From 9f83e426c742f2c9c19bb7974882c1ddcf1e13dc Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 5 Sep 2026 11:14:42 +0200 Subject: [PATCH] Consolidate platform workplans and assess intent gaps Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883 --- SCOPE.md | 199 +- WORK-RECORDS.md | 166 +- docs/credential-lane-designs/README.md | 13 +- .../state-hub-preflight-signing.md | 10 + ...-05-platform-intent-workplan-assessment.md | 269 ++ ...026-09-05-platform-workplan-inventory.json | 2183 +++++++++++++++++ workplans/README.md | 25 + ...-core-custody-and-recovery-coordination.md | 31 +- ...PF-WP-0025-openbao-operator-only-access.md | 13 +- ...7-keycape-live-secret-exposure-recovery.md | 41 +- ...-0029-backup-credential-default-removal.md | 10 + ...-WP-0035-credential-lane-implementation.md | 119 + .../RPF-WP-0036-platform-service-assurance.md | 165 ++ .../260905-ADHOC-2026-08-23.md} | 0 ...01-credential-request-and-lease-broker.md} | 0 ...openbao-approved-automation-delegation.md} | 0 ...-issue-core-runtime-ingestion-key-lane.md} | 0 ...m-connect-openrouter-provider-key-lane.md} | 0 ...e-surface-runtime-secrets-openbao-lane.md} | 0 ...-0006-rapp-openbao-extraction-boundary.md} | 0 ...0007-forgejo-admin-pat-openbao-cutover.md} | 0 ...-credential-change-suite-stabilization.md} | 0 ...-RPF-WP-0009-platform-rapp-consistency.md} | 0 ...-RPF-WP-0010-apps-pg-resource-evidence.md} | 0 ...F-WP-0011-architecture-cleanup-backlog.md} | 0 ...F-WP-0012-consumption-mode-enforcement.md} | 0 ...0013-agent-high-risk-boundary-coverage.md} | 0 ...14-hub-core-candidate-credential-lanes.md} | 0 ...-versioned-ephemeral-custody-lifecycle.md} | 0 ...0017-attended-login-output-containment.md} | 0 ...5-RPF-WP-0018-policy-surface-alignment.md} | 0 ...19-apps-pg-recoverability-and-controls.md} | 0 .../260905-RPF-WP-0020-ccr-schema-drift.md} | 0 ...flex-auth-credential-grant-integration.md} | 0 ...F-WP-0028-durable-live-image-inventory.md} | 0 ...F-WP-0030-core-hub-platform-onboarding.md} | 0 ...PF-WP-0031-workplan-identity-collision.md} | 0 ...0032-secrets-engine-service-jwt-design.md} | 12 +- ...0033-fluid-telegram-operator-kv-design.md} | 12 +- ...034-state-hub-preflight-signing-design.md} | 12 +- 40 files changed, 2985 insertions(+), 295 deletions(-) create mode 100644 history/2026-09-05-platform-intent-workplan-assessment.md create mode 100644 history/2026-09-05-platform-workplan-inventory.json create mode 100644 workplans/README.md create mode 100644 workplans/RPF-WP-0035-credential-lane-implementation.md create mode 100644 workplans/RPF-WP-0036-platform-service-assurance.md rename workplans/{ADHOC-2026-08-23.md => archived/260905-ADHOC-2026-08-23.md} (100%) rename workplans/{RPF-WP-0001-credential-request-and-lease-broker.md => archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md} (100%) rename workplans/{RPF-WP-0002-openbao-approved-automation-delegation.md => archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md} (100%) rename workplans/{RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md => archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md} (100%) rename workplans/{RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md => archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md} (100%) rename workplans/{RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md => archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md} (100%) rename workplans/{RPF-WP-0006-rapp-openbao-extraction-boundary.md => archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md} (100%) rename workplans/{RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md => archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md} (100%) rename workplans/{RPF-WP-0008-credential-change-suite-stabilization.md => archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md} (100%) rename workplans/{RPF-WP-0009-platform-rapp-consistency.md => archived/260905-RPF-WP-0009-platform-rapp-consistency.md} (100%) rename workplans/{RPF-WP-0010-apps-pg-resource-evidence.md => archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md} (100%) rename workplans/{RPF-WP-0011-architecture-cleanup-backlog.md => archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md} (100%) rename workplans/{RPF-WP-0012-consumption-mode-enforcement.md => archived/260905-RPF-WP-0012-consumption-mode-enforcement.md} (100%) rename workplans/{RPF-WP-0013-agent-high-risk-boundary-coverage.md => archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md} (100%) rename workplans/{RPF-WP-0014-hub-core-candidate-credential-lanes.md => archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md} (100%) rename workplans/{RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md => archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md} (100%) rename workplans/{RPF-WP-0017-attended-login-output-containment.md => archived/260905-RPF-WP-0017-attended-login-output-containment.md} (100%) rename workplans/{RPF-WP-0018-policy-surface-alignment.md => archived/260905-RPF-WP-0018-policy-surface-alignment.md} (100%) rename workplans/{RPF-WP-0019-apps-pg-recoverability-and-controls.md => archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md} (100%) rename workplans/{RPF-WP-0020-ccr-schema-drift.md => archived/260905-RPF-WP-0020-ccr-schema-drift.md} (100%) rename workplans/{RPF-WP-0026-flex-auth-credential-grant-integration.md => archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md} (100%) rename workplans/{RPF-WP-0028-durable-live-image-inventory.md => archived/260905-RPF-WP-0028-durable-live-image-inventory.md} (100%) rename workplans/{RPF-WP-0030-core-hub-platform-onboarding.md => archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md} (100%) rename workplans/{RPF-WP-0031-workplan-identity-collision.md => archived/260905-RPF-WP-0031-workplan-identity-collision.md} (100%) rename workplans/{RPF-WP-0032-secrets-engine-service-jwt-design.md => archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md} (76%) rename workplans/{RPF-WP-0033-fluid-telegram-operator-kv-design.md => archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md} (76%) rename workplans/{RPF-WP-0034-state-hub-preflight-signing-design.md => archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md} (76%) diff --git a/SCOPE.md b/SCOPE.md index dd8237e..897cc3b 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -1,169 +1,114 @@ # SCOPE -> This file helps you quickly understand what this repository is about, -> when it is relevant, and when it is not. -> It is intentionally lightweight and may be incomplete. +Reviewed 2026-09-05 against repository source, dated operating evidence and +adjacent owner contracts. This is a scope assessment, not a fresh live audit. +[INTENT.md](INTENT.md) remains the stable aspiration. ---- +## Purpose and boundary -## One-liner +Railiance's S3 shared stateful services: database provision and placement, +secret custody and delivery, and platform-data backup and recovery behind +versioned consumer interfaces. Cache, general object storage and messaging +remain demand-led capabilities; their inclusion in INTENT does not mean they +are deployed or justify running them without consumers. -S3 Platform Services layer of the Railiance OAS Stack — owns shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage. +S3 owns the service promise, custody and acceptance evidence. A `rapp-*` repo +owns its deployable package; the cluster and host owners supply the runtime. +Identity integration means consuming identity claims, not operating an identity +or authorization authority. See [ADR-0001](docs/adr/ADR-0001-s3-platform-service-boundary.md). ---- +## Current evidenced capability -## Core Idea +| Service | Implemented / evidenced | Limit and authority | +| --- | --- | --- | +| `apps-pg` | CNPG source, per-consumer database ACLs, 20-connection allowances, 15-second timeouts; daily backup, continuous WAL and 30-day retention; 56-second scratch restore and 14/14 boundary probes on 2026-08-20 | One instance; restart recovery, no HA or measured latency SLO. Ceiling 3, overflow `apps-pg-2` provisionable but demand-gated. S3 owns this CR and its controls. | +| `platform-pg` | Package-operated CNPG service, governed dynamic credentials, backup/restore evidence, Core Hub admission and private shadow evidence | `rapp-postgres` owns CR/provisioning/restore. S3 owns custody, placement policy and consumer disclosure. Published ceiling 4 declarations, counting the probe; reconcile current occupancy before admission. One instance is not HA. | +| OpenBao and credential delivery | CCR validation, policy/grant boundaries, approved apply interfaces, runtime KV/ESO and short-lived database lanes, ephemeral custody lifecycle | Package assets belong to `rapp-openbao`; custody/policy remains here. Existing helpers are not authority to mint arbitrary credentials. Operator-only access cutover and incident residuals remain open. | +| Backup storage consumption | Governed off-cluster S3 backup destination and credential lane used by CNPG; encrypted upload tooling for other backup consumers | Resource procurement belongs to `resource-control`/`reef-storage`. This does not establish a general S3 service or deployed MinIO. One successful restore does not establish a recurring recovery guarantee. | +| Cache / general object storage / messaging | Valkey deployment is gated; no supported consumer interface or deployed shared broker/general in-cluster object store is established by this review | Demand, reuse, ownership, service contract and recovery design must precede deployment. No engine/provider choice is made here. | -Railiance classifies repos along four orthogonal axes — `railiance-*` -(ownership), `rail-*` (execution contract), `rapp-*` (managed workload package), -`reef-*` (substrate boundary). This repo is `railiance-*`, at **S3** on the OAS -Stack dimension: the platform services that multiple applications share. Five -repos cover S1–S5; other `railiance-*` repos sit on other OAS dimensions rather -than on the stack. See `ArchitectureBlueprint.md` for the full backbone. +Evidence and contracts: [consumer interfaces](docs/s3-consumer-interfaces.md), +[apps-pg restore](docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md), +[apps-pg isolation](docs/evidence/RPF-WP-0019-isolation-2026-08-20.md), +[placement](docs/placement-policy.md), [tenancy](tenancy.yaml), and +[Core Hub capacity admission](docs/evidence/core-hub-postgres-capacity-admission-2026-08-20.md). +The former “apps-pg has no backup” and “both ceilings missing” scope statements +were stale. Dated evidence above must not be presented as current health. -The database operator is CloudNative PG. Bitnami postgresql-ha is retired -(no live release; `make pg-deploy` fail-closed, `RAILIANCE-WP-0016` item 14). -Valkey is a declared capability with no live instance and nothing left in S2 -to extract; `make valkey-deploy` is gated until a consumer rapp exists. +## Responsibility split -OpenBao is a platform capability in this repo, but not every OpenBao-related -file belongs in the long-term S3 ownership home. The deployable package surface -now has a wave-1 repo home in `rapp-openbao`, while this repo retains custody, -policy, and lane governance. +| S3 retains | Other owner / handoff | +| --- | --- | +| Database service placement, custody and acceptance | `rapp-postgres`: package, admission enforcement and restore; consumers: schemas, migrations, workload SLOs and app verification | +| OpenBao service custody, ACL/role review, approved delivery and revocation proof | `rapp-openbao`: package; `key-cape`/`net-kingdom`: issuer, OIDC/MFA, directory/provider reconciliation | +| Platform acceptance of a credential lane | `secrets-engine`: lifecycle engine; `ops-mason`: construction coordination through engine APIs; `flex-auth`/access-engine and `approval-engine`: decisions and approval consumption | +| Service health semantics, recovery expectations and evidence production | `railiance-telemetry`: Q2 collection, retention and alert transport; it is not S3's monitoring implementation to build | +| Platform snapshot/unseal/readiness contribution to an outage | `railiance-infra`: host/reboot; `railiance-cluster`: Kubernetes/restart; consumer owner: synthetic load and application acceptance | +| Database/object-store/credential interfaces consumed by the forge | `railiance-forge`: forge backup orchestration, artifact retention and pruning; `activity-core`: automation execution | +| Scope accuracy and file-backed source records | `railiance-master`: fleet taxonomy and Q3 placement; `repo-manager`/State Hub: derived record identity and projection correctness | ---- +DNS, host firewall, TLS/ingress primitives, Kubernetes runtime, CI templates, +application releases, business logic and identity/authorization decisions are +outside S3. Existing Forgejo helpers, ArgoCD bootstrap/application manifests, +and OpenBao package compatibility assets are retained migration surfaces, not +an expansion of that boundary. Transfer requires an accepting owner and tested +replacement entry points; source files are not deleted merely to tidy scope. -## In Scope +## Work that closes the intent gaps -- PostgreSQL via CloudNative PG operator (cnpg) — operator deployed, `databases` namespace active -- Valkey / Redis-compatible cache as a standalone Helm release (to be extracted from S2) -- Secret management infrastructure (OpenBao as the platform service, - SOPS/age for Git-at-rest bootstrap material) -- Identity services integration point (with net-kingdom) -- Message brokers (RabbitMQ, similar) -- Object storage (MinIO / S3-compatible) -- Backup and recovery services for platform data +The [current work index](workplans/README.md) groups six open workplans. +The [full assessment](history/2026-09-05-platform-intent-workplan-assessment.md) +records every reviewed plan and the consolidation mapping. ---- +| Priority | Gap | Canonical work | +| --- | --- | --- | +| First | Reported credential exposures need final disposition and dependable operator custody | RPF-WP-0027: KeyCape/NetKingdom residual evidence and S3 custody; RPF-WP-0029: provider invalidation and replacement backup recovery | +| First | Private attended OpenBao access remains unproven end to end | RPF-WP-0025-T03; keep its window separate from incident/recovery actions | +| Next | Recovery procedures exist, but two cross-owner exercises still lack completion evidence | RPF-WP-0015-T02/T03: S3 contribution, with audit-core and S1/S2 executing their own parts | +| Next | Three requested credential lanes have designs but no live acceptance | RPF-WP-0035: one queue with separate consumer/issuer/approval gates | +| Next | Numeric availability/recovery promises, evidence freshness, recurring drills, emission and admission drift lack a complete S3 acceptance loop | RPF-WP-0036-T02–T05 | +| Next | Compatibility ownership, stale Hub aliases, and undeployed capability demand need explicit disposition | RPF-WP-0036-T06/T07 | -## Out of Scope +The ready work in RPF-WP-0036 can proceed while attended operations wait. +It must define achievable promises for the existing single-node substrate, +not declare HA through documentation. Any stronger availability target needs +an S1/S2 dependency and a package-level failover proof. Fleet-wide Q3 ownership +is an architecture question; it does not suspend S3's own recovery obligations. -- OS-level concerns → railiance-infra (S1) -- Kubernetes runtime → railiance-cluster (S2) -- Developer tooling, CI/CD → railiance-enablement (S4) -- Application deployments → railiance-apps (S5) -- Standalone workload-package ownership for OpenBao deployment assets -> `rapp-openbao`, while S3 retains secrets custody and policy -- No re-configuration of S1/S2 concerns from this repo - ---- - -## Relevant When - -- Deploying or managing shared services that multiple S5 applications depend on -- Extracting platform services from application Helm subcharts (boundary enforcement) -- S2 cluster is operational and platform layer can now be established -- Defining which OpenBao concerns are workload package assets versus retained platform governance - ---- - -## Not Relevant When - -- S2 (cluster runtime) is not yet operational (pre-condition not met) -- Application-specific database schemas or migrations (those belong in S5 apps) -- Infrastructure or cluster work (wrong layer) - ---- - -## Current State - -- Status: maintained / emerging -- Implementation: CloudNative PG operator live; `databases` namespace holds the platform clusters; OpenBao is the S3 secrets service. Bitnami postgresql-ha is retired. Valkey is undeployed. -- Stability: emerging — CNPG clusters are live; cache and in-cluster object storage are not -- Usage: shared database and secrets layer; cnpg-system, databases, and openbao namespaces are live -- Deploys via ArgoCD: four Applications (`external-secrets`, `issue-core`, - `openbao-secretstore`, `target-revenue`) plus AppProjects under - `argocd/bootstrap/`; see `docs/argocd-gitops.md` -- Emits