| RPF-WP-0027-T04 | wait → done | Existing KeyCape/NetKingdom owner-controlled replacement evidence; no new live act |
| RPF-WP-0027-T05 | stays wait | Complete residual evidence/incident-owner disposition absent |
| RPF-WP-0025-T03 | stays wait | Fresh attended callback/login and retraction proof absent |
| RPF-WP-0029-T02 | stays wait | Provider invalidation and replacement recovery evidence absent |
All other pre-existing task statuses are retained. No IDs or managed UUIDs are
reassigned. Archive moves preserve identity; the JSON inventory records exact
old/new paths. Historical evidence references keep their historical meaning;
resolve moved records through the per-plan register below and the archive map.
## Intent gap closure sequence
1. Keep the two exposure residuals first in the attended queue: RPF-WP-0027
and RPF-WP-0029. Close by evidence/disposition, not by recreating old actions.
2. In parallel with waiting for owners, begin RPF-WP-0036-T02 (service promises)
and T05 (admission/disclosure consistency). These have local work available.
3. Finish private access under RPF-WP-0025, then schedule independent recovery
exercises under RPF-WP-0015 with fresh gates. No combined blanket approval.
4. Implement recurring proof T03 and S3 emission T04 against owner contracts.
5. Advance each RPF-WP-0035 lane only as its consumer/issuer/authority gates
clear. Revalidate the transitional signing demand first.
6. Complete compatibility handoffs and capability demand decisions, T06/T07.
Do not build HA, cache, MinIO or a broker merely to make the scope sound full.
## Derived-state caveat
The start-of-session topic query included other financial-domain repositories;
it is not a repo backlog. After filtering the actual platform repo UUID,
two active legacy aliases remained alongside their canonical records:
| Legacy Hub record | Canonical source record |
| --- | --- |
| `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`, `railiance-wp-0024@retired-20260826` | RPF-WP-0015, `f4640325-e89c-591d-b58e-ec6b087900ac` |
| `038bc3c0-4492-5b91-95eb-ae515ca205df`, `railiance-wp-0029@retired-20260826` | RPF-WP-0027, `b2c25a01-4a80-55c1-90cf-8538000f7e0e` |
The generated brief is dated 2026-08-26 and also repeats stale work. These are
not additional file-backed tasks. RPF-WP-0036-T06 records the scoped derived
cleanup dependency; no blanket retirement or managed UUID rewrite is justified.
The fast sync receipt verifies the current pushed source projection; it must
not be interpreted as proof that all historical alias views were repaired.
## Review limitations and maintenance
This is source/evidence review, not a live cluster, IAM, billing or service
health audit. Sibling SCOPE files themselves sometimes lag owner workplans;
newer dated task evidence takes precedence for the findings above. No previously
approved live authority is renewed by a documentation edit. Existing unrelated
history is unchanged. Revisit this assessment on an incident closure, consumer
admission, telemetry contract availability or accepted service guarantee.
The following per-plan register is generated from the captured before-inventory
and reviewed disposition map, not from the stale Hub brief.
