coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish hub-core credential lane workplan
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
This commit is contained in:
codex 2026-08-22 00:28:18 +02:00
parent 6f4a53543e
commit d40eb3c2a9
3 changed files with 31 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -21,7 +21,7 @@
| workplan | RAILIANCE-WP-0016 | finished | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
| workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md |
| workplan | RAILIANCE-WP-0022 | blocked | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
| workplan | RAILIANCE-WP-0023 | active | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
| workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
@ -93,7 +93,7 @@
| task | RAILIANCE-WP-0022-T04 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
| task | RAILIANCE-WP-0022-T05 | wait | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
| task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| task | RAILIANCE-WP-0023-T02 | progress | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| task | RAILIANCE-WP-0023-T02 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| task | RAILIANCE-WP-0023-T03 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
| task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
| task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |

18
docs/evidence/core-hub-private-shadow-2026-08-21.md
View file

@ -74,6 +74,24 @@ value is included in this record.
and operator-authenticated protected reads/writes. Its temporary token file
was mode 0600 and shredded on exit.
## Scheduled rotation stabilization observation
- At `2026-08-21T22:23:39Z`, after more than six hours of live stabilization,
both five-minute hub-core database ExternalSecrets completed another
scheduled reconciliation with `Ready=True` / `SecretSynced`.
- The runtime target Secret resourceVersion advanced from `50635316` to
`50636878`; the migration target advanced from `50635319` to `50636875`.
Only metadata was observed; neither Secret data nor a credential value was
read or logged.
- After projected-volume propagation, the candidate application child PID
changed from `224` to `278`. The pod UID remained
`64bfd630-4f9c-4df8-9939-c737bd5c5a8a`, readiness remained true, and its
container restart count remained zero. The
`openbao-core-hub-database` ClusterSecretStore remained `Ready=True` /
`Valid`.
- This closes the deliberate scheduled-rotation stabilization gate in
`RAILIANCE-WP-0023-T02` without forcing a refresh or disrupting the pod.
`CCR-2026-0013` is verified. Public promotion, final write freeze/transfer,
DNS changes, and CoulombCore retirement remain separate operator gates under
`CORE-WP-0011`.

17
workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Hub-core candidate credential lanes"
domain: financials
repo: railiance-platform
status: active
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-21"
updated: "2026-08-21"
updated: "2026-08-22"
related:
- CORE-WP-0010
- RAPPCOREHUB-WP-0002
@ -35,7 +35,7 @@ database store, with separate five-minute ExternalSecret projections.
```task
id: RAILIANCE-WP-0023-T02
status: progress
status: done
priority: high
state_hub_task_id: "d15f82db-f1ba-467a-bb69-86eb7c314016"
```
@ -44,9 +44,14 @@ Apply the reviewed policy and projections after rapp-postgres creates the
roles. Verify store validity, SecretSynced status, role separation, and lease
rotation without reading or logging values.
The exact policy, projections, SecretSynced state, role separation, and
production runtime/migration handoff passed on 2026-08-21. Keep this task in
progress for the deliberate lease-rotation observation during stabilization.
Completed 2026-08-22. The exact policy, projections, SecretSynced state, role
separation, and production runtime/migration handoff passed on 2026-08-21. A
subsequent scheduled five-minute reconciliation advanced both target Secret
resource versions. After projected-volume propagation, the candidate watcher
replaced only its application child while the pod UID remained stable,
readiness stayed true, and the container restart count stayed zero. No
credential value was read or logged. Evidence:
`docs/evidence/core-hub-private-shadow-2026-08-21.md`.
## Hand off the private candidate