to `railiance-telemetry` (Q2 Observability) once the evidence plane - exists — seeded 2026-08-11, not yet implemented -- Open work: Valkey remains a declared-but-unbuilt cache; MinIO is likewise - declared, not deployed. OpenBao package boundary and PAT cutover are - closed. Platform rapp declarations conform (`RAILIANCE-WP-0015`). - Versioned consumer interfaces: `docs/s3-consumer-interfaces.md`. - Tenancy posture and database placement policy are declared - (`docs/tenancy-posture.md`, `docs/placement-policy.md`, `RPF-WP-0018`). - Two open items they surfaced: `apps-pg` has no backup configured, and - both shared clusters owe a declared consumer ceiling before their third - consumer. Decisions are now recorded as ADRs in `docs/adr/` (ADR-0003). -- Known drift: State Hub attributes ~11 capabilities to this repo, including - S1/S2/S4/S5 concerns it does not own. The four `capability` blocks in this - file are authoritative; the hub carries stale pre-split attributions - (`ArchitectureBlueprint.md` C1) - ---- - -## How It Fits - -- Upstream dependencies: railiance-cluster (S2) — k3s running, Helm available, smoke tests passing -- Downstream consumers: railiance-enablement (S4), railiance-apps (S5) — all depend on platform services -- Often used with: net-kingdom (identity services integration), railiance-cluster (prior layer) -- Emits to: railiance-telemetry (evidence plane) — S3 services are expected to - emit health and readiness through the standard emission contract rather than - per-service bespoke integrations -- Structural backbone: `ArchitectureBlueprint.md` in this repo records the four - repo-family axes, the stack, repository status, and the open placement - decisions that `railiance-master` owns - ---- - -## Terminology - -- Preferred terms: OAS Stack Level S3, platform services, boundary rule, migration (extracting from S2 subcharts) -- Potentially confusing terms: "migration" here means moving Helm releases between layers, not database schema migration; `rapp-openbao` packages OpenBao, but it does not own platform custody or policy - ---- - -## Related / Overlapping - -- `railiance-cluster` (S2) — pre-condition; PostgreSQL was previously managed here (being extracted to S3) -- `railiance-apps` (S5) — consumes database and cache services from S3 -- `net-kingdom` — identity services integration point at the platform layer - ---- - -## Provided Capabilities +## Provided capabilities ```capability type: infrastructure title: PostgreSQL via CloudNative PG (cnpg) -description: PostgreSQL database clusters managed by the CloudNative PG operator — shared database service for all platform applications. Operator deployed in cnpg-system namespace; database clusters defined in the databases namespace. +description: Shared database service and placement policy with apps-pg controls and rapp-postgres package integration. Current evidenced deployments are single-instance; HA is not established. keywords: [postgresql, postgres, cnpg, cloudnative-pg, operator, database, kubernetes] ``` ```capability type: infrastructure title: Valkey / Redis-compatible cache -description: Declared shared Redis-compatible cache. Not deployed on railiance01 as of 2026-08-15; no S2 instance remains to extract. +description: Declared shared cache capability, not a supported live service. Deployment stays gated on an accepted consumer and service contract. keywords: [valkey, redis, cache, shared, session, queue] ``` ```capability type: data title: Object storage (MinIO / S3-compatible) -description: S3-compatible object storage service (MinIO) for artifact storage, backups, and large file handling across platform applications. +description: Governed external S3 backup-storage consumption exists. A general shared object-storage service, including in-cluster MinIO, remains undeployed and demand-gated. keywords: [minio, s3, object-storage, storage, artifacts, backup] ``` ```capability type: security title: OpenBao platform secrets service -description: Canonical S3 secrets service for runtime secrets, dynamic credentials, audit, and future workload integrations. SOPS/age remains the bootstrap mechanism for Git-at-rest secrets. +description: S3 custody, policy and approved runtime credential delivery; package assets belong to rapp-openbao. SOPS/age supports bootstrap custody. New lanes need independent live acceptance. keywords: [openbao, secrets, vault-compatible, secret-management, dynamic-credentials, audit, kubernetes-auth] ``` ---- +## Getting oriented -## Getting Oriented - -- Start with: `CLAUDE.md` (session protocol, boundary rules) -- Key files / directories: `workplans/RAIL-PL-WP-0001-platform-baseline.md`, `workplans/RAIL-PL-WP-0002-openbao-platform-secrets-service.md`, `helm/` (platform Helm charts), `docs/openbao.md`, `Makefile` -- Pre-conditions: railiance-cluster (S2) converged with k3s running; cluster backup verified before migration steps (`sudo make backup` in railiance-cluster) +Read [AGENTS.md](AGENTS.md), [INTENT.md](INTENT.md), then +[workplans/README.md](workplans/README.md). Completed plans are preserved under +`workplans/archived/`; [WORK-RECORDS.md](WORK-RECORDS.md) is the generated current +index (archives omitted). Routine sync follows AGENTS.md. The dated `.custodian-brief.md` and Hub +legacy aliases are not additional authoritative obligations. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 81d7962..5aa346c 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,161 +8,35 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | RPF-WP-ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | -| workplan | RPF-WP-0001 | finished | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| workplan | RPF-WP-0002 | finished | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| workplan | RPF-WP-0003 | finished | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| workplan | RPF-WP-0004 | finished | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| workplan | RPF-WP-0005 | finished | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md | -| workplan | RPF-WP-0006 | finished | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md | -| workplan | RPF-WP-0007 | finished | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md | -| workplan | RPF-WP-0008 | finished | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md | -| workplan | RPF-WP-0009 | finished | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| workplan | RPF-WP-0010 | finished | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md | -| workplan | RPF-WP-0011 | finished | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| workplan | RPF-WP-0012 | finished | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md | -| workplan | RPF-WP-0013 | finished | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| workplan | RPF-WP-0014 | finished | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md | -| workplan | RPF-WP-0015 | active | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| workplan | RPF-WP-0016 | finished | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| workplan | RPF-WP-0017 | finished | — | workplans/RPF-WP-0017-attended-login-output-containment.md | -| workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | -| workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md | +| workplan | RPF-WP-0015 | blocked | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | workplan | RPF-WP-0025 | blocked | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | -| workplan | RPF-WP-0026 | finished | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md | -| workplan | RPF-WP-0027 | active | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | -| workplan | RPF-WP-0028 | finished | — | workplans/RPF-WP-0028-durable-live-image-inventory.md | +| workplan | RPF-WP-0027 | blocked | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | | workplan | RPF-WP-0029 | blocked | — | workplans/RPF-WP-0029-backup-credential-default-removal.md | -| workplan | RPF-WP-0030 | finished | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| workplan | RPF-WP-0031 | finished | — | workplans/RPF-WP-0031-workplan-identity-collision.md | -| workplan | RPF-WP-0032 | blocked | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md | -| workplan | RPF-WP-0033 | blocked | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md | -| workplan | RPF-WP-0034 | blocked | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md | -| task | RPF-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | -| task | RPF-WP-ADHOC-2026-08-23-T02 | done | — | workplans/ADHOC-2026-08-23.md | -| task | RPF-WP-0001-T01 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T02 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T03 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T04 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T05 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T06 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T07 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T08 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T09 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0001-T10 | done | — | workplans/RPF-WP-0001-credential-request-and-lease-broker.md | -| task | RPF-WP-0002-T01 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| task | RPF-WP-0002-T02 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| task | RPF-WP-0002-T03 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| task | RPF-WP-0002-T04 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| task | RPF-WP-0002-T05 | done | — | workplans/RPF-WP-0002-openbao-approved-automation-delegation.md | -| task | RPF-WP-0003-T01 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T02 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T03 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T04 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T05 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T06 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0003-T07 | done | — | workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md | -| task | RPF-WP-0004-T01 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T02 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T03 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T04 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T05 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T06 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T07 | done | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0004-T08 | cancel | — | workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md | -| task | RPF-WP-0005-T01 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md | -| task | RPF-WP-0005-T02 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md | -| task | RPF-WP-0005-T03 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md | -| task | RPF-WP-0005-T04 | done | — | workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md | -| task | RPF-WP-0006-T01 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md | -| task | RPF-WP-0006-T02 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md | -| task | RPF-WP-0006-T03 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md | -| task | RPF-WP-0006-T04 | done | — | workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md | -| task | RPF-WP-0007-T01 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md | -| task | RPF-WP-0007-T02 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md | -| task | RPF-WP-0007-T03 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md | -| task | RPF-WP-0007-T04 | done | — | workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md | -| task | RPF-WP-0008-T01 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md | -| task | RPF-WP-0008-T02 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md | -| task | RPF-WP-0008-T03 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md | -| task | RPF-WP-0008-T04 | done | — | workplans/RPF-WP-0008-credential-change-suite-stabilization.md | -| task | RPF-WP-0009-T01 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0009-T02 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0009-T03 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0009-T04 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0009-T05 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0009-T06 | done | — | workplans/RPF-WP-0009-platform-rapp-consistency.md | -| task | RPF-WP-0010-T01 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md | -| task | RPF-WP-0010-T02 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md | -| task | RPF-WP-0010-T03 | done | — | workplans/RPF-WP-0010-apps-pg-resource-evidence.md | -| task | RPF-WP-0011-T01 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| task | RPF-WP-0011-T02 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| task | RPF-WP-0011-T03 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| task | RPF-WP-0011-T04 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| task | RPF-WP-0011-T05 | done | — | workplans/RPF-WP-0011-architecture-cleanup-backlog.md | -| task | RPF-WP-0012-T01 | done | — | workplans/RPF-WP-0012-consumption-mode-enforcement.md | -| task | RPF-WP-0013-T01 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0013-T02 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0013-T03 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0013-T04 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0013-T05 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0013-T06 | done | — | workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md | -| task | RPF-WP-0014-T01 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md | -| task | RPF-WP-0014-T02 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md | -| task | RPF-WP-0014-T03 | done | — | workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md | +| workplan | RPF-WP-0035 | blocked | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| workplan | RPF-WP-0036 | ready | — | workplans/RPF-WP-0036-platform-service-assurance.md | | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| task | RPF-WP-0015-T02 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| task | RPF-WP-0015-T03 | progress | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | +| task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | +| task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| task | RPF-WP-0016-T01 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0016-T02 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0016-T03 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0016-T04 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0016-T05 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0016-T06 | done | — | workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md | -| task | RPF-WP-0017-T01 | done | — | workplans/RPF-WP-0017-attended-login-output-containment.md | -| task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T04 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T05 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T06 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0018-T07 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md | -| task | RPF-WP-0019-T01 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | -| task | RPF-WP-0019-T02 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | -| task | RPF-WP-0019-T03 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | -| task | RPF-WP-0019-T04 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md | -| task | RPF-WP-0020-T01 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md | -| task | RPF-WP-0020-T02 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md | -| task | RPF-WP-0020-T03 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md | -| task | RPF-WP-0020-T04 | done | — | workplans/RPF-WP-0020-ccr-schema-drift.md | | task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | | task | RPF-WP-0025-T02 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | | task | RPF-WP-0025-T03 | wait | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | -| task | RPF-WP-0026-T01 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md | -| task | RPF-WP-0026-T02 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md | -| task | RPF-WP-0026-T03 | done | — | workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md | | task | RPF-WP-0027-T01 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | | task | RPF-WP-0027-T02 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | -| task | RPF-WP-0027-T03 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | -| task | RPF-WP-0027-T04 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | +| task | RPF-WP-0027-T03 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | +| task | RPF-WP-0027-T04 | done | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | | task | RPF-WP-0027-T05 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | -| task | RPF-WP-0027-T06 | progress | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | -| task | RPF-WP-0028-T01 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md | -| task | RPF-WP-0028-T02 | done | — | workplans/RPF-WP-0028-durable-live-image-inventory.md | +| task | RPF-WP-0027-T06 | wait | — | workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md | | task | RPF-WP-0029-T01 | done | — | workplans/RPF-WP-0029-backup-credential-default-removal.md | | task | RPF-WP-0029-T02 | wait | — | workplans/RPF-WP-0029-backup-credential-default-removal.md | -| task | RPF-WP-0030-T01 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| task | RPF-WP-0030-T02 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| task | RPF-WP-0030-T03 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| task | RPF-WP-0030-T04 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| task | RPF-WP-0030-T05 | done | — | workplans/RPF-WP-0030-core-hub-platform-onboarding.md | -| task | RPF-WP-0031-T01 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md | -| task | RPF-WP-0031-T02 | done | — | workplans/RPF-WP-0031-workplan-identity-collision.md | -| task | RPF-WP-0032-T01 | done | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md | -| task | RPF-WP-0032-T02 | wait | — | workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md | -| task | RPF-WP-0033-T01 | done | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md | -| task | RPF-WP-0033-T02 | wait | — | workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md | -| task | RPF-WP-0034-T01 | done | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md | -| task | RPF-WP-0034-T02 | wait | — | workplans/RPF-WP-0034-state-hub-preflight-signing-design.md | +| task | RPF-WP-0035-T01 | done | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| task | RPF-WP-0035-T02 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| task | RPF-WP-0035-T03 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| task | RPF-WP-0035-T04 | wait | — | workplans/RPF-WP-0035-credential-lane-implementation.md | +| task | RPF-WP-0036-T01 | done | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T02 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T03 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T04 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T05 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T06 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | +| task | RPF-WP-0036-T07 | todo | — | workplans/RPF-WP-0036-platform-service-assurance.md | diff --git a/docs/credential-lane-designs/README.md b/docs/credential-lane-designs/README.md index d63a7f1..9acfbbf 100644 --- a/docs/credential-lane-designs/README.md +++ b/docs/credential-lane-designs/README.md @@ -4,14 +4,15 @@ Reviewed against local owner source on 2026-09-05. These are proposed designs, not approvals or executable CCRs. No live credentials or OpenBao objects were created. Files here are deliberately outside the production CCR/policy scan. -| Design | Owning platform workplan | Consumer dependency | Main unresolved input | +| Design | Design workplan / current implementation task | Consumer dependency | Main unresolved input | | --- | --- | --- | --- | -| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority | -| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support | -| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 | STATE-WP-0085-T09 | Deployment binding, owner-approved custody and rotation window | +| [Secrets-engine service JWT](secrets-engine-service-jwt.md) | RPF-WP-0032 (finished) / RPF-WP-0035-T02 | SECRETS-WP-0008-T06; SECRETS-WP-0007-T04 | Actual issuer/JWKS, live registration and scoped execution authority | +| [Fluid-telegram operator KV](fluid-telegram-operator-kv.md) | RPF-WP-0033 (finished) / RPF-WP-0035-T03 | MASON-WP-0005; FT-WP-0002 | Tenant acceptance, actual OIDC group, write-capable CCR support | +| [State Hub preflight signing](state-hub-preflight-signing.md) | RPF-WP-0034 (finished) / RPF-WP-0035-T04 | FLEX-WP-0020-T05; STATE-WP-0085-T09 delivered | Deployment binding, owner-approved custody and rotation window | -Each workplan separates completed design work from the owner review, -implementation, and live acceptance still required. Proposed object names can +The completed design workplans are archived. RPF-WP-0035 is the canonical +queue for owner review, implementation, and live acceptance still required. +State Hub retirement requires revalidating the signing demand before provisioning. Proposed object names can be reviewed now; none represents a surveyed or active object. Before any secret or access request, use `warden route find` / `warden route show` as required by AGENTS.md. Keep values, bearer tokens and signing/preflight tokens out of Git, diff --git a/docs/credential-lane-designs/state-hub-preflight-signing.md b/docs/credential-lane-designs/state-hub-preflight-signing.md index 2e808f5..6309bde 100644 --- a/docs/credential-lane-designs/state-hub-preflight-signing.md +++ b/docs/credential-lane-designs/state-hub-preflight-signing.md @@ -102,3 +102,13 @@ For a non-compromise failed deployment, keep operations fenced and restore the prior chart/key version only with owner approval, then verify all replicas. Keep protected historical KV versions until the retention decision; no automatic destroy, provider rename, or weakening of preflight checks is part of this lane. + +## Demand review — 2026-09-05 + +STATE-WP-0085-T09 completed its adoption-plan deliverable on 2026-08-31. +The still-proposed FLEX-WP-0020-T05 cutover carries the signing prerequisite. +State Hub is now explicitly transitional in its INTENT; State Hub/repo-manager +and the migration owner must confirm the target runtime and continued need +before provisioning this design. RPF-WP-0035-T04 is the current platform task; +RPF-WP-0034 is the archived design record. No demand withdrawal or activation +is inferred from retirement planning alone. diff --git a/history/2026-09-05-platform-intent-workplan-assessment.md b/history/2026-09-05-platform-intent-workplan-assessment.md new file mode 100644 index 0000000..b8fa5b5 --- /dev/null +++ b/history/2026-09-05-platform-intent-workplan-assessment.md @@ -0,0 +1,269 @@ +# Railiance Platform intent, scope and workplan assessment — 2026-09-05 + +## Conclusion + +The backlog mostly serves INTENT, but its presentation confused completed +implementation, waiting live acceptance, and work belonging to other owners. +The largest missing part of the intent is a continuing service-assurance loop: +clear promises, fresh recovery evidence, monitored capacity and observable +failure. It is not a lack of additional credential designs or a reason to +install every aspirational stateful service. + +The review starts from platform commit `9d958f8e09a057d6ad688dc77001368b5feea029`. +It covers all 37 file-backed workplans and 168 task records, with detailed +inspection of every unfinished task, its source contracts and available owner +updates. Completed records were triaged by deliverable/boundary, not recertified +as current production health. The scope of work is assessment and consolidation; +no credentials were read, no live infrastructure changed, no external messages +sent, and no transfer acceptance was fabricated. INTENT is unchanged. + +## What changed + +Before: 29 finished plans, 2 active, 5 blocked, 1 archived; 31 files at the +workplan root, including 24 already finished. Task states: 150 done, 7 wait, +4 progress, 1 cancel and 6 historical `cancelled` tasks in the retired baseline. +Those legacy task spellings are preserved rather than silently rewriting the +historical baseline. + +After: 32 finished plans, 5 blocked, 1 ready, 1 archived (39 records total). +Only six current workplans remain at the root; 27 completed plans moved to +`workplans/archived/260905-*` with their IDs and managed UUIDs intact. No source +record was deleted. The three design plans finish because their design work is +delivered and each implementation task is explicitly superseded in RPF-WP-0035. +They do not claim live lane completion. RPF-WP-0036 adds the missing assurance +work with six actionable follow-ups rather than six more umbrella workplans. + +The number of blocked plans remains five: three lane waits became one queue, +and two apparently active plans were corrected to blocked because their +remaining work waits on owners/live windows. A smaller number achieved by +marking unperformed live work done would hide obligations, not consolidate them. + +`SCOPE.md` now describes actual service boundaries, dated evidence and unsupported +guarantees. `workplans/README.md` is the short current queue. The accompanying +[inventory](2026-09-05-platform-workplan-inventory.json) preserves before/after +statuses, task dispositions, source revisions and every archive path. + +## Important findings + +### 1. Two claimed platform gaps were already closed + +SCOPE said apps-pg had no backup and both shared clusters lacked ceilings. +RPF-WP-0019 and its 2026-08-20 evidence show daily backup/continuous WAL, +30-day retention, a 56-second scratch restore, 14/14 isolation/control probes, +and a three-consumer apps-pg ceiling with a provisionable overflow cell. +The consumer interface records platform-pg's four-declaration ceiling. + +Evidence: [apps-pg restore](../docs/evidence/RPF-WP-0019-backup-restore-2026-08-20.md), +[isolation](../docs/evidence/RPF-WP-0019-isolation-2026-08-20.md), and +[interfaces](../docs/s3-consumer-interfaces.md). These are dated proofs, not a +fresh claim about backup age today. Do not reopen the completed bootstrap work. + +### 2. Recovery/availability promises remain weaker than the aspiration + +Both published shared database interfaces declare one instance and no HA. +CNPG's presence is not a multi-node availability guarantee. Database restore +artifacts exist; the examined OpenBao snapshot/preparation receipts and restore +templates do not establish a current recurring isolated-restore guarantee. +The earlier reboot returned the same PVC and is not proof of node-loss recovery. + +S3 needs per-service accepted availability/RPO/RTO, retention and evidence-age +budgets, recovery custody/operator availability, and recurring proof of restore. +No numeric promise should be invented from one elapsed-time observation. +RPF-WP-0036-T02/T03 closes this gap while preserving the two specific pending +experiments in RPF-WP-0015. Fleet Q3 ownership remains for railiance-master; +S3 cannot use that uncertainty to decline its own recovery responsibility. + +### 3. The security incident records need evidence reconciliation, not another rotation + +KEY-WP-0011 is finished and NK-WP-0033-T04 records the bundle replacement. +Platform RPF-WP-0027-T04 was stale; it is now done by that existing owner evidence. +NK-WP-0033's 2026-08-27 update also records the resolver binding reconciliation, +but no complete green receipt and no retained predecessor for the negative test. +T03/T05/T06 remain waiting on current evidence disposition and exact custody. +The incident owner must decide how the missing predecessor proof is treated; +manual observations cannot be promoted into a fabricated receipt. + +Provider/resolver/MFA verification belongs to NetKingdom and KeyCape; S3 owns +custody and its acceptance. RPF-WP-0029 remains a separate, high-priority backup +credential exposure until provider invalidation and replacement recovery are +proved. Neither a source fix nor this consolidation closes an exposure. + +### 4. Observability is a shared dependency with a retained S3 obligation + +`docs/placement-policy.md` labels capacity monitoring unmonitored. The reviewed +railiance-telemetry source is still seeded and owns the standard emission and +transport contract. Platform must define what its service signals mean, emit +safe metadata, and prove a failed/stale check reaches a named recipient. It +should not build a second monitoring plane, nor mark emission complete because +another repo has not delivered the receiver. RPF-WP-0036-T04 makes this split +and its end-to-end acceptance explicit. + +### 5. Consumer admission records drift even though their controls exist + +The placement policy mixes desired tenant-engine placement with statements of +live co-residency and predates Core Hub admission. The interface and package +source must be joined before deciding occupancy, overflow or retention impact. +This is an evidence/disclosure gap, not permission to move workloads. +RPF-WP-0036-T05 reconciles it using existing package admission checks. + +### 6. Credential designs fit S3, but their end-to-end applications do not + +The three new designs remain useful. Their platform-owned portions are custody, +exact policy/auth bindings, delivery and negative verification. Issuer/JWKS, +application CAS/session behavior, lifecycle/approval consumption, and runtime +rotation fencing belong to their respective owners. RPF-WP-0035 is the single +implementation queue, with separate gates for each lane. + +The signing demand has a material qualification: STATE-WP-0085-T09 finished its +plan-generation scope on 2026-08-31. FLEX-WP-0020-T05 still needs signing for its +proposed live rename. State Hub's INTENT now places it in retirement planning. +Reconfirm the runtime and demand with State Hub/repo-manager and the consumer +before creating another transitional secret lane. Do not infer demand is +withdrawn merely because the service is transitional. + +### 7. Some operational code remains in the wrong long-term ownership home + +Forgejo pruning, image-inventory integration and backup orchestration belong +with railiance-forge, using S3's custody/storage interfaces and activity-core's +execution. OpenBao package wrappers belong to rapp-openbao. ArgoCD bootstrap, +generic delivery paths and individual app manifests need S2/S4/S5 splits. +These are retained compatibility assets; deleting or moving them without +accepting owners and tested callers would break working operations. +RPF-WP-0036-T06 carries a concrete acceptance-based handoff, not an assertion +that delegation already happened. The old architecture backlog RPF-WP-0011 +stays closed; its unrelated fleet rows are not resurrected here. + +### 8. Aspirational services need demand decisions, not speculative deployment + +Cache, object storage and messaging fit INTENT. Valkey has no supported current +consumer interface and its deployment is deliberately gated. External S3 backup +consumption exists, so “no object storage” is too broad, while “MinIO provided” +is also unsupported. No shared messaging service is established by this review. +RPF-WP-0036-T07 must decide reuse, defer with a trigger, or accept a bounded +consumer-backed delivery plan for each. Resource purchase/engine selection and +provider deployment are not part of this assessment. + +## Ownership and handoff assessment + +These are recommended/respected responsibility boundaries, not newly accepted +external assignments. Existing task references show where owner work already +exists; missing acceptance stays a platform follow-up rather than disappearing. + +| Platform task/surface | Owner work elsewhere | What stays here / completion boundary | +| --- | --- | --- | +| RPF-WP-0015-T02 | audit-core AUDIT-WP-0008 synthetic load/app proof; rapp-postgres database acceptance | Lease/ESO preconditions and restart-free recovery evidence for the exact consumer; fresh live window | +| RPF-WP-0015-T03 | railiance-infra reboot, railiance-cluster recovery, audit-core app proof; existing reviewed procedure receipts | Snapshot/custody/quorum/ESO/database readiness contribution, not whole-host execution ownership | +| RPF-WP-0025-T03 | rapp-openbao RAPP-OPENBAO-WP-0002; net-kingdom NK-WP-0032; S1/S2 DNS/network; ops-bridge tunnel | Exact OpenBao callback and private attended access acceptance; source readiness does not prove cutover | +| RPF-WP-0027-T03/T05 | KEY-WP-0011 delivered; NK-WP-0033-T03/T05 residual command/evidence disposition | Accept provider evidence; do not repeat its completed rotation or take over resolver operations | +| RPF-WP-0027-T06 | NetKingdom operator handoff and eventual routing consumer | Canonical confirmed custody coordinates, scope, lifecycle and receipt | +| RPF-WP-0029-T02 | Provider owner for invalidation; RAIL-HO-WP-0012 for S1 backup; railiance-forge for forge recovery | Governed replacement custody and accepted invalidation/upload/restore evidence | +| RPF-WP-0035-T02 | KEY-WP-0009 issuer; SECRETS-WP-0008-T06 login and SECRETS-WP-0007-T04 apply authority | Exact JWT role/policy and custody acceptance, not lifecycle engine implementation | +| RPF-WP-0035-T03 | MASON-WP-0005 construction; FT-WP-0002 client; IAM group/assurance owners | Operator-write CCR/validator and exact OpenBao scope; no Telegram application logic | +| RPF-WP-0035-T04 | State Hub runtime/rotation, FLEX-WP-0020-T05 cutover, repo-manager retirement coordination | Confirm demand; scoped signing-key custody and delivery; no repository rename | +| RPF-WP-0036-T04 | railiance-telemetry Q2 receiving/emission contract | S3 signal semantics and producer/receipt acceptance | +| RPF-WP-0036-T06 | Forge/package/S2/S4/S5 accepting owners; repo-manager/State Hub derived records | Exact inventory, stable contracts, tested handoff; preserve responsibility until accepted | +| RPF-WP-0036-T07 | Resource-control/reef-storage procurement; artifact-store existing surface; railiance-master Q3 placement | Demand/reuse review and S3 service obligations; no fleet architecture program here | + +## Task-level consolidation and status corrections + +| Source task | Disposition | Successor / reason | +| --- | --- | --- | +| RPF-WP-0032-T02 | wait → cancel (superseded) | RPF-WP-0035-T02; original JWT design preserved | +| RPF-WP-0033-T02 | wait → cancel (superseded) | RPF-WP-0035-T03; original operator KV design preserved | +| RPF-WP-0034-T02 | wait → cancel (superseded) | RPF-WP-0035-T04; original signing design preserved and demand qualified | +| RPF-WP-0015-T02/T03 | progress → wait | Procedures prepared; live experiments/owner gates outstanding | +| RPF-WP-0027-T03/T06 | progress → wait | Current evidence disposition and confirmed custody still outstanding | +| RPF-WP-0027-T04 | wait → done | Existing KeyCape/NetKingdom owner-controlled replacement evidence; no new live act | +| RPF-WP-0027-T05 | stays wait | Complete residual evidence/incident-owner disposition absent | +| RPF-WP-0025-T03 | stays wait | Fresh attended callback/login and retraction proof absent | +| RPF-WP-0029-T02 | stays wait | Provider invalidation and replacement recovery evidence absent | + +All other pre-existing task statuses are retained. No IDs or managed UUIDs are +reassigned. Archive moves preserve identity; the JSON inventory records exact +old/new paths. Historical evidence references keep their historical meaning; +resolve moved records through the per-plan register below and the archive map. + +## Intent gap closure sequence + +1. Keep the two exposure residuals first in the attended queue: RPF-WP-0027 + and RPF-WP-0029. Close by evidence/disposition, not by recreating old actions. +2. In parallel with waiting for owners, begin RPF-WP-0036-T02 (service promises) + and T05 (admission/disclosure consistency). These have local work available. +3. Finish private access under RPF-WP-0025, then schedule independent recovery + exercises under RPF-WP-0015 with fresh gates. No combined blanket approval. +4. Implement recurring proof T03 and S3 emission T04 against owner contracts. +5. Advance each RPF-WP-0035 lane only as its consumer/issuer/authority gates + clear. Revalidate the transitional signing demand first. +6. Complete compatibility handoffs and capability demand decisions, T06/T07. + Do not build HA, cache, MinIO or a broker merely to make the scope sound full. + +## Derived-state caveat + +The start-of-session topic query included other financial-domain repositories; +it is not a repo backlog. After filtering the actual platform repo UUID, +two active legacy aliases remained alongside their canonical records: + +| Legacy Hub record | Canonical source record | +| --- | --- | +| `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`, `railiance-wp-0024@retired-20260826` | RPF-WP-0015, `f4640325-e89c-591d-b58e-ec6b087900ac` | +| `038bc3c0-4492-5b91-95eb-ae515ca205df`, `railiance-wp-0029@retired-20260826` | RPF-WP-0027, `b2c25a01-4a80-55c1-90cf-8538000f7e0e` | + +The generated brief is dated 2026-08-26 and also repeats stale work. These are +not additional file-backed tasks. RPF-WP-0036-T06 records the scoped derived +cleanup dependency; no blanket retirement or managed UUID rewrite is justified. +The fast sync receipt verifies the current pushed source projection; it must +not be interpreted as proof that all historical alias views were repaired. + +## Review limitations and maintenance + +This is source/evidence review, not a live cluster, IAM, billing or service +health audit. Sibling SCOPE files themselves sometimes lag owner workplans; +newer dated task evidence takes precedence for the findings above. No previously +approved live authority is renewed by a documentation edit. Existing unrelated +history is unchanged. Revisit this assessment on an incident closure, consumer +admission, telemetry contract availability or accepted service guarantee. + +The following per-plan register is generated from the captured before-inventory +and reviewed disposition map, not from the stale Hub brief. + +## Disposition of all 37 original plans + +| Workplan | Before → after | Assessment | +| --- | --- | --- | +| [RPF-WP-ADHOC-2026-08-23](../workplans/archived/260905-ADHOC-2026-08-23.md) | finished → finished | Delivered tenancy evidence and broker test fixes; no residual project. | +| [RPF-WP-0001](../workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md) | finished → finished | Delivered custody/grant broker; retain S3 policy, route future engine lifecycle to secrets-engine. | +| [RPF-WP-0002](../workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md) | finished → finished | Delivered bounded delegated apply; S3 enforcement and approval boundary fit intent. | +| [RPF-WP-0003](../workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md) | finished → finished | Delivered Issue Core runtime custody; app ingestion remains consumer-owned. | +| [RPF-WP-0004](../workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md) | finished → finished | Delivered provider-key custody; provider/application lifecycle stays with its owner. | +| [RPF-WP-0005](../workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md) | finished → finished | Delivered reuse-surface runtime custody; webhook application logic is consumer-owned. | +| [RPF-WP-0006](../workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md) | finished → finished | Delivered OpenBao package boundary; compatibility handoff reviewed under 0036-T06. | +| [RPF-WP-0007](../workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md) | finished → finished | Delivered PAT custody cutover; future pruning ownership belongs to railiance-forge. | +| [RPF-WP-0008](../workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md) | finished → finished | Delivered CCR validation/test repair; keeps platform policy fail-closed. | +| [RPF-WP-0009](../workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md) | finished → finished | Delivered S3 rapp/interface conventions; fleet family taxonomy stays with master. | +| [RPF-WP-0010](../workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md) | finished → finished | Delivered apps-pg resource evidence; recurring freshness is 0036-T03/T04. | +| [RPF-WP-0011](../workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md) | finished → finished | Delivered S3 architecture cleanup; unrelated fleet rows remain outside S3. | +| [RPF-WP-0012](../workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md) | finished → finished | Delivered consumption-mode enforcement; consume policy, do not own commercial decisions. | +| [RPF-WP-0013](../workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md) | finished → finished | Delivered agent high-risk deny coverage; retained S3 custody boundary. | +| [RPF-WP-0014](../workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md) | finished → finished | Delivered hub-core candidate lanes; application migration stays with consumer/package. | +| [RPF-WP-0015](../workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | active → blocked | Keep scoped recovery contribution; prepared procedures wait on fresh live gates. | +| [RPF-WP-0016](../workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md) | finished → finished | Delivered ephemeral custody lifecycle; no unattended reaper authority implied. | +| [RPF-WP-0017](../workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md) | finished → finished | Delivered output-containment repair; future drill still needs fresh acceptance. | +| [RPF-WP-0018](../workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md) | finished → finished | Delivered tenancy/placement policy and ADR surface; ongoing drift is 0036-T05. | +| [RPF-WP-0019](../workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md) | finished → finished | Delivered backup/controls/ceiling/isolation; correct stale SCOPE, do not reopen. | +| [RPF-WP-0020](../workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md) | finished → finished | Delivered CCR migration/draft model; schema extension for new write lane is 0035-T03. | +| [RPF-WP-0025](../workplans/RPF-WP-0025-openbao-operator-only-access.md) | blocked → blocked | Keep private access cutover; exact attended login, package and network gates. | +| [RPF-WP-0026](../workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md) | finished → finished | Delivered canonical authorization consumption; PDP remains outside S3. | +| [RPF-WP-0027](../workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | active → blocked | Narrow to custody/residual evidence; owner rotation already delivered; no repeat rotation. | +| [RPF-WP-0028](../workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md) | finished → finished | Delivered durable inventory; future forge/automation handoff is 0036-T06. | +| [RPF-WP-0029](../workplans/RPF-WP-0029-backup-credential-default-removal.md) | blocked → blocked | Keep provider invalidation/recovery evidence; source fallback removal alone is insufficient. | +| [RPF-WP-0030](../workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md) | finished → finished | Delivered Core Hub onboarding; preserve distinct identity, reconcile disclosures in 0036-T05. | +| [RPF-WP-0031](../workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md) | finished → finished | Delivered scoped identity repair; do not repeat or broaden UUID edits. | +| [RPF-WP-0032](../workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T02. | +| [RPF-WP-0033](../workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T03. | +| [RPF-WP-0034](../workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md) | blocked → finished | Design delivered; implementation T02 superseded by 0035-T04; reconfirm transitional demand. | +| [RAIL-PL-WP-0002](../workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md) | finished → finished | Historical secrets-service bootstrap; continuing assurance belongs to 0036, not reopened bootstrap. | +| [RPF-WP-0021](../workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md) | finished → finished | Historical apps-pg bootstrap; stable identity preserved after previous collision repair. | +| [RPF-WP-0022](../workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md) | finished → finished | Historical GitOps bootstrap; retained mixed ownership inventory goes to 0036-T06. | +| [RPF-WP-0023](../workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md) | finished → finished | Delivered workload KV lane foundation; new demands use consolidated 0035. | +| [RPF-WP-0024](../workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md) | finished → finished | Delivered CCR approval workflow; retain S3 policy and consume approval authority. | +| [RAIL-PL-WP-0001](../workplans/archived/RAIL-PL-WP-0001-platform-baseline.md) | archived → archived | Retired baseline; six legacy cancelled tasks remain historical, not six open gaps. | diff --git a/history/2026-09-05-platform-workplan-inventory.json b/history/2026-09-05-platform-workplan-inventory.json new file mode 100644 index 0000000..ac72844 --- /dev/null +++ b/history/2026-09-05-platform-workplan-inventory.json @@ -0,0 +1,2183 @@ +{ + "review_date": "2026-09-05", + "basis": "source and dated evidence; no fresh live health audit", + "source_revisions": { + "railiance-platform": { + "head": "9d958f8e09a057d6ad688dc77001368b5feea029", + "working_tree_dirty": true + }, + "railiance-telemetry": { + "head": "aa59e805ba218323eb19395484cd1c876684abfc", + "working_tree_dirty": false + }, + "railiance-master": { + "head": "5ffd7d1b40d56249f490a318e728047fd3517c4c", + "working_tree_dirty": false + }, + "railiance-infra": { + "head": "f3e8bf3ab4b1dafa4d0b251b88ab2ef23a30c37b", + "working_tree_dirty": false + }, + "railiance-cluster": { + "head": "db7860ec2e2bda803d5bc6f0a467935e0d98697f", + "working_tree_dirty": false + }, + "railiance-enablement": { + "head": "f91a5298cb9ad07b7bc9c488a7429f89c55f651d", + "working_tree_dirty": false + }, + "railiance-forge": { + "head": "e395e5e9c196fe7cea9cd2be513554e493e675ee", + "working_tree_dirty": false + }, + "rapp-openbao": { + "head": "89bc86b8aff549953ec744395ca47578aaac7591", + "working_tree_dirty": false + }, + "rapp-postgres": { + "head": "2b7fe861f984f8539ca63ede662fe5719ace895a", + "working_tree_dirty": false + }, + "net-kingdom": { + "head": "4e07d60ff17a0fe74c23d352aafaae08a809e413", + "working_tree_dirty": false + }, + "key-cape": { + "head": "30fa8570aaff6e03c35617b265201b2ebf2c0094", + "working_tree_dirty": false + }, + "secrets-engine": { + "head": "ebdff586fe60d165bc717f3fa1de8e037fd5502a", + "working_tree_dirty": false + }, + "ops-mason": { + "head": "f920bcad1af688197c15417257b392aec42db9e7", + "working_tree_dirty": true + }, + "state-hub": { + "head": "2c60e5bcf76c31a2d2336f104ac9d5f01fc22e90", + "working_tree_dirty": true + }, + "fluid-telegram": { + "head": "f7af151f37a7d652fe389daf43efc9be0d3e2bc0", + "working_tree_dirty": false + }, + "audit-core": { + "head": "95dcb78e17d46889c17b55e3ba1aadbcceec6a99", + "working_tree_dirty": false + }, + "flex-auth": { + "head": "56940727bfb36aec705318b0128599f367256c23", + "working_tree_dirty": false + }, + "repo-manager": { + "head": "55002b6fc954bf6f61eeac20fb7d50d52aee7b75", + "working_tree_dirty": false + } + }, + "before": [ + { + "id": "RPF-WP-ADHOC-2026-08-23", + "path": "workplans/ADHOC-2026-08-23.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-ADHOC-2026-08-23-T01", + "status": "done" + }, + { + "id": "RPF-WP-ADHOC-2026-08-23-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0001", + "path": "workplans/RPF-WP-0001-credential-request-and-lease-broker.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0001-T01", + "status": "done" + }, + { + "id": "RPF-WP-0001-T02", + "status": "done" + }, + { + "id": "RPF-WP-0001-T03", + "status": "done" + }, + { + "id": "RPF-WP-0001-T04", + "status": "done" + }, + { + "id": "RPF-WP-0001-T05", + "status": "done" + }, + { + "id": "RPF-WP-0001-T06", + "status": "done" + }, + { + "id": "RPF-WP-0001-T07", + "status": "done" + }, + { + "id": "RPF-WP-0001-T08", + "status": "done" + }, + { + "id": "RPF-WP-0001-T09", + "status": "done" + }, + { + "id": "RPF-WP-0001-T10", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0002", + "path": "workplans/RPF-WP-0002-openbao-approved-automation-delegation.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0002-T01", + "status": "done" + }, + { + "id": "RPF-WP-0002-T02", + "status": "done" + }, + { + "id": "RPF-WP-0002-T03", + "status": "done" + }, + { + "id": "RPF-WP-0002-T04", + "status": "done" + }, + { + "id": "RPF-WP-0002-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0003", + "path": "workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0003-T01", + "status": "done" + }, + { + "id": "RPF-WP-0003-T02", + "status": "done" + }, + { + "id": "RPF-WP-0003-T03", + "status": "done" + }, + { + "id": "RPF-WP-0003-T04", + "status": "done" + }, + { + "id": "RPF-WP-0003-T05", + "status": "done" + }, + { + "id": "RPF-WP-0003-T06", + "status": "done" + }, + { + "id": "RPF-WP-0003-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0004", + "path": "workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0004-T01", + "status": "done" + }, + { + "id": "RPF-WP-0004-T02", + "status": "done" + }, + { + "id": "RPF-WP-0004-T03", + "status": "done" + }, + { + "id": "RPF-WP-0004-T04", + "status": "done" + }, + { + "id": "RPF-WP-0004-T05", + "status": "done" + }, + { + "id": "RPF-WP-0004-T06", + "status": "done" + }, + { + "id": "RPF-WP-0004-T07", + "status": "done" + }, + { + "id": "RPF-WP-0004-T08", + "status": "cancel" + } + ] + }, + { + "id": "RPF-WP-0005", + "path": "workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0005-T01", + "status": "done" + }, + { + "id": "RPF-WP-0005-T02", + "status": "done" + }, + { + "id": "RPF-WP-0005-T03", + "status": "done" + }, + { + "id": "RPF-WP-0005-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0006", + "path": "workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0006-T01", + "status": "done" + }, + { + "id": "RPF-WP-0006-T02", + "status": "done" + }, + { + "id": "RPF-WP-0006-T03", + "status": "done" + }, + { + "id": "RPF-WP-0006-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0007", + "path": "workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0007-T01", + "status": "done" + }, + { + "id": "RPF-WP-0007-T02", + "status": "done" + }, + { + "id": "RPF-WP-0007-T03", + "status": "done" + }, + { + "id": "RPF-WP-0007-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0008", + "path": "workplans/RPF-WP-0008-credential-change-suite-stabilization.