## Disposition of all 37 original plans
| Workplan | Before → after | Assessment |
| --- | --- | --- |
| [RPF-WP-ADHOC-2026-08-23](../workplans/archived/260905-ADHOC-2026-08-23.md) | finished → finished | Delivered tenancy evidence and broker test fixes; no residual project. |
| [RPF-WP-0001](../workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md) | finished → finished | Delivered custody/grant broker; retain S3 policy, route future engine lifecycle to secrets-engine. |
| [RPF-WP-0002](../workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md) | finished → finished | Delivered bounded delegated apply; S3 enforcement and approval boundary fit intent. |
| [RPF-WP-0003](../workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md) | finished → finished | Delivered Issue Core runtime custody; app ingestion remains consumer-owned. |
| [RPF-WP-0004](../workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md) | finished → finished | Delivered provider-key custody; provider/application lifecycle stays with its owner. |
| [RPF-WP-0005](../workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md) | finished → finished | Delivered reuse-surface runtime custody; webhook application logic is consumer-owned. |
| [RPF-WP-0006](../workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md) | finished → finished | Delivered OpenBao package boundary; compatibility handoff reviewed under 0036-T06. |
| [RPF-WP-0007](../workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md) | finished → finished | Delivered PAT custody cutover; future pruning ownership belongs to railiance-forge. |
| [RPF-WP-0008](../workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md) | finished → finished | Delivered CCR validation/test repair; keeps platform policy fail-closed. |
| [RPF-WP-0009](../workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md) | finished → finished | Delivered S3 rapp/interface conventions; fleet family taxonomy stays with master. |
| [RPF-WP-0010](../workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md) | finished → finished | Delivered apps-pg resource evidence; recurring freshness is 0036-T03/T04. |
| [RPF-WP-0011](../workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md) | finished → finished | Delivered S3 architecture cleanup; unrelated fleet rows remain outside S3. |
| [RPF-WP-0012](../workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md) | finished → finished | Delivered consumption-mode enforcement; consume policy, do not own commercial decisions. |
| [RPF-WP-0013](../workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md) | finished → finished | Delivered agent high-risk deny coverage; retained S3 custody boundary. |
| [RPF-WP-0014](../workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md) | finished → finished | Delivered hub-core candidate lanes; application migration stays with consumer/package. |
| [RPF-WP-0015](../workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | active → blocked | Keep scoped recovery contribution; prepared procedures wait on fresh live gates. |
| [RPF-WP-0016](../workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md) | finished → finished | Delivered ephemeral custody lifecycle; no unattended reaper authority implied. |
| [RPF-WP-0017](../workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md) | finished → finished | Delivered output-containment repair; future drill still needs fresh acceptance. |
| [RPF-WP-0018](../workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md) | finished → finished | Delivered tenancy/placement policy and ADR surface; ongoing drift is 0036-T05. |
| [RPF-WP-0019](../workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md) | finished → finished | Delivered backup/controls/ceiling/isolation; correct stale SCOPE, do not reopen. |
| [RPF-WP-0020](../workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md) | finished → finished | Delivered CCR migration/draft model; schema extension for new write lane is 0035-T03. |
| [RPF-WP-0025](../workplans/RPF-WP-0025-openbao-operator-only-access.md) | blocked → blocked | Keep private access cutover; exact attended login, package and network gates. |
| [RPF-WP-0026](../workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md) | finished → finished | Delivered canonical authorization consumption; PDP remains outside S3. |
| [RPF-WP-0027](../workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | active → blocked | Narrow to custody/residual evidence; owner rotation already delivered; no repeat rotation. |
| [RPF-WP-0028](../workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md) | finished → finished | Delivered durable inventory; future forge/automation handoff is 0036-T06. |
| [RPF-WP-0029](../workplans/RPF-WP-0029-backup-credential-default-removal.md) | blocked → blocked | Keep provider invalidation/recovery evidence; source fallback removal alone is insufficient. |
| [RPF-WP-0030](../workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md) | finished → finished | Delivered Core Hub onboarding; preserve distinct identity, reconcile disclosures in 0036-T05. |
| [RPF-WP-0031](../workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md) | finished → finished | Delivered scoped identity repair; do not repeat or broaden UUID edits. |
| [RPF-WP-0032](../workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T02. |
| [RPF-WP-0033](../workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T03. |
| [RPF-WP-0034](../workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T04; reconfirm transitional demand. |
| [RAIL-PL-WP-0002](../workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md) | finished → finished | Historical secrets-service bootstrap; continuing assurance belongs to 0036, not reopened bootstrap. |
| [RPF-WP-0021](../workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md) | finished → finished | Historical apps-pg bootstrap; stable identity preserved after previous collision repair. |
| [RPF-WP-0022](../workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md) | finished → finished | Historical GitOps bootstrap; retained mixed ownership inventory goes to 0036-T06. |
| [RPF-WP-0023](../workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md) | finished → finished | Delivered workload KV lane foundation; new demands use consolidated 0035. |
| [RPF-WP-0024](../workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md) | finished → finished | Delivered CCR approval workflow; retain S3 policy and consume approval authority. |
| [RAIL-PL-WP-0001](../workplans/archived/RAIL-PL-WP-0001-platform-baseline.md) | archived → archived | Retired baseline; six legacy cancelled tasks remain historical, not six open gaps. |

2183
history/2026-09-05-platform-workplan-inventory.json Normal file
View file

File diff suppressed because it is too large Load diff

25
workplans/README.md Normal file
View file

@ -0,0 +1,25 @@
# Current platform work
Reviewed 2026-09-05. Six open workplans: five blocked on explicit owner/live
gates and one ready for local work. Completed designs and implementations are
under `archived/`; their IDs and UUIDs are preserved. The number of blocked
plans is not a count of missing implementations or independent incidents.
