coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RPF-WP-0044-T04: issue-core child placed, zero client diff; sync awaits permission
All checks were successful
CCR intake gate / gate (push) Successful in 11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 527080@bnt-lap001
Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
This commit is contained in:
codex 2026-10-20 13:22:45 +02:00
parent d70422cc41
commit bfdd443861
2 changed files with 62 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
workplans/RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md
View file

@ -271,7 +271,7 @@ id: RPF-WP-0044-T04
status: wait
needs_human: true
intervention_note: "Orange attended Platform OpenBao OIDC/MFA login for the already D2-approved exact repository reader; no second source-scope approval."
blocking_reason: "Only the founder attended Platform OpenBao OIDC/MFA login running the fixed executor remains; runbook docs/runbooks/rpf-wp-0044-t04-attended.md."
blocking_reason: "Credential delivered and child Application placed with zero client-side diff; manual apply-strategy sync (prune/force off) was denied to the agent by harness auto-mode and needs a founder run or permission; then verify-live."
decision_id: 89f1058f-33bc-47a8-8a49-0b44d426c67e
priority: high
state_hub_task_id: "0e619658-0453-51ed-b9a0-bed28b5544fd"
@ -285,6 +285,8 @@ Public host trust and exact project admission are prepared in owner source and t
2026-10-20 (CUST-WP-0079-T06 attended-window prep, agent): prerequisites done. Host trust and exact project admission were executed 2026-10-11 (the-custodian `docs/evidence/2026-10-11-issue-core-public-transport/execution.json`); a fresh dry-run refused with `target_preimage_changed` (already applied, kept as `docs/evidence/2026-10-11-issue-core-transport/2026-10-20-dry-run-r1.json`) and `--action verify` passed (`2026-10-20-verify-r1.json`). ssh-keyscan from railiance01 matches the pinned provider key. Sealed contract `docs/evidence/2026-10-11-issue-core-credential/contract-sealed-2026-10-20.json` (sha256 `1ce9d2fdc39395407a01e358bfd0179f83f35c0a448e6658eb8f5aab351d3d3a`, expires 2026-10-27) passes the executor's `validate_contract`; 17 executor/transport tests pass. Wrapper pin target is rapp-issue-core `186c817b67d3919a64acdddbd3889e539841f946`. The only remaining step is the founder's attended login running the executor; exact commands and the agent follow-on (pin, diff, manual sync, verifier) are in `docs/runbooks/rpf-wp-0044-t04-attended.md`. No secret, credential or OpenBao call was made.
2026-10-20 (adoption, agent, founder explicit go + D2): the journal `contract_sha256` 0fd6d6fa... is `sha256(json.dumps(contract, sort_keys=True))` of the sealed contract (recomputed, exact match; the raw file hash 1ce9d2fd... was enforced at launch). Child placed in `argocd/railiance01/applications/issue-core.application.yaml` (SSH repoURL, 186c817) in `d70422c` and applied directly, because `railiance-apps-root` is also OutOfSync on activity-core, informed-decision-requester and state-hub-memo-dispatch (`make argocd-pin-drift`: all ok). Argo fetched the SSH source at 186c817 without ComparisonError; Healthy, OutOfSync (8 untracked objects). Client-side diff of the pinned render (T05 method): rc=0; the render holds no credential objects. **Manual sync not performed**: the agent harness auto-mode classifier denied the Application sync-operation patch. Nothing was rolled back because no workload changed; the new Application has no automated sync. Remaining: the founder runs (or permits) runbook step 4 sync, then the step 5 verifier. Receipt: `docs/evidence/2026-10-20-issue-core-argocd-adoption.json`.
2026-10-20 (attended window, CUST-WP-0079-T06): founder completed the Platform OpenBao OIDC/MFA login and the fixed executor at 10:37Z. Journal `docs/evidence/2026-10-11-issue-core-credential/execution-journal-r1.json`: state `delivered_not_adopted`, consumed-wrap replay denied (400), no secret values observed by the agent, custody version 1, destination `argocd/rapp-issue-core-repository`. The human gate is cleared. Remaining agent steps per `docs/runbooks/rpf-wp-0044-t04-attended.md`: pin the Application, client-side diff, manual sync (prune/force off), bounded verifier. The journal's `contract_sha256` (`0fd6d6fa…`) differs from the sealed file's sha256 (`1ce9d2fd…`). Reconcile this before the adoption sync.
## Adopt target-revenue