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0008-T01", + "status": "done" + }, + { + "id": "RPF-WP-0008-T02", + "status": "done" + }, + { + "id": "RPF-WP-0008-T03", + "status": "done" + }, + { + "id": "RPF-WP-0008-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0009", + "path": "workplans/RPF-WP-0009-platform-rapp-consistency.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0009-T01", + "status": "done" + }, + { + "id": "RPF-WP-0009-T02", + "status": "done" + }, + { + "id": "RPF-WP-0009-T03", + "status": "done" + }, + { + "id": "RPF-WP-0009-T04", + "status": "done" + }, + { + "id": "RPF-WP-0009-T05", + "status": "done" + }, + { + "id": "RPF-WP-0009-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0010", + "path": "workplans/RPF-WP-0010-apps-pg-resource-evidence.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0010-T01", + "status": "done" + }, + { + "id": "RPF-WP-0010-T02", + "status": "done" + }, + { + "id": "RPF-WP-0010-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0011", + "path": "workplans/RPF-WP-0011-architecture-cleanup-backlog.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0011-T01", + "status": "done" + }, + { + "id": "RPF-WP-0011-T02", + "status": "done" + }, + { + "id": "RPF-WP-0011-T03", + "status": "done" + }, + { + "id": "RPF-WP-0011-T04", + "status": "done" + }, + { + "id": "RPF-WP-0011-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0012", + "path": "workplans/RPF-WP-0012-consumption-mode-enforcement.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0012-T01", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0013", + "path": "workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0013-T01", + "status": "done" + }, + { + "id": "RPF-WP-0013-T02", + "status": "done" + }, + { + "id": "RPF-WP-0013-T03", + "status": "done" + }, + { + "id": "RPF-WP-0013-T04", + "status": "done" + }, + { + "id": "RPF-WP-0013-T05", + "status": "done" + }, + { + "id": "RPF-WP-0013-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0014", + "path": "workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0014-T01", + "status": "done" + }, + { + "id": "RPF-WP-0014-T02", + "status": "done" + }, + { + "id": "RPF-WP-0014-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0015", + "path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md", + "status": "active", + "tasks": [ + { + "id": "RPF-WP-0015-T01", + "status": "done" + }, + { + "id": "RPF-WP-0015-T02", + "status": "progress" + }, + { + "id": "RPF-WP-0015-T03", + "status": "progress" + }, + { + "id": "RPF-WP-0015-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0016", + "path": "workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0016-T01", + "status": "done" + }, + { + "id": "RPF-WP-0016-T02", + "status": "done" + }, + { + "id": "RPF-WP-0016-T03", + "status": "done" + }, + { + "id": "RPF-WP-0016-T04", + "status": "done" + }, + { + "id": "RPF-WP-0016-T05", + "status": "done" + }, + { + "id": "RPF-WP-0016-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0017", + "path": "workplans/RPF-WP-0017-attended-login-output-containment.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0017-T01", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0018", + "path": "workplans/RPF-WP-0018-policy-surface-alignment.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0018-T01", + "status": "done" + }, + { + "id": "RPF-WP-0018-T02", + "status": "done" + }, + { + "id": "RPF-WP-0018-T03", + "status": "done" + }, + { + "id": "RPF-WP-0018-T04", + "status": "done" + }, + { + "id": "RPF-WP-0018-T05", + "status": "done" + }, + { + "id": "RPF-WP-0018-T06", + "status": "done" + }, + { + "id": "RPF-WP-0018-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0019", + "path": "workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0019-T01", + "status": "done" + }, + { + "id": "RPF-WP-0019-T02", + "status": "done" + }, + { + "id": "RPF-WP-0019-T03", + "status": "done" + }, + { + "id": "RPF-WP-0019-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0020", + "path": "workplans/RPF-WP-0020-ccr-schema-drift.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0020-T01", + "status": "done" + }, + { + "id": "RPF-WP-0020-T02", + "status": "done" + }, + { + "id": "RPF-WP-0020-T03", + "status": "done" + }, + { + "id": "RPF-WP-0020-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0025", + "path": "workplans/RPF-WP-0025-openbao-operator-only-access.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0025-T01", + "status": "done" + }, + { + "id": "RPF-WP-0025-T02", + "status": "done" + }, + { + "id": "RPF-WP-0025-T03", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0026", + "path": "workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0026-T01", + "status": "done" + }, + { + "id": "RPF-WP-0026-T02", + "status": "done" + }, + { + "id": "RPF-WP-0026-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0027", + "path": "workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md", + "status": "active", + "tasks": [ + { + "id": "RPF-WP-0027-T01", + "status": "done" + }, + { + "id": "RPF-WP-0027-T02", + "status": "done" + }, + { + "id": "RPF-WP-0027-T03", + "status": "progress" + }, + { + "id": "RPF-WP-0027-T04", + "status": "wait" + }, + { + "id": "RPF-WP-0027-T05", + "status": "wait" + }, + { + "id": "RPF-WP-0027-T06", + "status": "progress" + } + ] + }, + { + "id": "RPF-WP-0028", + "path": "workplans/RPF-WP-0028-durable-live-image-inventory.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0028-T01", + "status": "done" + }, + { + "id": "RPF-WP-0028-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0029", + "path": "workplans/RPF-WP-0029-backup-credential-default-removal.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0029-T01", + "status": "done" + }, + { + "id": "RPF-WP-0029-T02", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0030", + "path": "workplans/RPF-WP-0030-core-hub-platform-onboarding.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0030-T01", + "status": "done" + }, + { + "id": "RPF-WP-0030-T02", + "status": "done" + }, + { + "id": "RPF-WP-0030-T03", + "status": "done" + }, + { + "id": "RPF-WP-0030-T04", + "status": "done" + }, + { + "id": "RPF-WP-0030-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0031", + "path": "workplans/RPF-WP-0031-workplan-identity-collision.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0031-T01", + "status": "done" + }, + { + "id": "RPF-WP-0031-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0032", + "path": "workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0032-T01", + "status": "done" + }, + { + "id": "RPF-WP-0032-T02", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0033", + "path": "workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0033-T01", + "status": "done" + }, + { + "id": "RPF-WP-0033-T02", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0034", + "path": "workplans/RPF-WP-0034-state-hub-preflight-signing-design.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0034-T01", + "status": "done" + }, + { + "id": "RPF-WP-0034-T02", + "status": "wait" + } + ] + }, + { + "id": "RAIL-PL-WP-0002", + "path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "status": "finished", + "tasks": [ + { + "id": "RAIL-PL-WP-0002-T01", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T02", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T03", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T04", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T05", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T06", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0021", + "path": "workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0021-T01", + "status": "done" + }, + { + "id": "RPF-WP-0021-T02", + "status": "done" + }, + { + "id": "RPF-WP-0021-T03", + "status": "done" + }, + { + "id": "RPF-WP-0021-T04", + "status": "done" + }, + { + "id": "RPF-WP-0021-T05", + "status": "done" + }, + { + "id": "RPF-WP-0021-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0022", + "path": "workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0022-T01", + "status": "done" + }, + { + "id": "RPF-WP-0022-T02", + "status": "done" + }, + { + "id": "RPF-WP-0022-T03", + "status": "done" + }, + { + "id": "RPF-WP-0022-T04", + "status": "done" + }, + { + "id": "RPF-WP-0022-T05", + "status": "done" + }, + { + "id": "RPF-WP-0022-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0023", + "path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0023-T01", + "status": "done" + }, + { + "id": "RPF-WP-0023-T02", + "status": "done" + }, + { + "id": "RPF-WP-0023-T03", + "status": "done" + }, + { + "id": "RPF-WP-0023-T04", + "status": "done" + }, + { + "id": "RPF-WP-0023-T05", + "status": "done" + }, + { + "id": "RPF-WP-0023-T06", + "status": "done" + }, + { + "id": "RPF-WP-0023-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0024", + "path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0024-T01", + "status": "done" + }, + { + "id": "RPF-WP-0024-T02", + "status": "done" + }, + { + "id": "RPF-WP-0024-T03", + "status": "done" + }, + { + "id": "RPF-WP-0024-T04", + "status": "done" + }, + { + "id": "RPF-WP-0024-T05", + "status": "done" + }, + { + "id": "RPF-WP-0024-T06", + "status": "done" + }, + { + "id": "RPF-WP-0024-T07", + "status": "done" + }, + { + "id": "RPF-WP-0024-T08", + "status": "done" + }, + { + "id": "RPF-WP-0024-T09", + "status": "done" + } + ] + }, + { + "id": "RAIL-PL-WP-0001", + "path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "status": "archived", + "tasks": [ + { + "id": "RAIL-PL-WP-0001-T01", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T02", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T03", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T04", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T05", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T06", + "status": "cancelled" + } + ] + } + ], + "after": [ + { + "id": "RPF-WP-0015", + "path": "workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0015-T01", + "status": "done" + }, + { + "id": "RPF-WP-0015-T02", + "status": "wait" + }, + { + "id": "RPF-WP-0015-T03", + "status": "wait" + }, + { + "id": "RPF-WP-0015-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0025", + "path": "workplans/RPF-WP-0025-openbao-operator-only-access.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0025-T01", + "status": "done" + }, + { + "id": "RPF-WP-0025-T02", + "status": "done" + }, + { + "id": "RPF-WP-0025-T03", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0027", + "path": "workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0027-T01", + "status": "done" + }, + { + "id": "RPF-WP-0027-T02", + "status": "done" + }, + { + "id": "RPF-WP-0027-T03", + "status": "wait" + }, + { + "id": "RPF-WP-0027-T04", + "status": "done" + }, + { + "id": "RPF-WP-0027-T05", + "status": "wait" + }, + { + "id": "RPF-WP-0027-T06", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0029", + "path": "workplans/RPF-WP-0029-backup-credential-default-removal.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0029-T01", + "status": "done" + }, + { + "id": "RPF-WP-0029-T02", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0035", + "path": "workplans/RPF-WP-0035-credential-lane-implementation.md", + "status": "blocked", + "tasks": [ + { + "id": "RPF-WP-0035-T01", + "status": "done" + }, + { + "id": "RPF-WP-0035-T02", + "status": "wait" + }, + { + "id": "RPF-WP-0035-T03", + "status": "wait" + }, + { + "id": "RPF-WP-0035-T04", + "status": "wait" + } + ] + }, + { + "id": "RPF-WP-0036", + "path": "workplans/RPF-WP-0036-platform-service-assurance.md", + "status": "ready", + "tasks": [ + { + "id": "RPF-WP-0036-T01", + "status": "done" + }, + { + "id": "RPF-WP-0036-T02", + "status": "todo" + }, + { + "id": "RPF-WP-0036-T03", + "status": "todo" + }, + { + "id": "RPF-WP-0036-T04", + "status": "todo" + }, + { + "id": "RPF-WP-0036-T05", + "status": "todo" + }, + { + "id": "RPF-WP-0036-T06", + "status": "todo" + }, + { + "id": "RPF-WP-0036-T07", + "status": "todo" + } + ] + }, + { + "id": "RAIL-PL-WP-0002", + "path": "workplans/archived/260702-RAIL-PL-WP-0002-openbao-platform-secrets-service.md", + "status": "finished", + "tasks": [ + { + "id": "RAIL-PL-WP-0002-T01", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T02", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T03", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T04", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T05", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T06", + "status": "done" + }, + { + "id": "RAIL-PL-WP-0002-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0021", + "path": "workplans/archived/260702-RPF-WP-0021-apps-pg-shared-cluster.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0021-T01", + "status": "done" + }, + { + "id": "RPF-WP-0021-T02", + "status": "done" + }, + { + "id": "RPF-WP-0021-T03", + "status": "done" + }, + { + "id": "RPF-WP-0021-T04", + "status": "done" + }, + { + "id": "RPF-WP-0021-T05", + "status": "done" + }, + { + "id": "RPF-WP-0021-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0022", + "path": "workplans/archived/260702-RPF-WP-0022-argocd-gitops-bootstrap.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0022-T01", + "status": "done" + }, + { + "id": "RPF-WP-0022-T02", + "status": "done" + }, + { + "id": "RPF-WP-0022-T03", + "status": "done" + }, + { + "id": "RPF-WP-0022-T04", + "status": "done" + }, + { + "id": "RPF-WP-0022-T05", + "status": "done" + }, + { + "id": "RPF-WP-0022-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0023", + "path": "workplans/archived/260702-RPF-WP-0023-workload-kv-access-lanes.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0023-T01", + "status": "done" + }, + { + "id": "RPF-WP-0023-T02", + "status": "done" + }, + { + "id": "RPF-WP-0023-T03", + "status": "done" + }, + { + "id": "RPF-WP-0023-T04", + "status": "done" + }, + { + "id": "RPF-WP-0023-T05", + "status": "done" + }, + { + "id": "RPF-WP-0023-T06", + "status": "done" + }, + { + "id": "RPF-WP-0023-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0024", + "path": "workplans/archived/260702-RPF-WP-0024-credential-change-approval-workflow.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0024-T01", + "status": "done" + }, + { + "id": "RPF-WP-0024-T02", + "status": "done" + }, + { + "id": "RPF-WP-0024-T03", + "status": "done" + }, + { + "id": "RPF-WP-0024-T04", + "status": "done" + }, + { + "id": "RPF-WP-0024-T05", + "status": "done" + }, + { + "id": "RPF-WP-0024-T06", + "status": "done" + }, + { + "id": "RPF-WP-0024-T07", + "status": "done" + }, + { + "id": "RPF-WP-0024-T08", + "status": "done" + }, + { + "id": "RPF-WP-0024-T09", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-ADHOC-2026-08-23", + "path": "workplans/archived/260905-ADHOC-2026-08-23.