coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close RAILIANCE-WP-0015-T06 rapp credential-lane binding
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details

Browse source 
Document the one recipe a new rapp uses to acquire runtime secrets:
standing KV secrets bind through a CCR target.rapp, leases through
grant rapp_id. Stamp the existing postgres grants and the qonto
workload CCR. Gate, delivery, and revocation are unchanged.
This commit is contained in:
codex 2026-08-14 00:47:28 +02:00
parent 6ab882cc44
commit dfa6373985
10 changed files with 342 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

13
workplans/RAILIANCE-WP-0015-platform-rapp-consistency.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Platform rapp consistency and deployment-management contract"
domain: financials
repo: railiance-platform
status: active
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-11"
@ -174,7 +174,7 @@ the open C-31 failures on multi-segment `RAPP-*-WP-` ids.
```task
id: RAILIANCE-WP-0015-T06
status: todo
status: done
priority: medium
state_hub_task_id: "9ea10522-47a9-4cce-b0d8-cb6f9c7813b8"
```
@ -202,4 +202,11 @@ the T06 coverage check is
`scripts/capture-reef-deployables.py`. Family-validator remainder is
outside this task: `rapp-qonto` still on the pre-schema shape, three
undeclared `rapp-*` engine repos, and `reef-railiance` `bound_rapps`
still hand-listed. T06 is open.
still hand-listed.
Session of 2026-08-13 (later): T06 done. Binding recipe is
`docs/rapp-credential-lane-binding.md`. Standing secrets bind through
a CCR `target.rapp` + `secret_references`; short-lived leases bind
through grant `rapp_id` (required when the grant id is `rapp-*/…`).
Stamped `rapp-postgres` catalog grants and `CCR-2026-0009`. Gate,
delivery, and revocation semantics are unchanged. Workplan finished.