| Workplan | Purpose and next gate | S3 boundary |
| --- | --- | --- |
| [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. |
| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup credential exposure; attended provider invalidation and replacement recovery receipts | S3 retains custody acceptance; S1 and forge own their backup execution. |
| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. |
| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; fresh synthetic-load/outage approvals and custody readiness | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. |
| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | One implementation queue for secrets-engine JWT, Fluid operator KV and preflight signing | Three independent task gates; no new approval inherited from the completed designs. |
| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | **Ready:** service guarantees, recurring evidence, S3 emission, admission consistency, ownership handoff and demand review | Local design/checking can progress while live work waits. |
Start with RPF-WP-0036-T02/T05 for work that does not require a live credential
or outage. Treat credential exposure closure as the highest-priority attended
work; task order does not combine or waive approvals.
[Assessment and disposition of every plan](../history/2026-09-05-platform-intent-workplan-assessment.md)
and [generated current record index](../WORK-RECORDS.md).
Do not recreate completed workplans because an old Hub alias or generated brief
still shows them active. Use source IDs, and follow AGENTS.md for verified sync.

31
workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Coordinate audit-core temporary custody and recovery exercises"
domain: financials
repo: railiance-platform
status: active
status: blocked
owner: codex
topic_slug: railiance
created: "2026-08-22"
updated: "2026-08-22"
updated: "2026-09-05"
related:
- AUDIT-WP-0008
- WH-ENG-20260822-AUDIT-E2-01
@ -119,7 +119,7 @@ copied for another engagement.
```task
id: RPF-WP-0015-T02
status: progress
status: wait
priority: high
state_hub_task_id: "fda4262a-56f6-5f06-a070-8fe7e1297209"
```
@ -175,7 +175,7 @@ live window after the Whitehat engagement cleanup.
```task
id: RPF-WP-0015-T03
status: progress
status: wait
priority: high
state_hub_task_id: "ba729d18-f053-539f-86ef-5cb8ad4cce45"
```
@ -313,3 +313,26 @@ each task.
- [ ] Database recovery is restart-free and evidenced without credential values.
- [ ] Reboot recovery has an ordered, owner-signed checklist and abort path.
- [x] No live action is implied by completing this design workplan.
## Portfolio review — 2026-09-05
INTENT binding: tested recovery and dependable custody. Procedure construction
is complete; the two tasks were incorrectly left `progress` while their live
windows remained unavailable. They now explicitly wait. This does not claim
that the experiments passed or that prior expired approvals can be reused.
T02 retains the S3 lease/ESO acceptance contribution. `audit-core` owns the
synthetic-load driver and application retry/readiness proof (AUDIT-WP-0008);
`rapp-postgres` owns database acceptance. Unblock with a revision-pinned load
receipt, named abort operator and fresh bounded window.
T03 retains only S3 snapshot, quorum/unseal, ESO and database-readiness gates.