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-ADHOC-2026-08-23-T01", + "status": "done" + }, + { + "id": "RPF-WP-ADHOC-2026-08-23-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0001", + "path": "workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0001-T01", + "status": "done" + }, + { + "id": "RPF-WP-0001-T02", + "status": "done" + }, + { + "id": "RPF-WP-0001-T03", + "status": "done" + }, + { + "id": "RPF-WP-0001-T04", + "status": "done" + }, + { + "id": "RPF-WP-0001-T05", + "status": "done" + }, + { + "id": "RPF-WP-0001-T06", + "status": "done" + }, + { + "id": "RPF-WP-0001-T07", + "status": "done" + }, + { + "id": "RPF-WP-0001-T08", + "status": "done" + }, + { + "id": "RPF-WP-0001-T09", + "status": "done" + }, + { + "id": "RPF-WP-0001-T10", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0002", + "path": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0002-T01", + "status": "done" + }, + { + "id": "RPF-WP-0002-T02", + "status": "done" + }, + { + "id": "RPF-WP-0002-T03", + "status": "done" + }, + { + "id": "RPF-WP-0002-T04", + "status": "done" + }, + { + "id": "RPF-WP-0002-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0003", + "path": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0003-T01", + "status": "done" + }, + { + "id": "RPF-WP-0003-T02", + "status": "done" + }, + { + "id": "RPF-WP-0003-T03", + "status": "done" + }, + { + "id": "RPF-WP-0003-T04", + "status": "done" + }, + { + "id": "RPF-WP-0003-T05", + "status": "done" + }, + { + "id": "RPF-WP-0003-T06", + "status": "done" + }, + { + "id": "RPF-WP-0003-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0004", + "path": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0004-T01", + "status": "done" + }, + { + "id": "RPF-WP-0004-T02", + "status": "done" + }, + { + "id": "RPF-WP-0004-T03", + "status": "done" + }, + { + "id": "RPF-WP-0004-T04", + "status": "done" + }, + { + "id": "RPF-WP-0004-T05", + "status": "done" + }, + { + "id": "RPF-WP-0004-T06", + "status": "done" + }, + { + "id": "RPF-WP-0004-T07", + "status": "done" + }, + { + "id": "RPF-WP-0004-T08", + "status": "cancel" + } + ] + }, + { + "id": "RPF-WP-0005", + "path": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0005-T01", + "status": "done" + }, + { + "id": "RPF-WP-0005-T02", + "status": "done" + }, + { + "id": "RPF-WP-0005-T03", + "status": "done" + }, + { + "id": "RPF-WP-0005-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0006", + "path": "workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0006-T01", + "status": "done" + }, + { + "id": "RPF-WP-0006-T02", + "status": "done" + }, + { + "id": "RPF-WP-0006-T03", + "status": "done" + }, + { + "id": "RPF-WP-0006-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0007", + "path": "workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0007-T01", + "status": "done" + }, + { + "id": "RPF-WP-0007-T02", + "status": "done" + }, + { + "id": "RPF-WP-0007-T03", + "status": "done" + }, + { + "id": "RPF-WP-0007-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0008", + "path": "workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0008-T01", + "status": "done" + }, + { + "id": "RPF-WP-0008-T02", + "status": "done" + }, + { + "id": "RPF-WP-0008-T03", + "status": "done" + }, + { + "id": "RPF-WP-0008-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0009", + "path": "workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0009-T01", + "status": "done" + }, + { + "id": "RPF-WP-0009-T02", + "status": "done" + }, + { + "id": "RPF-WP-0009-T03", + "status": "done" + }, + { + "id": "RPF-WP-0009-T04", + "status": "done" + }, + { + "id": "RPF-WP-0009-T05", + "status": "done" + }, + { + "id": "RPF-WP-0009-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0010", + "path": "workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0010-T01", + "status": "done" + }, + { + "id": "RPF-WP-0010-T02", + "status": "done" + }, + { + "id": "RPF-WP-0010-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0011", + "path": "workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0011-T01", + "status": "done" + }, + { + "id": "RPF-WP-0011-T02", + "status": "done" + }, + { + "id": "RPF-WP-0011-T03", + "status": "done" + }, + { + "id": "RPF-WP-0011-T04", + "status": "done" + }, + { + "id": "RPF-WP-0011-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0012", + "path": "workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0012-T01", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0013", + "path": "workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0013-T01", + "status": "done" + }, + { + "id": "RPF-WP-0013-T02", + "status": "done" + }, + { + "id": "RPF-WP-0013-T03", + "status": "done" + }, + { + "id": "RPF-WP-0013-T04", + "status": "done" + }, + { + "id": "RPF-WP-0013-T05", + "status": "done" + }, + { + "id": "RPF-WP-0013-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0014", + "path": "workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0014-T01", + "status": "done" + }, + { + "id": "RPF-WP-0014-T02", + "status": "done" + }, + { + "id": "RPF-WP-0014-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0016", + "path": "workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0016-T01", + "status": "done" + }, + { + "id": "RPF-WP-0016-T02", + "status": "done" + }, + { + "id": "RPF-WP-0016-T03", + "status": "done" + }, + { + "id": "RPF-WP-0016-T04", + "status": "done" + }, + { + "id": "RPF-WP-0016-T05", + "status": "done" + }, + { + "id": "RPF-WP-0016-T06", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0017", + "path": "workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0017-T01", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0018", + "path": "workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0018-T01", + "status": "done" + }, + { + "id": "RPF-WP-0018-T02", + "status": "done" + }, + { + "id": "RPF-WP-0018-T03", + "status": "done" + }, + { + "id": "RPF-WP-0018-T04", + "status": "done" + }, + { + "id": "RPF-WP-0018-T05", + "status": "done" + }, + { + "id": "RPF-WP-0018-T06", + "status": "done" + }, + { + "id": "RPF-WP-0018-T07", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0019", + "path": "workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0019-T01", + "status": "done" + }, + { + "id": "RPF-WP-0019-T02", + "status": "done" + }, + { + "id": "RPF-WP-0019-T03", + "status": "done" + }, + { + "id": "RPF-WP-0019-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0020", + "path": "workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0020-T01", + "status": "done" + }, + { + "id": "RPF-WP-0020-T02", + "status": "done" + }, + { + "id": "RPF-WP-0020-T03", + "status": "done" + }, + { + "id": "RPF-WP-0020-T04", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0026", + "path": "workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0026-T01", + "status": "done" + }, + { + "id": "RPF-WP-0026-T02", + "status": "done" + }, + { + "id": "RPF-WP-0026-T03", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0028", + "path": "workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0028-T01", + "status": "done" + }, + { + "id": "RPF-WP-0028-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0030", + "path": "workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0030-T01", + "status": "done" + }, + { + "id": "RPF-WP-0030-T02", + "status": "done" + }, + { + "id": "RPF-WP-0030-T03", + "status": "done" + }, + { + "id": "RPF-WP-0030-T04", + "status": "done" + }, + { + "id": "RPF-WP-0030-T05", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0031", + "path": "workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0031-T01", + "status": "done" + }, + { + "id": "RPF-WP-0031-T02", + "status": "done" + } + ] + }, + { + "id": "RPF-WP-0032", + "path": "workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0032-T01", + "status": "done" + }, + { + "id": "RPF-WP-0032-T02", + "status": "cancel" + } + ] + }, + { + "id": "RPF-WP-0033", + "path": "workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0033-T01", + "status": "done" + }, + { + "id": "RPF-WP-0033-T02", + "status": "cancel" + } + ] + }, + { + "id": "RPF-WP-0034", + "path": "workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md", + "status": "finished", + "tasks": [ + { + "id": "RPF-WP-0034-T01", + "status": "done" + }, + { + "id": "RPF-WP-0034-T02", + "status": "cancel" + } + ] + }, + { + "id": "RAIL-PL-WP-0001", + "path": "workplans/archived/RAIL-PL-WP-0001-platform-baseline.md", + "status": "archived", + "tasks": [ + { + "id": "RAIL-PL-WP-0001-T01", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T02", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T03", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T04", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T05", + "status": "cancelled" + }, + { + "id": "RAIL-PL-WP-0001-T06", + "status": "cancelled" + } + ] + } + ], + "dispositions": { + "RPF-WP-0001": "Delivered custody/grant broker; retain S3 policy, route future engine lifecycle to secrets-engine.", + "RPF-WP-0002": "Delivered bounded delegated apply; S3 enforcement and approval boundary fit intent.", + "RPF-WP-0003": "Delivered Issue Core runtime custody; app ingestion remains consumer-owned.", + "RPF-WP-0004": "Delivered provider-key custody; provider/application lifecycle stays with its owner.", + "RPF-WP-0005": "Delivered reuse-surface runtime custody; webhook application logic is consumer-owned.", + "RPF-WP-0006": "Delivered OpenBao package boundary; compatibility handoff reviewed under 0036-T06.", + "RPF-WP-0007": "Delivered PAT custody cutover; future pruning ownership belongs to railiance-forge.", + "RPF-WP-0008": "Delivered CCR validation/test repair; keeps platform policy fail-closed.", + "RPF-WP-0009": "Delivered S3 rapp/interface conventions; fleet family taxonomy stays with master.", + "RPF-WP-0010": "Delivered apps-pg resource evidence; recurring freshness is 0036-T03/T04.", + "RPF-WP-0011": "Delivered S3 architecture cleanup; unrelated fleet rows remain outside S3.", + "RPF-WP-0012": "Delivered consumption-mode enforcement; consume policy, do not own commercial decisions.", + "RPF-WP-0013": "Delivered agent high-risk deny coverage; retained S3 custody boundary.", + "RPF-WP-0014": "Delivered hub-core candidate lanes; application migration stays with consumer/package.", + "RPF-WP-0015": "Keep scoped recovery contribution; prepared procedures wait on fresh live gates.", + "RPF-WP-0016": "Delivered ephemeral custody lifecycle; no unattended reaper authority implied.", + "RPF-WP-0017": "Delivered output-containment repair; future drill still needs fresh acceptance.", + "RPF-WP-0018": "Delivered tenancy/placement policy and ADR surface; ongoing drift is 0036-T05.", + "RPF-WP-0019": "Delivered backup/controls/ceiling/isolation; correct stale SCOPE, do not reopen.", + "RPF-WP-0020": "Delivered CCR migration/draft model; schema extension for new write lane is 0035-T03.", + "RPF-WP-0021": "Historical apps-pg bootstrap; stable identity preserved after previous collision repair.", + "RPF-WP-0022": "Historical GitOps bootstrap; retained mixed ownership inventory goes to 0036-T06.", + "RPF-WP-0023": "Delivered workload KV lane foundation; new demands use consolidated 0035.", + "RPF-WP-0024": "Delivered CCR approval workflow; retain S3 policy and consume approval authority.", + "RPF-WP-0025": "Keep private access cutover; exact attended login, package and network gates.", + "RPF-WP-0026": "Delivered canonical authorization consumption; PDP remains outside S3.", + "RPF-WP-0027": "Narrow to custody/residual evidence; owner rotation already delivered; no repeat rotation.", + "RPF-WP-0028": "Delivered durable inventory; future forge/automation handoff is 0036-T06.", + "RPF-WP-0029": "Keep provider invalidation/recovery evidence; source fallback removal alone is insufficient.", + "RPF-WP-0030": "Delivered Core Hub onboarding; preserve distinct identity, reconcile disclosures in 0036-T05.", + "RPF-WP-0031": "Delivered scoped identity repair; do not repeat or broaden UUID edits.", + "RPF-WP-0032": "Design delivered; implementation T02 superseded by 0035-T02.", + "RPF-WP-0033": "Design delivered; implementation T02 superseded by 0035-T03.", + "RPF-WP-0034": "Design delivered; implementation T02 superseded by 0035-T04; reconfirm transitional demand.", + "RPF-WP-ADHOC-2026-08-23": "Delivered tenancy evidence and broker test fixes; no residual project.", + "RAIL-PL-WP-0002": "Historical secrets-service bootstrap; continuing assurance belongs to 0036, not reopened bootstrap.", + "RAIL-PL-WP-0001": "Retired baseline; six legacy cancelled tasks remain historical, not six open gaps." + }, + "archive_moves": [ + { + "id": "RPF-WP-ADHOC-2026-08-23", + "from": "workplans/ADHOC-2026-08-23.md", + "to": "workplans/archived/260905-ADHOC-2026-08-23.md" + }, + { + "id": "RPF-WP-0001", + "from": "workplans/RPF-WP-0001-credential-request-and-lease-broker.md", + "to": "workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md" + }, + { + "id": "RPF-WP-0002", + "from": "workplans/RPF-WP-0002-openbao-approved-automation-delegation.md", + "to": "workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md" + }, + { + "id": "RPF-WP-0003", + "from": "workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md", + "to": "workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md" + }, + { + "id": "RPF-WP-0004", + "from": "workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md", + "to": "workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md" + }, + { + "id": "RPF-WP-0005", + "from": "workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md", + "to": "workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md" + }, + { + "id": "RPF-WP-0006", + "from": "workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md", + "to": "workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md" + }, + { + "id": "RPF-WP-0007", + "from": "workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md", + "to": "workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md" + }, + { + "id": "RPF-WP-0008", + "from": "workplans/RPF-WP-0008-credential-change-suite-stabilization.md", + "to": "workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md" + }, + { + "id": "RPF-WP-0009", + "from": "workplans/RPF-WP-0009-platform-rapp-consistency.md", + "to": "workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md" + }, + { + "id": "RPF-WP-0010", + "from": "workplans/RPF-WP-0010-apps-pg-resource-evidence.md", + "to": "workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md" + }, + { + "id": "RPF-WP-0011", + "from": "workplans/RPF-WP-0011-architecture-cleanup-backlog.md", + "to": "workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md" + }, + { + "id": "RPF-WP-0012", + "from": "workplans/RPF-WP-0012-consumption-mode-enforcement.md", + "to": "workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md" + }, + { + "id": "RPF-WP-0013", + "from": "workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md", + "to": "workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md" + }, + { + "id": "RPF-WP-0014", + "from": "workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md", + "to": "workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md" + }, + { + "id": "RPF-WP-0016", + "from": "workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md", + "to": "workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md" + }, + { + "id": "RPF-WP-0017", + "from": "workplans/RPF-WP-0017-attended-login-output-containment.md", + "to": "workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md" + }, + { + "id": "RPF-WP-0018", + "from": "workplans/RPF-WP-0018-policy-surface-alignment.md", + "to": "workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md" + }, + { + "id": "RPF-WP-0019", + "from": "workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md", + "to": "workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md" + }, + { + "id": "RPF-WP-0020", + "from": "workplans/RPF-WP-0020-ccr-schema-drift.md", + "to": "workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md" + }, + { + "id": "RPF-WP-0026", + "from": "workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md", + "to": "workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md" + }, + { + "id": "RPF-WP-0028", + "from": "workplans/RPF-WP-0028-durable-live-image-inventory.md", + "to": "workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md" + }, + { + "id": "RPF-WP-0030", + "from": "workplans/RPF-WP-0030-core-hub-platform-onboarding.md", + "to": "workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md" + }, + { + "id": "RPF-WP-0031", + "from": "workplans/RPF-WP-0031-workplan-identity-collision.md", + "to": "workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md" + }, + { + "id": "RPF-WP-0032", + "from": "workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md", + "to": "workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md" + }, + { + "id": "RPF-WP-0033", + "from": "workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md", + "to": "workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md" + }, + { + "id": "RPF-WP-0034", + "from": "workplans/RPF-WP-0034-state-hub-preflight-signing-design.md", + "to": "workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md" + } + ], + "superseded_tasks": { + "RPF-WP-0032-T02": "RPF-WP-0035-T02", + "RPF-WP-0033-T02": "RPF-WP-0035-T03", + "RPF-WP-0034-T02": "RPF-WP-0035-T04" + } +} diff --git a/workplans/README.md b/workplans/README.md new file mode 100644 index 0000000..ddf39f9 --- /dev/null +++ b/workplans/README.md @@ -0,0 +1,25 @@ +# Current platform work + +Reviewed 2026-09-05. Six open workplans: five blocked on explicit owner/live +gates and one ready for local work. Completed designs and implementations are +under `archived/`; their IDs and UUIDs are preserved. The number of blocked +plans is not a count of missing implementations or independent incidents. + +| Workplan | Purpose and next gate | S3 boundary | +| --- | --- | --- | +| [RPF-WP-0027](RPF-WP-0027-keycape-live-secret-exposure-recovery.md) | Incident custody and final evidence; accept NetKingdom's residual disposition and publish exact custody handoff | The bundle was already rotated. Provider/MFA reconciliation belongs to NetKingdom. | +| [RPF-WP-0029](RPF-WP-0029-backup-credential-default-removal.md) | Backup credential exposure; attended provider invalidation and replacement recovery receipts | S3 retains custody acceptance; S1 and forge own their backup execution. | +| [RPF-WP-0025](RPF-WP-0025-openbao-operator-only-access.md) | Private OpenBao access; fresh attended callback/login then guarded retraction | Coordinate package, issuer, tunnel and DNS owners; keep the window separate. | +| [RPF-WP-0015](RPF-WP-0015-audit-core-custody-and-recovery-coordination.md) | Two prepared recovery exercises; fresh synthetic-load/outage approvals and custody readiness | S3 contributes lease/ESO and snapshot/unseal proof; S1/S2 and audit-core execute their parts. | +| [RPF-WP-0035](RPF-WP-0035-credential-lane-implementation.md) | One implementation queue for secrets-engine JWT, Fluid operator KV and preflight signing | Three independent task gates; no new approval inherited from the completed