feat: add hub-core database lease projections

WORK-RECORDS.md

@@ -21,6 +21,7 @@
 | workplan | RAILIANCE-WP-0016 | finished | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md |
 | workplan | RAILIANCE-WP-0022 | blocked | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
+| workplan | RAILIANCE-WP-0023 | active | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
@@ -91,6 +92,9 @@
 | task | RAILIANCE-WP-0022-T03 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
 | task | RAILIANCE-WP-0022-T04 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
 | task | RAILIANCE-WP-0022-T05 | wait | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
+| task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| task | RAILIANCE-WP-0023-T02 | progress | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| task | RAILIANCE-WP-0023-T03 | wait | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |

argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml

@@ -58,3 +58,39 @@ spec:
   dataFrom:
     - extract:
         key: creds/core-hub-migration
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hub-core-runtime-database
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-database
+  target:
+    name: hub-core-runtime-database
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  dataFrom:
+    - extract:
+        key: creds/hub-core-runtime
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hub-core-migration-database
+  namespace: core-hub
+spec:
+  refreshInterval: 5m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao-core-hub-database
+  target:
+    name: hub-core-migration-database
+    creationPolicy: Owner
+    deletionPolicy: Retain
+  dataFrom:
+    - extract:
+        key: creds/hub-core-migration

openbao/policies/external-secrets-core-hub-database.hcl

@@ -9,3 +9,11 @@ path "database/creds/core-hub-runtime" {
 path "database/creds/core-hub-migration" {
   capabilities = ["read"]
 }
+
+path "database/creds/hub-core-runtime" {
+  capabilities = ["read"]
+}
+
+path "database/creds/hub-core-migration" {
+  capabilities = ["read"]
+}

tests/test_credential_change.py

@@ -183,6 +183,8 @@ class CredentialChangeTests(unittest.TestCase):
         ).read_text()
         self.assertIn('path "database/creds/core-hub-runtime"', database_policy)
         self.assertIn('path "database/creds/core-hub-migration"', database_policy)
+        self.assertIn('path "database/creds/hub-core-runtime"', database_policy)
+        self.assertIn('path "database/creds/hub-core-migration"', database_policy)
         self.assertNotIn("platform/data/", database_policy)
 
         database_store = credential_change.load_yaml(
@@ -204,6 +206,8 @@ class CredentialChangeTests(unittest.TestCase):
                 "core-hub-api-token",
                 "core-hub-runtime-database",
                 "core-hub-migration-database",
+                "hub-core-runtime-database",
+                "hub-core-migration-database",
             },
         )
         for item in external_secrets:
@@ -219,6 +223,22 @@ class CredentialChangeTests(unittest.TestCase):
         )
         self.assertEqual(runtime["spec"]["dataFrom"][0]["extract"]["key"], "creds/core-hub-runtime")
         self.assertEqual(migration["spec"]["dataFrom"][0]["extract"]["key"], "creds/core-hub-migration")
+        hub_runtime = next(
+            item for item in external_secrets
+            if item["metadata"]["name"] == "hub-core-runtime-database"
+        )
+        hub_migration = next(
+            item for item in external_secrets
+            if item["metadata"]["name"] == "hub-core-migration-database"
+        )
+        self.assertEqual(
+            hub_runtime["spec"]["dataFrom"][0]["extract"]["key"],
+            "creds/hub-core-runtime",
+        )
+        self.assertEqual(
+            hub_migration["spec"]["dataFrom"][0]["extract"]["key"],
+            "creds/hub-core-migration",
+        )
 
     def test_target_rapp_rejects_non_slug(self) -> None:
         path = self.unapproved_ccr()

workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md

@@ -0,0 +1,53 @@
+---
+id: RAILIANCE-WP-0023
+type: workplan
+title: "Hub-core candidate credential lanes"
+domain: financials
+repo: railiance-platform
+status: active
+owner: codex
+topic_slug: railiance
+created: "2026-08-21"
+updated: "2026-08-21"
+related:
+  - CORE-WP-0010
+  - RAPPCOREHUB-WP-0002
+  - RAPP-POSTGRES-WP-0004
+---
+
+# Hub-core candidate credential lanes
+
+## Extend exact-scope policy and projections
+
+```task
+id: RAILIANCE-WP-0023-T01
+status: done
+priority: high
+```
+
+Add only `database/creds/hub-core-runtime` and
+`database/creds/hub-core-migration` to the existing namespace-limited Core Hub
+database store, with separate five-minute ExternalSecret projections.
+
+## Activate and verify production lanes
+
+```task
+id: RAILIANCE-WP-0023-T02
+status: progress
+priority: high
+```
+
+Apply the reviewed policy and projections after rapp-postgres creates the
+roles. Verify store validity, SecretSynced status, role separation, and lease
+rotation without reading or logging values.
+
+## Hand off the private candidate
+
+```task
+id: RAILIANCE-WP-0023-T03
+status: wait
+priority: high
+```
+
+Confirm both Secret metadata objects are ready, then hand the candidate
+migration and rollout gate back to `RAPPCOREHUB-WP-0002-T03`.