Host reboot execution belongs to `railiance-infra`, cluster recovery to
`railiance-cluster`, application acceptance to audit-core. Existing owner
procedure receipts remain evidence of review, not fresh live GO. Unblock with
fresh snapshot/quorum/access evidence, owner confirmations and an outage window.
The terminal NO-GO is not rerunnable. RPF-WP-0017 closed the local output
containment defect; the next attempt still needs current acceptance evidence.
Do not create another platform-owned whole-host drill or duplicate these live
tasks in RPF-WP-0036; that plan owns recurring service assurance.

13
workplans/RPF-WP-0025-openbao-operator-only-access.md
View file

@ -8,7 +8,7 @@ status: blocked
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
updated: "2026-09-05"
related:
- RMASTER-WP-0020-T09
- RAPP-OPENBAO-WP-0002
@ -85,3 +85,14 @@ is ready to complete the browser/MFA act.
This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or
Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup.
## Portfolio review — 2026-09-05
INTENT binding: secure custody and an operable operator access path. Retain
T03 as the one attended cutover task; do not merge its approval/window with
incident rotation or reboot. Platform owns the exact OpenBao callback and
custody acceptance; rapp-openbao owns package exposure, KeyCape/NetKingdom the
issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives.
Unblock with a fresh attended OIDC/MFA callback update and loopback login,
then the guarded retraction and owner-specific DNS handoff. Existing source
readiness is not evidence of a completed live cutover.

41
workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Coordinate KeyCape live Secret exposure recovery"
domain: financials
repo: railiance-platform
status: active
status: blocked
owner: codex
topic_slug: railiance
created: "2026-08-23"
updated: "2026-08-23"
updated: "2026-09-05"
related:
- KEY-WP-0011
origin: routed
@ -56,7 +56,7 @@ predecessor revocation, and sanitized evidence.
```task
id: RPF-WP-0027-T03
status: progress
status: wait
priority: high
state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1"
```
@ -96,7 +96,7 @@ lane remains unresolved and no credential fetch or retry is authorized.
```task
id: RPF-WP-0027-T04
status: wait
status: done
priority: high
state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7"
```
@ -123,7 +123,7 @@ status, timestamps, and cleanup receipts.
```task
id: RPF-WP-0027-T06
status: progress
status: wait
priority: high
state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
```
@ -135,3 +135,34 @@ attended handoff identifier. Do not infer or invent any of these values. After
publication, update `docs/net-kingdom-credential-custody-contract.md`, ask
ops-warden to refresh lane resolvability, and pass only protected inputs to
NetKingdom's minimal resolver reconciliation flow.
## Portfolio review — 2026-09-05
INTENT binding: secure custody and incident closure. The goal above is historical;
the remaining platform scope is custody and acceptance of owner evidence.
**T04 is complete by existing owner evidence, not by a new action here.**
`key-cape/workplans/KEY-WP-0011-live-secret-exposure-recovery.md` T02/T03 and
`net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md` T04
record the approved 2026-08-23 bundle replacement. Do not repeat that rotation
merely because this platform task previously remained `wait`.
The 2026-08-27 NK-WP-0033-T05 update is newer than the earlier notes above:
the resolver binding was reconciled, but there is no complete green receipt.
The predecessor value is unavailable; manual observations are not a recorded
negative proof. No one should recover or fabricate a predecessor just to make
a test pass. The incident owner must rule explicitly on the residual evidence
and acceptable disposition. Overall incident closure remains open.
- T03 waits for current NetKingdom/provider evidence disposition and the exact
platform custody acknowledgements; old procedure acknowledgements exist.
- T05 waits for the repaired owner command's sanitized receipt and the
incident owner's explicit disposition of the unavailable predecessor.
NetKingdom owns resolver/MFA execution (NK-WP-0033-T03/T05); this repo accepts
custody-related results without taking over the identity provider.
- T06 waits for confirmed mount/path/fields, writer/reader authority and the
operator handoff. The existing draft leaves those facts intentionally blank.
No new owner acceptance or coordination message is asserted by this review.
