.custodian-brief.md

@@ -2,20 +2,11 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-07-25 08:41 UTC  
+**Last synced:** 2026-07-25 08:19 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Forgejo admin PAT OpenBao consumer cutover
-Progress: 0/4 done  |  workplan_id: `38fa254d-cd56-498a-8385-f9673ec005ac`
-
-**Open tasks:**
-- ! T04 - Verify prune workflow and close the inbox request  `1fc2af0f`
-- · T01 - Inventory current consumer and fallback paths  `68131f3b`
-- · T02 - Implement the approved non-file fallback path  `f67a58e5`
-- · T03 - Update operator guidance and lane references  `ed5f791c`
-
 ### rapp-openbao extraction boundary
 Progress: 0/4 done  |  workplan_id: `6ec5f317-e6c6-48e8-a7d4-850c13541641`
 
@@ -25,6 +16,11 @@ Progress: 0/4 done  |  workplan_id: `6ec5f317-e6c6-48e8-a7d4-850c13541641`
 - · T02 - Define the first `rapp-openbao` move set  `67526f71`
 - · T03 - Record the retained S3 platform responsibilities  `30036060`
 
+## Inbox Hygiene
+
+**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 1 unread message(s) lack supersession chains.
+
 ---
 ## MCP Orientation (when available)
 

workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md

@@ -1,110 +0,0 @@
----
-id: RAILIANCE-WP-0012
-type: workplan
-title: "rapp-openbao extraction boundary"
-domain: financials
-repo: railiance-platform
-status: active
-owner: codex
-topic_slug: railiance
-created: "2026-07-25"
-updated: "2026-07-25"
-state_hub_workstream_id: "6ec5f317-e6c6-48e8-a7d4-850c13541641"
----
-
-# RAILIANCE-WP-0012 - rapp-openbao extraction boundary
-
-## Goal
-
-Prepare the first `rapp-*` extraction by separating the OpenBao workload package
-surface from the broader S3 platform ownership in `railiance-platform`.
-
-This workplan follows the first-wave `rapp-*` order defined in
-`/home/worsch/railiance-master/docs/rapp-first-wave-candidates.md`.
-
-## Boundaries
-
-This workplan may:
-
-- identify which OpenBao assets belong to a future `rapp-openbao`
-- record which OpenBao-related concerns remain platform-owned
-- prepare the handoff contract between the future wrapper and S3 platform policy
-
-It must not:
-
-- weaken `railiance-platform` as the owner of secrets custody and policy
-- move shared credential lane or approval machinery into the workload wrapper
-- require a repo rename or live deployment change before the package boundary is clear
-
-## T01 - Separate package assets from platform-governance assets
-
-```task
-id: RAILIANCE-WP-0012-T01
-status: todo
-priority: high
-state_hub_task_id: "498a89e1-67e1-4860-8c73-cc38dd92083c"
-```
-
-Classify the current OpenBao-related files into:
-
-- workload package assets for `rapp-openbao`
-- shared platform governance and policy that stays in `railiance-platform`
-
-Done when the distinction is written against real file paths and current usage.
-
-## T02 - Define the first `rapp-openbao` move set
-
-```task
-id: RAILIANCE-WP-0012-T02
-status: todo
-priority: high
-state_hub_task_id: "67526f71-0220-45fb-ab9d-8cef5628257c"
-```
-
-Prepare the first move set for the wrapper, including likely candidates such as:
-
-- Helm values and middleware for the OpenBao workload
-- UI overlay wrapper assets
-- workload-specific deploy/verify scripts
-- workload-health and recovery runbooks
-
-Done when the future wrapper has a concrete first file inventory.
-
-## T03 - Record the retained S3 platform responsibilities
-
-```task
-id: RAILIANCE-WP-0012-T03
-status: todo
-priority: high
-state_hub_task_id: "30036060-85ec-4a24-a428-9f31dd58f853"
-```
-
-Record what must remain in `railiance-platform`, including:
-
-- runtime secret custody as a platform capability
-- workload lane policy and approval flows
-- cross-workload secret delivery conventions
-- platform-wide operator guidance that is not OpenBao-package specific
-
-Done when the wrapper cannot be mistaken for the new S3 ownership home.
-
-## T04 - Prepare the repo-creation handoff for `rapp-openbao`
-
-```task
-id: RAILIANCE-WP-0012-T04
-status: wait
-priority: medium
-state_hub_task_id: "25bf2d11-4a85-4259-9027-79768a23a06c"
-```
-
-Blocked on T01-T03 and the creation of the future `rapp-openbao` repo.
-
-Prepare the minimal handoff needed to create the wrapper repo without breaking
-current operators or losing source-of-truth clarity inside `railiance-platform`.
-
-Done when the future package extraction can start from a stable boundary.
-
-## Notes
-
-This workplan is repo-local. The framework-level sequencing stays in
-`railiance-master/workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md`.