143 commits

Author	SHA1	Message	Date
codex	60fcd0cdce	Record partial resolver update and operator stop ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 15:13:35 +02:00
codex	b879e85d6d	Pin privacyIDEA resolver reconciliation gate ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 15:06:50 +02:00
codex	18d61cd6a0	Record final KeyCape recovery receipt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:51:50 +02:00
codex	7f71dff945	docs(RAILIANCE-WP-0027): record attended callback NO-GO ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:41:10 +02:00
codex	7ce3bc8380	Record KeyCape exposure owner receipts ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:37:36 +02:00
codex	d18649fc6e	feat(RAILIANCE-WP-0027): add contained callback role update ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:37:01 +02:00
codex	453fed3b2d	Plan KeyCape exposure recovery ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:10:06 +02:00
codex	c9d02147d3	Adopt canonical flex-auth credential checks ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:03:40 +02:00
codex	8ae77ca006	Record KeyCape loopback callback evidence ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 13:23:35 +02:00
codex	913c03d6ec	Fix apps-pg tenancy evidence declaration ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 13:21:42 +02:00
repo-manager	e8e71191d8	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:51:40 +02:00
codex	517f68593d	feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:50:23 +02:00
codex	082c76979e	Add attended login containment workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 01:13:52 +02:00
codex	077c4f8699	Record WP0027 terminal no-go ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 01:08:30 +02:00
codex	f87a4aa1f4	Record WP0027 platform snapshot receipt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 00:32:20 +02:00
codex	2a5c002aa5	Prepare canonical custody for audit E2 third attempt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de	2026-08-22 23:23:41 +02:00
repo-manager	fc198b896f	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:57:18 +02:00
codex	30e6edc236	Add versioned ephemeral custody lifecycle ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:56:42 +02:00
codex	04c858eff6	Record audit E2 retry readiness ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:00:29 +02:00
codex	a557208a4a	Add direct WP-0024 load driver handoff ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 16:17:03 +02:00
codex	abf8855ae1	Include platform owner in WP-0024 receipts ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 14:59:59 +02:00
codex	d8c0cd38a7	Report WP-0024 approvals by task ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 14:57:52 +02:00
codex	defb2a556d	Correct WP-0024 lease selection contract ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 14:46:12 +02:00
codex	0d9cebedea	Add direct WP-0024 owner review interface ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 14:15:02 +02:00
codex	3f9e4535d1	Harden WP-0024 recovery execution gates ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 14:00:18 +02:00
codex	08a3dd7660	Record WP-0024 recovery owner routing ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 13:18:50 +02:00
codex	bd25f7fa40	Add audit recovery exercise preflights ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 13:16:13 +02:00
codex	864cc20b96	Add attended Whitehat E2 credential projection ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:59:38 +02:00
custodian-sync	a4642274a2	chore(consistency): renormalize lifecycle state [auto] ... Updated by fix-consistency on 2026-08-22: - workplan status: ready → active Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:42:06 +02:00
repo-manager	5141bf1d0b	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:39:42 +02:00
codex	8e26afc6a6	Add audit custody and recovery coordination workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:34:25 +02:00
codex	429cc912ed	Finish coding-agent high-risk boundary coverage ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 10:03:54 +02:00
codex	d40eb3c2a9	Finish hub-core credential lane workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 00:28:18 +02:00
repo-manager	c54de0f3d0	chore(registrar): assign State Hub identifiers	2026-08-21 21:39:10 +02:00
codex	456a80c2f6	Finish OpenRouter provider lane workplan	2026-08-21 21:22:52 +02:00