Keep this incident separate from the new-lane queue; broad lane approval cannot
close an exposure.

10
workplans/RPF-WP-0029-backup-credential-default-removal.md
View file

@ -37,3 +37,13 @@ state_hub_task_id: "b3f3402f-890b-5781-9b3e-1c9c0d28cea8"
```
Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape.
## Portfolio review — 2026-09-05
INTENT binding: dependable backup custody and recovery. Retain T02 until the
provider owner invalidates the predecessor and supplies replacement upload and
restore receipts through CCR-2026-0004. Source removal is already complete.
S1 backup scheduling belongs to RAIL-HO-WP-0012; forge backup orchestration and
artifact retention belong to railiance-forge. RPF-WP-0036-T06 will obtain an
accepted compatibility handoff, but this exposure obligation stays visible
here until its evidence is accepted. No rotation was executed in this review.

119
workplans/RPF-WP-0035-credential-lane-implementation.md Normal file
View file

@ -0,0 +1,119 @@
---
id: RPF-WP-0035
type: workplan
title: "Implement reviewed credential lanes with separate owner gates"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
related:
- RPF-WP-0032
- RPF-WP-0033
- RPF-WP-0034
---
# Credential lane implementation
One S3 queue for three designed lanes; each task keeps its own approval,
execution and closure boundary. This replaces the implementation tasks in the
three completed design workplans, not the designs themselves. No approval is
inherited by consolidation. INTENT binding: secure custody, dependable delivery,
stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029.
## Consolidate completed designs and owner dependencies
```task
id: RPF-WP-0035-T01
status: done
priority: medium
```
Completed 2026-09-05. Preserved the three designs under
`docs/credential-lane-designs/`, identified native owner responsibilities and
linked each superseded task below. Owners have not been sent new requests and
no new external acceptance is claimed. STATE-WP-0085-T09 is already done;
the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
## Accept and provision secrets-engine service JWT login
```task
id: RPF-WP-0035-T02
status: wait
priority: high
```
Supersedes RPF-WP-0032-T02. Design:
`docs/credential-lane-designs/secrets-engine-service-jwt.md`.
Platform owns the exact JWT mount/role/policy, effective-policy negative tests
and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service
registration (KEY-WP-0009); secrets-engine owns service authentication and
authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer
readiness, approved source and attended apply authority. A service login does
not grant lane mutation authority. Do not build another identity provider or
lifecycle engine here.
**Done when:** approved exact role succeeds for the intended service, wrong
issuer/audience/subject/claims and unrelated secret access fail, bounded TTL
and revocation are proven, the consumer explicitly opts into the verified
contract, and rollback/cleanup receipts contain no secret material.
## Implement the platform operator-write CCR contract and Fluid lane
```task
id: RPF-WP-0035-T03
status: wait
priority: high
```
Supersedes RPF-WP-0033-T02. Design:
`docs/credential-lane-designs/fluid-telegram-operator-kv.md`.
Platform owns the per-path capability schema/validator, exact OpenBao policy
and accepted custody coordinates. MASON-WP-0005 owns construction coordination
and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership;
FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram
application acceptance. Retain the existing read-only CCR semantics.
**Unblock:** accept tenant/path and per-entry field/capability matrix; confirm
actual group/assurance and callbacks, reviewed construction contract and writer
authority. Contract review can proceed without a live credential; the final
schema cannot be treated as accepted solely because a draft exists.
**Done when:** validation rejects broad/unsupported grants, the consumer proves
CAS=0 first-write behavior and no value output, approved identities can perform
only the exact matrix, negative/expiry/revocation checks pass, custody is seeded
through the separate writer, and the verified route has a safe handoff receipt.
The unattended adapter remains a separate demand and gets no operator session.
## Accept the needed signing lane and deliver it to the owning runtime
```task
id: RPF-WP-0035-T04
status: wait
priority: medium
```
Supersedes RPF-WP-0034-T02. Design:
`docs/credential-lane-designs/state-hub-preflight-signing.md`.
