coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record attended completion from the CUST-WP-0073 cutover (2026-10-20)

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
codex 2026-10-21 00:02:00 +02:00
parent 3e6f2807cf
commit b64bb3f1fe
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -188,7 +188,7 @@
| task | RPF-WP-0061-T05 | wait | — | workplans/RPF-WP-0061-self-service-ccr-intake.md |
| task | RPF-WP-0062-T01 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
| task | RPF-WP-0062-T02 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
| task | RPF-WP-0062-T03 | wait | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
| task | RPF-WP-0062-T03 | done | — | workplans/RPF-WP-0062-custodian-agent-observer-identity.md |
| intake | RPF-IN-0001 | closed | — | intakes/intakes.md |
| intake | RPF-IN-0002 | open | — | intakes/intakes.md |
| intake | RPF-IN-0003 | open | — | intakes/intakes.md |

6
workplans/RPF-WP-0062-custodian-agent-observer-identity.md
View file

@ -91,13 +91,13 @@ introduced the manifests. No `automated` block, no finalizer.
```task
id: RPF-WP-0062-T03
status: wait
status: done
priority: high
needs_human: true
blocking_reason: "Root and custodian-agents child synced 2026-10-20; impersonated can-i proof passed. Remaining: founder issues the agent token (and, if wanted, a token-based can-i rerun)."
state_hub_task_id: "c1d2bf34-791e-5bfa-beda-94532448c7b3"
```
2026-10-20 (recorded 2026-10-21): the founder issued the 24h ServiceAccount token for `custodian-agents/custodian-agent` (CUST-WP-0073 `issue-agent-credentials.sh kube`). Token-based proof from the agent account: identity `custodian-agents:custodian-agent`, no system:masters, curated `get pods` allowed, 597/597 negative probes denied across 48 namespaces (the-custodian `docs/evidence/2026-10-20-custodian-agent-kube-denials-receipt.json`, passed=true). Done.
2026-10-20: the founder ran the attended `custodian-agents` child sync, pinned to `567d2c6` with the apply strategy and prune/force off. The operation Succeeded and the app is Synced/Healthy. It created exactly four objects: Namespace `custodian-agents`, ServiceAccount `custodian-agent`, ClusterRole `custodian-supervised-observer` and its ClusterRoleBinding. A pre-check confirmed none of these names existed before the sync.
Impersonated `kubectl auth can-i --as=system:serviceaccount:custodian-agents:custodian-agent`: