feat: prepare core hub platform onboarding

credential-change-requests/CCR-2026-0013-core-hub-runtime-api-token.yaml

@@ -0,0 +1,115 @@
+id: CCR-2026-0013
+kind: credential-change-request
+schema_version: 1
+request_type: workload-kv-read
+title: Core Hub runtime API token lane
+status: proposed
+created: '2026-08-20'
+updated: '2026-08-20'
+requester:
+  agent: codex
+  reason: >-
+    CORE-WP-0011 and RAPP-CORE-HUB-WP-0001 relocate Core Hub production to
+    railiance01. The validated package requires CORE_HUB_API_TOKEN, but the
+    value must move through platform custody rather than a copied Kubernetes
+    Secret or Git. This request covers only the standing application token;
+    PostgreSQL credentials remain dynamic database-engine leases.
+review:
+  required: true
+  required_approvers:
+  - platform-operator
+  - core-hub-owner
+  comments: []
+target:
+  domain: infotech
+  tenant: core-hub
+  workload: core-hub
+  rapp: rapp-core-hub
+  environment: production
+  purpose: >-
+    Project the existing Core Hub protected-API token into the private
+    railiance01 runtime through a namespace-limited ExternalSecret while
+    preserving the token across the relocation window.
+openbao:
+  mount: platform
+  kv_path: platform/workloads/core-hub/runtime
+  fields:
+  - CORE_HUB_API_TOKEN
+  policy_name: workload-kv-read-core-hub-runtime
+  policy_file: openbao/policies/workload-kv-read-core-hub-runtime.hcl
+  auth:
+    method: kubernetes
+    mount: kubernetes
+    role: external-secrets-core-hub-runtime
+    bound_claims:
+      service_account_names:
+      - external-secrets
+      service_account_namespaces:
+      - external-secrets
+    bound_claims_confirmed: false
+    policies:
+    - workload-kv-read-core-hub-runtime
+    ttl: 15m
+access_frontdoor:
+  type: ops-warden
+  catalog_id: core-hub-runtime-api-token
+  selector: Core Hub runtime protected API token
+  command: warden access core-hub-runtime-api-token --fetch CORE_HUB_API_TOKEN
+  resolvable: false
+  readiness: pending-review
+delivery:
+  surface: external-secrets
+  target: >-
+    ClusterSecretStore openbao-core-hub-runtime, limited to namespace
+    core-hub, to ExternalSecret core-hub/core-hub-api-token and Secret
+    core-hub-api-token. The rapp package consumes this Secret separately from
+    runtime and migration PostgreSQL lease Secrets.
+risk:
+  classification: high
+  notes:
+  - The token authorizes protected Core Hub API operations and must not be
+    printed, placed on argv, committed, or recorded in State Hub.
+  - This CCR does not authorize a standing database password or a database URL
+    in KV. Those come from the OpenBao database engine.
+  - Preserve the current token during the relocation so existing protected API
+    consumers do not fail at the same time as the infrastructure move.
+  - Later rotation is coordinated with every protected API consumer because
+    Core Hub currently accepts one token.
+verification:
+  positive:
+  - An approved core-hub ExternalSecret syncs CORE_HUB_API_TOKEN into Secret
+    core-hub-api-token without printing the value.
+  - Protected API smoke succeeds against the private shadow endpoint using an
+    injected token after the source database has been reconciled.
+  negative:
+  - A namespace outside core-hub cannot use openbao-core-hub-runtime.
+  - A token without workload-kv-read-core-hub-runtime cannot read the KV data
+    path.
+  - The Core Hub workload identity cannot write or list sibling workload paths.
+  activation_conditions:
+  - Platform operator and Core Hub owner approve this CCR.
+  - The source token is transferred through attended operator custody without
+    entering logs, chat, Git, or State Hub.
+  - The Kubernetes auth role and policy are applied to railiance01-local
+    OpenBao and the bound service-account claims are verified.
+  - The package consumes the API-token Secret separately from dynamic database
+    lease Secrets.
+  - Positive and negative evidence is recorded with non-secret timestamps or
+    OpenBao audit references.
+  evidence: []
+lifecycle:
+  deactivate: >-
+    Disable the front door and Kubernetes auth role, remove the ExternalSecret,
+    and delete the materialized Secret only after Core Hub is retired or a
+    reviewed fallback is active.
+  rotate: >-
+    Coordinate a new random token with all protected API consumers, update the
+    OpenBao field through attended custody, wait for ESO sync, roll Core Hub and
+    consumers, verify protected calls, then invalidate the old token.
+  compromised: >-
+    Disable protected writes, replace the token in OpenBao and every consumer,
+    roll the workload, review Core Hub protected-operation logs, and open an
+    incident follow-up.
+state_hub:
+  workplan_id: RPF-WP-0021
+  task_id: RPF-WP-0021-T04