Platform owns signing-key custody, exact read policy/role and scoped delivery
acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing
and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency;
STATE-WP-0085-T09's adoption-plan delivery is already complete.
**Unblock:** State Hub/repo-manager and the consuming migration owner confirm
that this transitional State Hub lane is still needed during retirement;
record the target runtime, namespace/SA/auth audience and an executable
rotation fence, plus approved writer and deployment window. Do not broaden the
lane into a general repository-rename authority or provision for a stale demand.
**Done when:** protected one-time generation, API-only ESO delivery, negative
access checks and a non-mutating signed preflight pass; every API replica uses
the accepted version; rotation/invalidation and recovery are evidenced. No
repository rename is part of S3 lane acceptance. If demand is withdrawn, record
the owning decision and cancel this task explicitly rather than provision it.

165
workplans/RPF-WP-0036-platform-service-assurance.md Normal file
View file

@ -0,0 +1,165 @@
---
id: RPF-WP-0036
type: workplan
title: "Close S3 service assurance and ownership gaps"
domain: financials
repo: railiance-platform
status: ready
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
---
# S3 service assurance and ownership gaps
Source: `history/2026-09-05-platform-intent-workplan-assessment.md`.
Reviewed against current repository evidence. This plan supplies the missing
continuing obligations; it does not reopen completed bootstrap projects or
duplicate incident/lane work. Repository design and read-only implementation
can progress now. Every live drill, scheduler, credential operation or migration
retains its own owner and execution gate.
## Record the portfolio assessment and consolidate source work
```task
id: RPF-WP-0036-T01
status: done
priority: high
```
Completed 2026-09-05. Assessed all 37 existing plans and their 168 task records,
corrected SCOPE, grouped the remaining obligations, consolidated the three
design follow-ups under RPF-WP-0035, archived completed plans with identities
preserved, and recorded owner handoffs and before/after inventory in history.
This certifies the source review, not live service health or external acceptance.
## Publish achievable service guarantees and recovery ownership
```task
id: RPF-WP-0036-T02
status: todo
priority: high
```
For apps-pg, platform-pg, OpenBao and each supported backup delivery lane,
publish a versioned service record: accountable S3/package/operator owners,
consumers, failure domain, availability objective, RPO/RTO, retention, recovery
key/quorum availability, maintenance/abort path and evidence freshness budget.
Separate measured results from accepted targets and unknowns. A 56-second
scratch restore is not an RTO commitment; one replica on one host is not HA.
Reuse `docs/s3-consumer-interfaces.md` and existing package declarations.
**Done when:** every supported service has owner-reviewed numeric targets or
an explicit unsupported guarantee and decision owner; consumer requirements
are compared to the current substrate; any HA/node-loss gap has an exact S1/S2
and package dependency rather than a blanket new-cluster project here.
## Make backup freshness and recurring recovery evidence checkable
```task
id: RPF-WP-0036-T03
status: todo
priority: high
```
Inventory authoritative CNPG backup/PITR, OpenBao snapshot/isolated restore,
encrypted off-host copy and custody-recovery receipts. Reuse existing validators
and package status commands. Define cadence/expiry from T02; return distinct
healthy, stale, missing and unavailable states using metadata only. Schedule
execution only through the accepted execution owner and separately approved
authority. Keep RPF-WP-0015's pending database/reboot experiments as the sole
live tasks for those experiments; RPF-WP-0029 retains provider-key recovery.
**Done when:** a current off-host backup and a current isolated restore receipt
exist for each supported data service, the approved cadence is installed and
its execution is evidenced, and missing/stale/failed evidence reaches a named
operator. A template, dated successful snapshot, or same-PVC reboot does not
pass as restore proof. Record independent recovery-key access without values.
## Produce S3 signals and prove their delivery to the evidence owner
```task
id: RPF-WP-0036-T04
status: todo
priority: high
```
Define service-owned health semantics for backup/WAL age, restore age, seal
state, ESO freshness, connection/memory headroom and consumer ceiling. Reuse
package emitters and the Q2 owner's standard contract; retain an explicit
unmonitored state and named manual checker until transport is accepted.