designs. | +| [RPF-WP-0036](RPF-WP-0036-platform-service-assurance.md) | **Ready:** service guarantees, recurring evidence, S3 emission, admission consistency, ownership handoff and demand review | Local design/checking can progress while live work waits. | + +Start with RPF-WP-0036-T02/T05 for work that does not require a live credential +or outage. Treat credential exposure closure as the highest-priority attended +work; task order does not combine or waive approvals. + +[Assessment and disposition of every plan](../history/2026-09-05-platform-intent-workplan-assessment.md) +and [generated current record index](../WORK-RECORDS.md). + +Do not recreate completed workplans because an old Hub alias or generated brief +still shows them active. Use source IDs, and follow AGENTS.md for verified sync. diff --git a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md index da961bb..94476cf 100644 --- a/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md +++ b/workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md @@ -4,11 +4,11 @@ type: workplan title: "Coordinate audit-core temporary custody and recovery exercises" domain: financials repo: railiance-platform -status: active +status: blocked owner: codex topic_slug: railiance created: "2026-08-22" -updated: "2026-08-22" +updated: "2026-09-05" related: - AUDIT-WP-0008 - WH-ENG-20260822-AUDIT-E2-01 @@ -119,7 +119,7 @@ copied for another engagement. ```task id: RPF-WP-0015-T02 -status: progress +status: wait priority: high state_hub_task_id: "fda4262a-56f6-5f06-a070-8fe7e1297209" ``` @@ -175,7 +175,7 @@ live window after the Whitehat engagement cleanup. ```task id: RPF-WP-0015-T03 -status: progress +status: wait priority: high state_hub_task_id: "ba729d18-f053-539f-86ef-5cb8ad4cce45" ``` @@ -313,3 +313,26 @@ each task. - [ ] Database recovery is restart-free and evidenced without credential values. - [ ] Reboot recovery has an ordered, owner-signed checklist and abort path. - [x] No live action is implied by completing this design workplan. + +## Portfolio review — 2026-09-05 + +INTENT binding: tested recovery and dependable custody. Procedure construction +is complete; the two tasks were incorrectly left `progress` while their live +windows remained unavailable. They now explicitly wait. This does not claim +that the experiments passed or that prior expired approvals can be reused. + +T02 retains the S3 lease/ESO acceptance contribution. `audit-core` owns the +synthetic-load driver and application retry/readiness proof (AUDIT-WP-0008); +`rapp-postgres` owns database acceptance. Unblock with a revision-pinned load +receipt, named abort operator and fresh bounded window. + +T03 retains only S3 snapshot, quorum/unseal, ESO and database-readiness gates. +Host reboot execution belongs to `railiance-infra`, cluster recovery to +`railiance-cluster`, application acceptance to audit-core. Existing owner +procedure receipts remain evidence of review, not fresh live GO. Unblock with +fresh snapshot/quorum/access evidence, owner confirmations and an outage window. +The terminal NO-GO is not rerunnable. RPF-WP-0017 closed the local output +containment defect; the next attempt still needs current acceptance evidence. + +Do not create another platform-owned whole-host drill or duplicate these live +tasks in RPF-WP-0036; that plan owns recurring service assurance. diff --git a/workplans/RPF-WP-0025-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md index 67cbe2d..c67f5ed 100644 --- a/workplans/RPF-WP-0025-openbao-operator-only-access.md +++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md @@ -8,7 +8,7 @@ status: blocked owner: codex topic_slug: railiance created: "2026-08-23" -updated: "2026-08-23" +updated: "2026-09-05" related: - RMASTER-WP-0020-T09 - RAPP-OPENBAO-WP-0002 @@ -85,3 +85,14 @@ is ready to complete the browser/MFA act. This workplan authorizes no OpenBao seal/unseal, policy broadening, PVC or Secret mutation, reboot, restore, or RMASTER-WP-0020-T08 cleanup. + +## Portfolio review — 2026-09-05 + +INTENT binding: secure custody and an operable operator access path. Retain +T03 as the one attended cutover task; do not merge its approval/window with +incident rotation or reboot. Platform owns the exact OpenBao callback and +custody acceptance; rapp-openbao owns package exposure, KeyCape/NetKingdom the +issuer callback, ops-bridge the tunnel, and S1/S2 DNS/network primitives. +Unblock with a fresh attended OIDC/MFA callback update and loopback login, +then the guarded retraction and owner-specific DNS handoff. Existing source +readiness is not evidence of a completed live cutover. diff --git a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md index 4303b3f..c6efab8 100644 --- a/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md +++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md @@ -4,11 +4,11 @@ type: workplan title: "Coordinate KeyCape live Secret exposure recovery" domain: financials repo: railiance-platform -status: active +status: blocked owner: codex topic_slug: railiance created: "2026-08-23" -updated: "2026-08-23" +updated: "2026-09-05" related: - KEY-WP-0011 origin: routed @@ -56,7 +56,7 @@ predecessor revocation, and sanitized evidence. ```task id: RPF-WP-0027-T03 -status: progress +status: wait priority: high state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1" ``` @@ -96,7 +96,7 @@ lane remains unresolved and no credential fetch or retry is authorized. ```task id: RPF-WP-0027-T04 -status: wait +status: done priority: high state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7" ``` @@ -123,7 +123,7 @@ status, timestamps, and cleanup receipts. ```task id: RPF-WP-0027-T06 -status: progress +status: wait priority: high state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283" ``` @@ -135,3 +135,34 @@ attended handoff identifier. Do not infer or invent any of these values. After publication, update `docs/net-kingdom-credential-custody-contract.md`, ask ops-warden to refresh lane resolvability, and pass only protected inputs to NetKingdom's minimal resolver reconciliation flow. + +## Portfolio review — 2026-09-05 + +INTENT binding: secure custody and incident closure. The goal above is historical; +the remaining platform scope is custody and acceptance of owner evidence. + +**T04 is complete by existing owner evidence, not by a new action here.** +`key-cape/workplans/KEY-WP-0011-live-secret-exposure-recovery.md` T02/T03 and +`net-kingdom/workplans/NK-WP-0033-keycape-secret-exposure-rotation.md` T04 +record the approved 2026-08-23 bundle replacement. Do not repeat that rotation +merely because this platform task previously remained `wait`. + +The 2026-08-27 NK-WP-0033-T05 update is newer than the earlier notes above: +the resolver binding was reconciled, but there is no complete green receipt. +The predecessor value is unavailable; manual observations are not a recorded +negative proof. No one should recover or fabricate a predecessor just to make +a test pass. The incident owner must rule explicitly on the residual evidence +and acceptable disposition. Overall incident closure remains open. + +- T03 waits for current NetKingdom/provider evidence disposition and the exact + platform custody acknowledgements; old procedure acknowledgements exist. +- T05 waits for the repaired owner command's sanitized receipt and the + incident owner's explicit disposition of the unavailable predecessor. + NetKingdom owns resolver/MFA execution (NK-WP-0033-T03/T05); this repo accepts + custody-related results without taking over the identity provider. +- T06 waits for confirmed mount/path/fields, writer/reader authority and the + operator handoff. The existing draft leaves those facts intentionally blank. + +No new owner acceptance or coordination message is asserted by this review. +Keep this incident separate from the new-lane queue; broad lane approval cannot +close an exposure. diff --git a/workplans/RPF-WP-0029-backup-credential-default-removal.md b/workplans/RPF-WP-0029-backup-credential-default-removal.md index 97beaa5..e977055 100644 --- a/workplans/RPF-WP-0029-backup-credential-default-removal.md +++ b/workplans/RPF-WP-0029-backup-credential-default-removal.md @@ -37,3 +37,13 @@ state_hub_task_id: "b3f3402f-890b-5781-9b3e-1c9c0d28cea8" ``` Provider-side invalidation and replacement custody need the attended provider owner and CCR-2026-0004 lifecycle procedure. Record only non-secret invalidation, encrypted upload and restore receipts. No provider authority or replacement receipt was available; source removal alone does not close the reported exposure. Never record the predecessor value, fingerprint, length, or shape. + +## Portfolio review — 2026-09-05 + +INTENT binding: dependable backup custody and recovery. Retain T02 until the +provider owner invalidates the predecessor and supplies replacement upload and +restore receipts through CCR-2026-0004. Source removal is already complete. +S1 backup scheduling belongs to RAIL-HO-WP-0012; forge backup orchestration and +artifact retention belong to railiance-forge. RPF-WP-0036-T06 will obtain an +accepted compatibility handoff, but this exposure obligation stays visible +here until its evidence is accepted. No rotation was executed in this review. diff --git a/workplans/RPF-WP-0035-credential-lane-implementation.md b/workplans/RPF-WP-0035-credential-lane-implementation.md new file mode 100644 index 0000000..30420e0 --- /dev/null +++ b/workplans/RPF-WP-0035-credential-lane-implementation.md @@ -0,0 +1,119 @@ +--- +id: RPF-WP-0035 +type: workplan +title: "Implement reviewed credential lanes with separate owner gates" +domain: financials +repo: railiance-platform +status: blocked +owner: codex +created: "2026-09-05" +updated: "2026-09-05" +related: + - RPF-WP-0032 + - RPF-WP-0033 + - RPF-WP-0034 +--- + +# Credential lane implementation + +One S3 queue for three designed lanes; each task keeps its own approval, +execution and closure boundary. This replaces the implementation tasks in the +three completed design workplans, not the designs themselves. No approval is +inherited by consolidation. INTENT binding: secure custody, dependable delivery, +stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029. + +## Consolidate completed designs and owner dependencies + +```task +id: RPF-WP-0035-T01 +status: done +priority: medium +``` + +Completed 2026-09-05. Preserved the three designs under +`docs/credential-lane-designs/`, identified native owner responsibilities and +linked each superseded task below. Owners have not been sent new requests and +no new external acceptance is claimed. STATE-WP-0085-T09 is already done; +the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover. + +## Accept and provision secrets-engine service JWT login + +```task +id: RPF-WP-0035-T02 +status: wait +priority: high +``` + +Supersedes RPF-WP-0032-T02. Design: +`docs/credential-lane-designs/secrets-engine-service-jwt.md`. + +Platform owns the exact JWT mount/role/policy, effective-policy negative tests +and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service +registration (KEY-WP-0009); secrets-engine owns service authentication and +authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04). + +**Unblock:** confirmed HTTPS issuer/JWKS, exact claims and audience, consumer +readiness, approved source and attended apply authority. A service login does +not grant lane mutation authority. Do not build another identity provider or +lifecycle engine here. + +**Done when:** approved exact role succeeds for the intended service, wrong +issuer/audience/subject/claims and unrelated secret access fail, bounded TTL +and revocation are proven, the consumer explicitly opts into the verified +contract, and rollback/cleanup receipts contain no secret material. + +## Implement the platform operator-write CCR contract and Fluid lane + +```task +id: RPF-WP-0035-T03 +status: wait +priority: high +``` + +Supersedes RPF-WP-0033-T02. Design: +`docs/credential-lane-designs/fluid-telegram-operator-kv.md`. + +Platform owns the per-path capability schema/validator, exact OpenBao policy +and accepted custody coordinates. MASON-WP-0005 owns construction coordination +and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership; +FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram +application acceptance. Retain the existing read-only CCR semantics. + +**Unblock:** accept tenant/path and per-entry field/capability matrix; confirm +actual group/assurance and callbacks, reviewed construction contract and writer +authority. Contract review can proceed without a live credential; the final +schema cannot be treated as accepted solely because a draft exists. + +**Done when:** validation rejects broad/unsupported grants, the consumer proves +CAS=0 first-write behavior and no value output, approved identities can perform +only the exact matrix, negative/expiry/revocation checks pass, custody is seeded +through the separate writer, and the verified route has a safe handoff receipt. +The unattended adapter remains a separate demand and gets no operator session. + +## Accept the needed signing lane and deliver it to the owning runtime + +```task +id: RPF-WP-0035-T04 +status: wait +priority: medium +``` + +Supersedes RPF-WP-0034-T02. Design: +`docs/credential-lane-designs/state-hub-preflight-signing.md`. + +Platform owns signing-key custody, exact read policy/role and scoped delivery +acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing +and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency; +STATE-WP-0085-T09's adoption-plan delivery is already complete. + +**Unblock:** State Hub/repo-manager and the consuming migration owner confirm +that this transitional State Hub lane is still needed during retirement; +record the target runtime, namespace/SA/auth audience and an executable +rotation fence, plus approved writer and deployment window. Do not broaden the +lane into a general repository-rename authority or provision for a stale demand. + +**Done when:** protected one-time generation, API-only ESO delivery, negative +access checks and a non-mutating signed preflight pass; every API replica uses +the accepted version; rotation/invalidation and recovery are evidenced. No +repository rename is part of S3 lane acceptance. If demand is withdrawn, record +the owning decision and cancel this task explicitly rather than provision it. diff --git a/workplans/RPF-WP-0036-platform-service-assurance.md b/workplans/RPF-WP-0036-platform-service-assurance.md new file mode 100644 index 0000000..9fcff61 --- /dev/null +++ b/workplans/RPF-WP-0036-platform-service-assurance.md @@ -0,0 +1,165 @@ +--- +id: RPF-WP-0036 +type: workplan +title: "Close S3 service assurance and ownership gaps" +domain: financials +repo: railiance-platform +status: ready +owner: codex +created: "2026-09-05" +updated: "2026-09-05" +--- + +# S3 service assurance and ownership gaps + +Source: `history/2026-09-05-platform-intent-workplan-assessment.md`. +Reviewed against current repository evidence. This plan supplies the missing +continuing obligations; it does not reopen completed bootstrap projects or +duplicate incident/lane work. Repository design and read-only implementation +can progress now. Every live drill, scheduler, credential operation or migration +retains its own owner and execution gate. + +## Record the portfolio assessment and consolidate source work + +```task +id: RPF-WP-0036-T01 +status: done +priority: high +``` + +Completed 2026-09-05. Assessed all 37 existing plans and their 168 task records, +corrected SCOPE, grouped the remaining obligations, consolidated the three +design follow-ups under RPF-WP-0035, archived completed plans with identities +preserved, and recorded owner handoffs and before/after inventory in history. +This certifies the source review, not live service health or external acceptance. + +## Publish achievable service guarantees and recovery ownership + +```task +id: RPF-WP-0036-T02 +status: todo +priority: high +``` + +For apps-pg, platform-pg, OpenBao and each supported backup delivery lane, +publish a versioned service record: accountable S3/package/operator owners, +consumers, failure domain, availability objective, RPO/RTO, retention, recovery +key/quorum availability, maintenance/abort path and evidence freshness budget. +Separate measured results from accepted targets and unknowns. A 56-second +scratch restore is not an RTO commitment; one replica on one host is not HA. +Reuse `docs/s3-consumer-interfaces.md` and existing package declarations. + +**Done when:** every supported service has owner-reviewed numeric targets or +an explicit unsupported guarantee and decision owner; consumer requirements +are compared to the current substrate; any HA/node-loss gap has an exact S1/S2 +and package dependency rather than a blanket new-cluster project here. + +## Make backup freshness and recurring recovery evidence checkable + +```task +id: RPF-WP-0036-T03 +status: todo +priority: high +``` + +Inventory authoritative CNPG backup/PITR, OpenBao