coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native ESO result and prepare scoped self-token amendment
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-04 23:21:55 +02:00
parent f7776013af
commit e84b68db01
7 changed files with 111 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md
View file

@ -91,7 +91,7 @@ priority: high
depends_on: [RPF-WP-0051-T02]
needs_human: true
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
blocking_reason: "Exact requester delivery approved by founder. Await attended OpenBao OIDC/MFA execution, then native custody/delivery receipts; broader lifecycle cutover remains separate."
blocking_reason: "Approved metadata applied; ESO validation fails on token lookup-self. Prepared exact self-token lookup/revoke amendment awaits founder approval and attended execution; broader cutover remains separate."
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"
```
@ -138,3 +138,19 @@ docs/evidence/requester-metadata/*.json and remains silent. Twelve focused tests
pass. The approved CCR and permissions are unchanged. A fresh attended attempt
will compare both objects before any missing-only write and record its phase.
Native delivery remains pending; do not mark the earlier attempt successful.
## Native delivery result and required amendment — 2026-10-04
Founder reported exit 0 and helper receipt confirms metadata_verified. Created
the reviewed dedicated manual ArgoCD application/project and synced three delivery
objects from 4332c39 after diff/server dry-run. Corrected the draft audience field
to serviceAccountRef.audiences using the installed ESO schema. Node IP and CPU
headroom checked (3445m/4000m); no workload rollout or image change occurred.
ArgoCD sync succeeded; ClusterSecretStore and ExternalSecret are not Ready.
Bounded condition inspection confirms 403 on auth/token/lookup-self. Existing
ESO readers include self lookup/read and revoke/update, omitted by this packet.
Prepared only that amendment and an exact-predecessor policy migration in the
silent helper; 14 tests pass. CCR returns to proposed for changed capabilities,
retaining original approval/application history. T03 stays waiting for amendment
approval and fresh attended execution. Evidence: 2026-10-04-requester-delivery.json.