Request a concrete receiving contract from railiance-telemetry when routing is
authorized; do not implement a competing monitoring plane in S3.
**Done when:** bounded metadata-only samples pass contract validation, a
controlled stale/failure sample reaches a named recipient through the accepted
Q2 route, and missing emission itself is detectable. Local fixture tests may
finish before the receiver, but end-to-end acceptance cannot.
## Reconcile admission, placement and consumer interface drift
```task
id: RPF-WP-0036-T05
status: todo
priority: high
```
Join actual package declarations and authorized metadata to the S3 interface,
tenancy and placement records. Correct stale platform-pg occupancy/co-residency
(Core Hub admission versus older tenant-engine descriptions), distinguish
desired placement from observed placement, and verify the named overflow
targets remain provisionable. Add a bounded check for missing owners,
unsupported retention requests, quota/ceiling drift and stale evidence; consume
package admission checks instead of reimplementing them.
**Done when:** every admitted consumer has one authoritative placement/contract,
capacity and retention disclosures match package source and dated live proof,
and synthetic invalid admissions fail before provisioning. No workload moves
under this task without its own owner-reviewed migration.
## Obtain acceptance for compatibility assets and derived-record cleanup
```task
id: RPF-WP-0036-T06
status: todo
priority: medium
```
Prepare exact source/entry-point inventories and owner-ready handoffs for
Forgejo backup/pruning/image inventory (`railiance-forge`, activity-core
execution), retained OpenBao package wrappers (`rapp-openbao`), and ArgoCD
bootstrap/application manifests (S2/S4/S5 according to artifact). Keep S3
custody contracts and the RPF-WP-0029 exposure obligation here until accepted
closure. No new framework or app-specific helper belongs here by default.
Supply repo-manager/State Hub with the exact legacy alias/source identity map
from the assessment. Their apparent duplicate active records and stale brief
are derived-state defects, not additional workplans. Use scoped reconciliation;
never change managed UUIDs or blanket-acknowledge retirements to clean a view.
**Done when:** each retained compatibility surface has an accepting owner,
canonical replacement and tested callers or a dated retention decision; the
repo-filtered projection and generated brief agree with source identities.
Unaccepted transfer remains explicitly pending. No requests were sent during
the assessment and this task does not assert acceptance for another repo.
## Decide demand and reuse for undeployed stateful capabilities
```task
id: RPF-WP-0036-T07
status: todo
priority: medium
```
Review cache, general object storage and messaging separately with potential
consumers. Inventory existing providers/contracts (including artifact-store
and the external backup bucket) before selecting an engine. Record workload,
durability/latency/retention needs, capacity, tenancy, custody, package owner,
recovery cost and operating owner for any accepted demand. Ask railiance-master
to resolve fleet Q3 ownership through its architecture process; do not assign
it to S3 by implication.
**Done when:** each capability has a dated decision to reuse, defer with a
review trigger, or start a bounded consumer-backed delivery plan with explicit
acceptance criteria. “No accepted demand; keep deploy gated” is a valid result.
No Valkey, MinIO, RabbitMQ or new provider purchase is authorized by this plan.