snapshot/isolated restore, +encrypted off-host copy and custody-recovery receipts. Reuse existing validators +and package status commands. Define cadence/expiry from T02; return distinct +healthy, stale, missing and unavailable states using metadata only. Schedule +execution only through the accepted execution owner and separately approved +authority. Keep RPF-WP-0015's pending database/reboot experiments as the sole +live tasks for those experiments; RPF-WP-0029 retains provider-key recovery. + +**Done when:** a current off-host backup and a current isolated restore receipt +exist for each supported data service, the approved cadence is installed and +its execution is evidenced, and missing/stale/failed evidence reaches a named +operator. A template, dated successful snapshot, or same-PVC reboot does not +pass as restore proof. Record independent recovery-key access without values. + +## Produce S3 signals and prove their delivery to the evidence owner + +```task +id: RPF-WP-0036-T04 +status: todo +priority: high +``` + +Define service-owned health semantics for backup/WAL age, restore age, seal +state, ESO freshness, connection/memory headroom and consumer ceiling. Reuse +package emitters and the Q2 owner's standard contract; retain an explicit +unmonitored state and named manual checker until transport is accepted. +Request a concrete receiving contract from railiance-telemetry when routing is +authorized; do not implement a competing monitoring plane in S3. + +**Done when:** bounded metadata-only samples pass contract validation, a +controlled stale/failure sample reaches a named recipient through the accepted +Q2 route, and missing emission itself is detectable. Local fixture tests may +finish before the receiver, but end-to-end acceptance cannot. + +## Reconcile admission, placement and consumer interface drift + +```task +id: RPF-WP-0036-T05 +status: todo +priority: high +``` + +Join actual package declarations and authorized metadata to the S3 interface, +tenancy and placement records. Correct stale platform-pg occupancy/co-residency +(Core Hub admission versus older tenant-engine descriptions), distinguish +desired placement from observed placement, and verify the named overflow +targets remain provisionable. Add a bounded check for missing owners, +unsupported retention requests, quota/ceiling drift and stale evidence; consume +package admission checks instead of reimplementing them. + +**Done when:** every admitted consumer has one authoritative placement/contract, +capacity and retention disclosures match package source and dated live proof, +and synthetic invalid admissions fail before provisioning. No workload moves +under this task without its own owner-reviewed migration. + +## Obtain acceptance for compatibility assets and derived-record cleanup + +```task +id: RPF-WP-0036-T06 +status: todo +priority: medium +``` + +Prepare exact source/entry-point inventories and owner-ready handoffs for +Forgejo backup/pruning/image inventory (`railiance-forge`, activity-core +execution), retained OpenBao package wrappers (`rapp-openbao`), and ArgoCD +bootstrap/application manifests (S2/S4/S5 according to artifact). Keep S3 +custody contracts and the RPF-WP-0029 exposure obligation here until accepted +closure. No new framework or app-specific helper belongs here by default. + +Supply repo-manager/State Hub with the exact legacy alias/source identity map +from the assessment. Their apparent duplicate active records and stale brief +are derived-state defects, not additional workplans. Use scoped reconciliation; +never change managed UUIDs or blanket-acknowledge retirements to clean a view. + +**Done when:** each retained compatibility surface has an accepting owner, +canonical replacement and tested callers or a dated retention decision; the +repo-filtered projection and generated brief agree with source identities. +Unaccepted transfer remains explicitly pending. No requests were sent during +the assessment and this task does not assert acceptance for another repo. + +## Decide demand and reuse for undeployed stateful capabilities + +```task +id: RPF-WP-0036-T07 +status: todo +priority: medium +``` + +Review cache, general object storage and messaging separately with potential +consumers. Inventory existing providers/contracts (including artifact-store +and the external backup bucket) before selecting an engine. Record workload, +durability/latency/retention needs, capacity, tenancy, custody, package owner, +recovery cost and operating owner for any accepted demand. Ask railiance-master +to resolve fleet Q3 ownership through its architecture process; do not assign +it to S3 by implication. + +**Done when:** each capability has a dated decision to reuse, defer with a +review trigger, or start a bounded consumer-backed delivery plan with explicit +acceptance criteria. “No accepted demand; keep deploy gated” is a valid result. +No Valkey, MinIO, RabbitMQ or new provider purchase is authorized by this plan. diff --git a/workplans/ADHOC-2026-08-23.md b/workplans/archived/260905-ADHOC-2026-08-23.md similarity index 100% rename from workplans/ADHOC-2026-08-23.md rename to workplans/archived/260905-ADHOC-2026-08-23.md diff --git a/workplans/RPF-WP-0001-credential-request-and-lease-broker.md b/workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md similarity index 100% rename from workplans/RPF-WP-0001-credential-request-and-lease-broker.md rename to workplans/archived/260905-RPF-WP-0001-credential-request-and-lease-broker.md diff --git a/workplans/RPF-WP-0002-openbao-approved-automation-delegation.md b/workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md similarity index 100% rename from workplans/RPF-WP-0002-openbao-approved-automation-delegation.md rename to workplans/archived/260905-RPF-WP-0002-openbao-approved-automation-delegation.md diff --git a/workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md b/workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md similarity index 100% rename from workplans/RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md rename to workplans/archived/260905-RPF-WP-0003-issue-core-runtime-ingestion-key-lane.md diff --git a/workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md b/workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md similarity index 100% rename from workplans/RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md rename to workplans/archived/260905-RPF-WP-0004-llm-connect-openrouter-provider-key-lane.md diff --git a/workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md b/workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md similarity index 100% rename from workplans/RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md rename to workplans/archived/260905-RPF-WP-0005-reuse-surface-runtime-secrets-openbao-lane.md diff --git a/workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md b/workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md similarity index 100% rename from workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md rename to workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md diff --git a/workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md b/workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md similarity index 100% rename from workplans/RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md rename to workplans/archived/260905-RPF-WP-0007-forgejo-admin-pat-openbao-cutover.md diff --git a/workplans/RPF-WP-0008-credential-change-suite-stabilization.md b/workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md similarity index 100% rename from workplans/RPF-WP-0008-credential-change-suite-stabilization.md rename to workplans/archived/260905-RPF-WP-0008-credential-change-suite-stabilization.md diff --git a/workplans/RPF-WP-0009-platform-rapp-consistency.md b/workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md similarity index 100% rename from workplans/RPF-WP-0009-platform-rapp-consistency.md rename to workplans/archived/260905-RPF-WP-0009-platform-rapp-consistency.md diff --git a/workplans/RPF-WP-0010-apps-pg-resource-evidence.md b/workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md similarity index 100% rename from workplans/RPF-WP-0010-apps-pg-resource-evidence.md rename to workplans/archived/260905-RPF-WP-0010-apps-pg-resource-evidence.md diff --git a/workplans/RPF-WP-0011-architecture-cleanup-backlog.md b/workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md similarity index 100% rename from workplans/RPF-WP-0011-architecture-cleanup-backlog.md rename to workplans/archived/260905-RPF-WP-0011-architecture-cleanup-backlog.md diff --git a/workplans/RPF-WP-0012-consumption-mode-enforcement.md b/workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md similarity index 100% rename from workplans/RPF-WP-0012-consumption-mode-enforcement.md rename to workplans/archived/260905-RPF-WP-0012-consumption-mode-enforcement.md diff --git a/workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md b/workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md similarity index 100% rename from workplans/RPF-WP-0013-agent-high-risk-boundary-coverage.md rename to workplans/archived/260905-RPF-WP-0013-agent-high-risk-boundary-coverage.md diff --git a/workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md b/workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md similarity index 100% rename from workplans/RPF-WP-0014-hub-core-candidate-credential-lanes.md rename to workplans/archived/260905-RPF-WP-0014-hub-core-candidate-credential-lanes.md diff --git a/workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md b/workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md similarity index 100% rename from workplans/RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md rename to workplans/archived/260905-RPF-WP-0016-versioned-ephemeral-custody-lifecycle.md diff --git a/workplans/RPF-WP-0017-attended-login-output-containment.md b/workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md similarity index 100% rename from workplans/RPF-WP-0017-attended-login-output-containment.md rename to workplans/archived/260905-RPF-WP-0017-attended-login-output-containment.md diff --git a/workplans/RPF-WP-0018-policy-surface-alignment.md b/workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md similarity index 100% rename from workplans/RPF-WP-0018-policy-surface-alignment.md rename to workplans/archived/260905-RPF-WP-0018-policy-surface-alignment.md diff --git a/workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md b/workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md similarity index 100% rename from workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md rename to workplans/archived/260905-RPF-WP-0019-apps-pg-recoverability-and-controls.md diff --git a/workplans/RPF-WP-0020-ccr-schema-drift.md b/workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md similarity index 100% rename from workplans/RPF-WP-0020-ccr-schema-drift.md rename to workplans/archived/260905-RPF-WP-0020-ccr-schema-drift.md diff --git a/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md b/workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md similarity index 100% rename from workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md rename to workplans/archived/260905-RPF-WP-0026-flex-auth-credential-grant-integration.md diff --git a/workplans/RPF-WP-0028-durable-live-image-inventory.md b/workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md similarity index 100% rename from workplans/RPF-WP-0028-durable-live-image-inventory.md rename to workplans/archived/260905-RPF-WP-0028-durable-live-image-inventory.md diff --git a/workplans/RPF-WP-0030-core-hub-platform-onboarding.md b/workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md similarity index 100% rename from workplans/RPF-WP-0030-core-hub-platform-onboarding.md rename to workplans/archived/260905-RPF-WP-0030-core-hub-platform-onboarding.md diff --git a/workplans/RPF-WP-0031-workplan-identity-collision.md b/workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md similarity index 100% rename from workplans/RPF-WP-0031-workplan-identity-collision.md rename to workplans/archived/260905-RPF-WP-0031-workplan-identity-collision.md diff --git a/workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md b/workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md similarity index 76% rename from workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md rename to workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md index f9ffbfa..a5e1c61 100644 --- a/workplans/RPF-WP-0032-secrets-engine-service-jwt-design.md +++ b/workplans/archived/260905-RPF-WP-0032-secrets-engine-service-jwt-design.md @@ -4,7 +4,7 @@ type: workplan title: "Design secrets-engine service JWT login" domain: financials repo: railiance-platform -status: blocked +status: finished owner: codex created: "2026-09-05" updated: "2026-09-05" @@ -32,7 +32,7 @@ production objects changed or owner messages sent. ```task id: RPF-WP-0032-T02 -status: wait +status: cancel priority: high state_hub_task_id: "d1f4a9f6-4ea5-5daa-97bb-039856855bc2" ``` @@ -41,3 +41,11 @@ Confirm issuer, verification endpoint, actual KeyCape registration and live auth Review the linked design and pin current source revisions before implementation. Do not interpret this workplan or a proposed coordinate as live authorization. + +## Portfolio review — 2026-09-05 + +The design deliverable is complete. The implementation obligation is preserved +in **RPF-WP-0035-T02**, the single credential-lane implementation queue. +T02 is `cancel` here only because it is superseded there; it is not implemented, +waived or externally accepted. The approved design scope and all existing +identifiers remain unchanged. Archived on 2026-09-05 after this consolidation. diff --git a/workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md b/workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md similarity index 76% rename from workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md rename to workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md index d8e85bb..8fa4fac 100644 --- a/workplans/RPF-WP-0033-fluid-telegram-operator-kv-design.md +++ b/workplans/archived/260905-RPF-WP-0033-fluid-telegram-operator-kv-design.md @@ -4,7 +4,7 @@ type: workplan title: "Design fluid-telegram attended operator KV lane" domain: financials repo: railiance-platform -status: blocked +status: finished owner: codex created: "2026-09-05" updated: "2026-09-05" @@ -32,7 +32,7 @@ production objects changed or owner messages sent. ```task id: RPF-WP-0033-T02 -status: wait +status: cancel priority: high state_hub_task_id: "a542697f-adf8-59ac-9704-0bcde1d9fd0f" ``` @@ -41,3 +41,11 @@ Obtain tenant/group/MFA decisions; extend the CCR schema, validator, renderer an Review the linked design and pin current source revisions before implementation. Do not interpret this workplan or a proposed coordinate as live authorization. + +## Portfolio review — 2026-09-05 + +The design deliverable is complete. The implementation obligation is preserved +in **RPF-WP-0035-T03**, the single credential-lane implementation queue. +T02 is `cancel` here only because it is superseded there; it is not implemented, +waived or externally accepted. The approved design scope and all existing +identifiers remain unchanged. Archived on 2026-09-05 after this consolidation. diff --git a/workplans/RPF-WP-0034-state-hub-preflight-signing-design.md b/workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md similarity index 76% rename from workplans/RPF-WP-0034-state-hub-preflight-signing-design.md rename to workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md index 74f3d73..75151de 100644 --- a/workplans/RPF-WP-0034-state-hub-preflight-signing-design.md +++ b/workplans/archived/260905-RPF-WP-0034-state-hub-preflight-signing-design.md @@ -4,7 +4,7 @@ type: workplan title: "Design State Hub preflight signing custody" domain: financials repo: railiance-platform -status: blocked +status: finished owner: codex created: "2026-09-05" updated: "2026-09-05" @@ -32,7 +32,7 @@ production objects changed or owner messages sent. ```task id: RPF-WP-0034-T02 -status: wait +status: cancel priority: high state_hub_task_id: "96e4864a-fd17-529b-a72f-69ffd885a962" ``` @@ -41,3 +41,11 @@ Confirm exact primary deployment and delivery identity; approve the writer and r Review the linked design and pin current source revisions before implementation. Do not interpret this workplan or a proposed coordinate as live authorization. + +## Portfolio review — 2026-09-05 + +The design deliverable is complete. The implementation obligation is preserved +in **RPF-WP-0035-T04**, the single credential-lane implementation queue. +T02 is `cancel` here only because it is superseded there; it is not implemented, +waived or externally accepted. The approved design scope and all existing +identifiers remain unchanged. Archived on 2026-09-05 after this consolidation.