Finish hub-core credential lane workplan

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

WORK-RECORDS.md

@@ -21,7 +21,7 @@
 | workplan | RAILIANCE-WP-0016 | finished | — | workplans/RAILIANCE-WP-0016-architecture-cleanup-backlog.md |
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md |
 | workplan | RAILIANCE-WP-0022 | blocked | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
-| workplan | RAILIANCE-WP-0023 | active | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| workplan | RAILIANCE-WP-0023 | finished | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
@@ -93,7 +93,7 @@
 | task | RAILIANCE-WP-0022-T04 | done | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
 | task | RAILIANCE-WP-0022-T05 | wait | — | workplans/RAILIANCE-WP-0022-agent-high-risk-boundary-coverage.md |
 | task | RAILIANCE-WP-0023-T01 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
-| task | RAILIANCE-WP-0023-T02 | progress | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
+| task | RAILIANCE-WP-0023-T02 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | task | RAILIANCE-WP-0023-T03 | done | — | workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md |
 | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |

docs/evidence/core-hub-private-shadow-2026-08-21.md

@@ -74,6 +74,24 @@ value is included in this record.
   and operator-authenticated protected reads/writes. Its temporary token file
   was mode 0600 and shredded on exit.
 
+## Scheduled rotation stabilization observation
+
+- At `2026-08-21T22:23:39Z`, after more than six hours of live stabilization,
+  both five-minute hub-core database ExternalSecrets completed another
+  scheduled reconciliation with `Ready=True` / `SecretSynced`.
+- The runtime target Secret resourceVersion advanced from `50635316` to
+  `50636878`; the migration target advanced from `50635319` to `50636875`.
+  Only metadata was observed; neither Secret data nor a credential value was
+  read or logged.
+- After projected-volume propagation, the candidate application child PID
+  changed from `224` to `278`. The pod UID remained
+  `64bfd630-4f9c-4df8-9939-c737bd5c5a8a`, readiness remained true, and its
+  container restart count remained zero. The
+  `openbao-core-hub-database` ClusterSecretStore remained `Ready=True` /
+  `Valid`.
+- This closes the deliberate scheduled-rotation stabilization gate in
+  `RAILIANCE-WP-0023-T02` without forcing a refresh or disrupting the pod.
+
 `CCR-2026-0013` is verified. Public promotion, final write freeze/transfer,
 DNS changes, and CoulombCore retirement remain separate operator gates under
 `CORE-WP-0011`.

workplans/RAILIANCE-WP-0023-hub-core-candidate-credential-lanes.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Hub-core candidate credential lanes"
 domain: financials
 repo: railiance-platform
-status: active
+status: finished
 owner: codex
 topic_slug: railiance
 created: "2026-08-21"
-updated: "2026-08-21"
+updated: "2026-08-22"
 related:
   - CORE-WP-0010
   - RAPPCOREHUB-WP-0002
@@ -35,7 +35,7 @@ database store, with separate five-minute ExternalSecret projections.
 
 ```task
 id: RAILIANCE-WP-0023-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "d15f82db-f1ba-467a-bb69-86eb7c314016"
 ```
@@ -44,9 +44,14 @@ Apply the reviewed policy and projections after rapp-postgres creates the
 roles. Verify store validity, SecretSynced status, role separation, and lease
 rotation without reading or logging values.
 
-The exact policy, projections, SecretSynced state, role separation, and
+Completed 2026-08-22. The exact policy, projections, SecretSynced state, role
-production runtime/migration handoff passed on 2026-08-21. Keep this task in
+separation, and production runtime/migration handoff passed on 2026-08-21. A
-progress for the deliberate lease-rotation observation during stabilization.
+subsequent scheduled five-minute reconciliation advanced both target Secret
+resource versions. After projected-volume propagation, the candidate watcher
+replaced only its application child while the pod UID remained stable,
+readiness stayed true, and the container restart count stayed zero. No
+credential value was read or logged. Evidence:
+`docs/evidence/core-hub-private-shadow-2026-08-21.md`.
 
 ## Hand off the private candidate