coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0044-T04: issue-core adopted by Argo, verifier passed
Some checks failed
CCR intake gate / gate (push) Successful in 2m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
codex 2026-10-20 13:36:08 +02:00
parent bfdd443861
commit acd1ade59a
4 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -105,7 +105,7 @@
| task | RPF-WP-0044-T01 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T02 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T03 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T04 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T04 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T05 | done | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T06 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |
| task | RPF-WP-0044-T07 | wait | — | workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md |

1
docs/evidence/2026-10-20-issue-core-verify-live.json Normal file
View file

@ -0,0 +1 @@
{"captured_at": "2026-10-20T11:35:18.179570+00:00", "checks": {"argo_synced_healthy": true, "argo_tracking": true, "estate_node_ip": true, "expected_runtime_secret_references": true, "external_secret_ready": true, "healthz_status": 200, "immutable_image": true, "network_policies_present": true, "private_service": true, "source_revision": "186c817b67d3919a64acdddbd3889e539841f946", "unauthenticated_ingest_status": 401}, "dependency_test": "not_run", "passed": true, "schema_version": "rapp-issue-core-adoption/v2", "secret_values_observed": false, "expected_image": "forgejo.coulomb.social/coulomb/issue-core@sha256:a56c80ccbd1690bc0bcea384165b1967704f0fdbaf1c506ce1082f56190b92cf", "sync": {"initiated_by": "founder (rpf-wp-0044-t04)", "strategy": "apply", "prune": false, "force": false, "phase": "Succeeded", "status": "Synced Healthy 186c817b67d3919a64acdddbd3889e539841f946"}}

3
docs/runbooks/rpf-wp-0044-t04-attended.md
View file

@ -72,8 +72,7 @@ python3 -c "import json;d=json.load(open('docs/evidence/2026-10-11-issue-core-cr
4. Manual sync, apply strategy, prune off, force off:
```bash
ssh railiance01 kubectl -n argocd patch application issue-core --type merge -p \
'{"operation":{"initiatedBy":{"username":"rpf-wp-0044-t04"},"sync":{"revision":"186c817b67d3919a64acdddbd3889e539841f946","prune":false,"syncStrategy":{"apply":{"force":false}}}}}'
ssh railiance01 "kubectl -n argocd patch application issue-core --type merge -p '{\"operation\":{\"initiatedBy\":{\"username\":\"rpf-wp-0044-t04\"},\"sync\":{\"revision\":\"186c817b67d3919a64acdddbd3889e539841f946\",\"prune\":false,\"syncStrategy\":{\"apply\":{\"force\":false}}}}}'"
```
5. Bounded owner verifier, from `~/rapp-issue-core`:

6
workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
View file

@ -268,10 +268,8 @@ proving period without changing sync/automation policy or using a new human gate
```task
id: RPF-WP-0044-T04
status: wait
needs_human: true
status: done
intervention_note: "Orange attended Platform OpenBao OIDC/MFA login for the already D2-approved exact repository reader; no second source-scope approval."
blocking_reason: "Credential delivered and child Application placed with zero client-side diff; manual apply-strategy sync (prune/force off) was denied to the agent by harness auto-mode and needs a founder run or permission; then verify-live."
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
priority: high
state_hub_task_id: "0e619658-0453-51ed-b9a0-bed28b5544fd"
@ -289,6 +287,8 @@ Public host trust and exact project admission are prepared in owner source and t
2026-10-20 (attended window, CUST-WP-0079-T06): founder completed the Platform OpenBao OIDC/MFA login and the fixed executor at 10:37Z. Journal `docs/evidence/2026-10-11-issue-core-credential/execution-journal-r1.json`: state `delivered_not_adopted`, consumed-wrap replay denied (400), no secret values observed by the agent, custody version 1, destination `argocd/rapp-issue-core-repository`. The human gate is cleared. Remaining agent steps per `docs/runbooks/rpf-wp-0044-t04-attended.md`: pin the Application, client-side diff, manual sync (prune/force off), bounded verifier. The journal's `contract_sha256` (`0fd6d6fa…`) differs from the sealed file's sha256 (`1ce9d2fd…`). Reconcile this before the adoption sync.
2026-10-20 adoption complete. The founder ran the manual sync (apply strategy, prune/force off). Argo reports issue-core Synced/Healthy at `186c817`, operation Succeeded. The bounded verifier `make verify-live` passed with all checks true: healthz 200, unauthenticated ingest 401, immutable image, ExternalSecret Ready, no secret values observed. Receipt: `docs/evidence/2026-10-20-issue-core-verify-live.json`. The runbook's ssh quoting was fixed. Automated sync is still off; enabling it is a separate decision. T04 done.
## Adopt target-revenue
```task