codex	4689645621	docs: record hub-core credential handoff	2026-08-21 21:07:10 +02:00
codex	bb7cfcb184	feat: add hub-core database lease projections	2026-08-21 17:30:44 +02:00
codex	382f04412a	Close CCR drift and high-risk policy gaps	2026-08-21 01:29:28 +02:00
codex	1206ed55da	Finish Core Hub private shadow onboarding	2026-08-21 00:51:06 +02:00
codex	90a0192e4f	Record Core Hub lease and network readiness	2026-08-20 23:44:35 +02:00
codex	06c69f140e	Track Core Hub credential approval gate	2026-08-20 23:33:18 +02:00
codex	07ed6217b7	Advance RPF-WP-0021 platform onboarding	2026-08-20 23:31:47 +02:00
codex	cb321deeab	Finish RPF-WP-0019 apps-pg controls and recovery	2026-08-20 22:58:45 +02:00
codex	ceed3c051d	docs: record provider incident and core hub rotation	2026-08-20 22:47:38 +02:00
codex	131502e6e7	docs: refresh core hub publication evidence	2026-08-20 12:00:02 +02:00
codex	ac69f90300	feat: prepare core hub platform onboarding	2026-08-20 11:18:30 +02:00
codex	7fb7c503df	chore(consistency): sync RPF-WP-0020 registration	2026-08-18 15:19:19 +02:00
codex	b1f973c2d5	Pin apps-pg targets to railiance01 by cluster identity; seed RPF-WP-0020 ... Two reachable clusters each carry a CNPG Cluster named apps-pg in a namespace named databases. KUBECONFIG is an environment variable, so the Makefile ?= default never applied, and RAILIANCE01_KUBECONFIG pointed at config-hosteurope - a different cluster. Had the environment pointed at the other reachable cluster instead of an unauthorized one, make apps-pg-deploy would have applied RPF-WP-0019 connection limits, role timeouts and backup config to the wrong cluster and reported success. The Unauthorized error was the only thing that prevented it. Filename selection cannot protect against this: both kubeconfigs resolve to a 127.0.0.1 tunnel port and the environment wins either way. railiance01-guard pins identity instead, comparing the live kube-system namespace UID against RAILIANCE01_CLUSTER_UID, and fails closed on mismatch or unreachability. It gates apps-pg deploy, backup-deploy, overflow-dry-run, status and shell. Verified refusing on the wrong cluster, refusing when unreachable, and passing on railiance01. Not global: db-status legitimately targets the other cluster for gitea-db. RPF-WP-0019 blocker note corrected - the cluster was never unreachable, our wiring was wrong. RPF-WP-0020 seeded for the pre-existing CCR test failure, which is two unrelated problems: CCR-2026-0010 is an active lane missing its whole openbao.auth block, and CCR-2026-0011 is an honest in-flight draft the suite has no way to express. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 15:18:37 +02:00
codex	dc4245361d	Finish RPF-WP-0018; RPF-WP-0019 repository-complete ... RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding was adopted upstream and its canonical form is the provider: block in tenancy.yaml; adaptive-pricing declined the standing co-signature and supplied typed tier minima instead, recorded in ADR-0002. Three corrections against our own output are recorded in the documents rather than edited away. RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as overflow, enforced by make apps-pg-verify-capacity). T01/T02 are repository-complete: backup target, retention, per-consumer connection limits, role timeouts and Burstable resources are declared in source and published in s3-consumer-interfaces 1.1.0 before rollout. They stay in progress because no live application, backup success or restore proof exists, and declared configuration is not a section 13 artifact. T04 waits on that window. apps-pg R reason corrected to say the target is declared-not-applied rather than absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 13:35:04 +02:00
codex	b15215d191	RPF-WP-0018: mark unevidenced P1 claims; seed RPF-WP-0019 for apps-pg ... Placement policy 3.1 records that the P1 levels for vergabe and coulomb_social are provisioning declarations without the SS13 isolation probes - apps-pg has none. 3.2 records that apps-pg cannot produce the noisy-neighbour artifact at all until per-consumer controls exist, per SS13.4: with nothing to bind, a probe could only demonstrate degradation. RPF-WP-0019 seeded for the three live defects the disclosure work found: no backup, no per-consumer controls, no isolation probes. Kept separate from RPF-WP-0018 so declaring is not confused with fixing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 23:01:57 +02:00