0
workplans/ADHOC-2026-08-23.md → workplans/archived/260905-ADHOC-2026-08-23.md
View file

0
workplans/RPF-WP-0001-credential-request-and-lease-broker.md → workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md
View file

0
workplans/RPF-WP-0002-openbao-approved-automation-delegation.md → workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md
View file

0
workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md → workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md
View file

0
workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md → workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md
View file

0
workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md → workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md
View file

0
workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md → workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md
View file

0
workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md → workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md
View file

0
workplans/RPF-WP-0008-credential-change-suite-stabilization.md → workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md
View file

0
workplans/RPF-WP-0009-platform-rapp-consistency.md → workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md
View file

0
workplans/RPF-WP-0010-apps-pg-resource-evidence.md → workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md
View file

0
workplans/RPF-WP-0011-architecture-cleanup-backlog.md → workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md
View file

0
workplans/RPF-WP-0012-consumption-mode-enforcement.md → workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md
View file

0
workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md → workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md
View file

0
workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md → workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md
View file

0
workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md → workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md
View file

0
workplans/RPF-WP-0017-attended-login-output-containment.md → workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md
View file

0
workplans/RPF-WP-0018-policy-surface-alignment.md → workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md
View file

0
workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md → workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md
View file

0
workplans/RPF-WP-0020-ccr-schema-drift.md → workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md
View file

0
workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md → workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md
View file

0
workplans/RPF-WP-0028-durable-live-image-inventory.md → workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md
View file

0
workplans/RPF-WP-0030-core-hub-platform-onboarding.md → workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md
View file

0
workplans/RPF-WP-0031-workplan-identity-collision.md → workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md
View file

12
workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md → workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Design secrets-engine service JWT login"
domain: financials
repo: railiance-platform
status: blocked
status: finished
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -32,7 +32,7 @@ production objects changed or owner messages sent.
```task
id: RPF-WP-0032-T02
status: wait
status: cancel
priority: high
state_hub_task_id: "d1f4a9f6-4ea5-5daa-97bb-039856855bc2"
```
@ -41,3 +41,11 @@ Confirm issuer, verification endpoint, actual KeyCape registration and live auth
Review the linked design and pin current source revisions before implementation.
Do not interpret this workplan or a proposed coordinate as live authorization.
## Portfolio review — 2026-09-05
The design deliverable is complete. The implementation obligation is preserved
in **RPF-WP-0035-T02**, the single credential-lane implementation queue.
T02 is `cancel` here only because it is superseded there; it is not implemented,
waived or externally accepted. The approved design scope and all existing
identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.

12
workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md → workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Design fluid-telegram attended operator KV lane"
domain: financials
repo: railiance-platform
status: blocked
status: finished
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -32,7 +32,7 @@ production objects changed or owner messages sent.
```task
id: RPF-WP-0033-T02
status: wait
status: cancel
priority: high
state_hub_task_id: "a542697f-adf8-59ac-9704-0bcde1d9fd0f"
```
@ -41,3 +41,11 @@ Obtain tenant/group/MFA decisions; extend the CCR schema, validator, renderer an
Review the linked design and pin current source revisions before implementation.
Do not interpret this workplan or a proposed coordinate as live authorization.
## Portfolio review — 2026-09-05
The design deliverable is complete. The implementation obligation is preserved
in **RPF-WP-0035-T03**, the single credential-lane implementation queue.
T02 is `cancel` here only because it is superseded there; it is not implemented,
waived or externally accepted. The approved design scope and all existing
identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.

12
workplans/RPF-WP-0034-state-hub-preflight-signing-design.md → workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Design State Hub preflight signing custody"
domain: financials
repo: railiance-platform
status: blocked
status: finished
owner: codex
created: "2026-09-05"
updated: "2026-09-05"
@ -32,7 +32,7 @@ production objects changed or owner messages sent.
```task
id: RPF-WP-0034-T02
status: wait
status: cancel
priority: high
state_hub_task_id: "96e4864a-fd17-529b-a72f-69ffd885a962"
```
@ -41,3 +41,11 @@ Confirm exact primary deployment and delivery identity; approve the writer and r
Review the linked design and pin current source revisions before implementation.
Do not interpret this workplan or a proposed coordinate as live authorization.
## Portfolio review — 2026-09-05
The design deliverable is complete. The implementation obligation is preserved
in **RPF-WP-0035-T04**, the single credential-lane implementation queue.
T02 is `cancel` here only because it is superseded there; it is not implemented,
waived or externally accepted. The approved design scope and all existing
identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.