From 6dd362014b0c8a4230821e4f4a392f866e0b5a1b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 25 Jul 2026 10:41:51 +0200 Subject: [PATCH 1/2] chore(consistency): renormalize lifecycle state [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-07-25: - workplan status: ready → active --- ...P-0012-rapp-openbao-extraction-boundary.md | 110 ++++++++++++++++++ 1 file changed, 110 insertions(+) create mode 100644 workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md diff --git a/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md b/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md new file mode 100644 index 0000000..ce6567d --- /dev/null +++ b/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md @@ -0,0 +1,110 @@ +--- +id: RAILIANCE-WP-0012 +type: workplan +title: "rapp-openbao extraction boundary" +domain: financials +repo: railiance-platform +status: active +owner: codex +topic_slug: railiance +created: "2026-07-25" +updated: "2026-07-25" +state_hub_workstream_id: "6ec5f317-e6c6-48e8-a7d4-850c13541641" +--- + +# RAILIANCE-WP-0012 - rapp-openbao extraction boundary + +## Goal + +Prepare the first `rapp-*` extraction by separating the OpenBao workload package +surface from the broader S3 platform ownership in `railiance-platform`. + +This workplan follows the first-wave `rapp-*` order defined in +`/home/worsch/railiance-master/docs/rapp-first-wave-candidates.md`. + +## Boundaries + +This workplan may: + +- identify which OpenBao assets belong to a future `rapp-openbao` +- record which OpenBao-related concerns remain platform-owned +- prepare the handoff contract between the future wrapper and S3 platform policy + +It must not: + +- weaken `railiance-platform` as the owner of secrets custody and policy +- move shared credential lane or approval machinery into the workload wrapper +- require a repo rename or live deployment change before the package boundary is clear + +## T01 - Separate package assets from platform-governance assets + +```task +id: RAILIANCE-WP-0012-T01 +status: todo +priority: high +state_hub_task_id: "498a89e1-67e1-4860-8c73-cc38dd92083c" +``` + +Classify the current OpenBao-related files into: + +- workload package assets for `rapp-openbao` +- shared platform governance and policy that stays in `railiance-platform` + +Done when the distinction is written against real file paths and current usage. + +## T02 - Define the first `rapp-openbao` move set + +```task +id: RAILIANCE-WP-0012-T02 +status: todo +priority: high +state_hub_task_id: "67526f71-0220-45fb-ab9d-8cef5628257c" +``` + +Prepare the first move set for the wrapper, including likely candidates such as: + +- Helm values and middleware for the OpenBao workload +- UI overlay wrapper assets +- workload-specific deploy/verify scripts +- workload-health and recovery runbooks + +Done when the future wrapper has a concrete first file inventory. + +## T03 - Record the retained S3 platform responsibilities + +```task +id: RAILIANCE-WP-0012-T03 +status: todo +priority: high +state_hub_task_id: "30036060-85ec-4a24-a428-9f31dd58f853" +``` + +Record what must remain in `railiance-platform`, including: + +- runtime secret custody as a platform capability +- workload lane policy and approval flows +- cross-workload secret delivery conventions +- platform-wide operator guidance that is not OpenBao-package specific + +Done when the wrapper cannot be mistaken for the new S3 ownership home. + +## T04 - Prepare the repo-creation handoff for `rapp-openbao` + +```task +id: RAILIANCE-WP-0012-T04 +status: wait +priority: medium +state_hub_task_id: "25bf2d11-4a85-4259-9027-79768a23a06c" +``` + +Blocked on T01-T03 and the creation of the future `rapp-openbao` repo. + +Prepare the minimal handoff needed to create the wrapper repo without breaking +current operators or losing source-of-truth clarity inside `railiance-platform`. + +Done when the future package extraction can start from a stable boundary. + +## Notes + +This workplan is repo-local. The framework-level sequencing stays in +`railiance-master/workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md`. From 5690372129fa81367ebf0f1644831ffacdcbfd9b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sat, 25 Jul 2026 10:41:54 +0200 Subject: [PATCH 2/2] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-25: - update .custodian-brief.md for railiance-platform --- .custodian-brief.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 01a306c..c6f5841 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,11 +2,20 @@ # Custodian Brief — railiance-platform **Domain:** financials -**Last synced:** 2026-07-25 08:19 UTC +**Last synced:** 2026-07-25 08:41 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams +### Forgejo admin PAT OpenBao consumer cutover +Progress: 0/4 done | workplan_id: `38fa254d-cd56-498a-8385-f9673ec005ac` + +**Open tasks:** +- ! T04 - Verify prune workflow and close the inbox request `1fc2af0f` +- · T01 - Inventory current consumer and fallback paths `68131f3b` +- · T02 - Implement the approved non-file fallback path `f67a58e5` +- · T03 - Update operator guidance and lane references `ed5f791c` + ### rapp-openbao extraction boundary Progress: 0/4 done | workplan_id: `6ec5f317-e6c6-48e8-a7d4-850c13541641` @@ -16,11 +25,6 @@ Progress: 0/4 done | workplan_id: `6ec5f317-e6c6-48e8-a7d4-850c13541641` - · T02 - Define the first `rapp-openbao` move set `67526f71` - · T03 - Record the retained S3 platform responsibilities `30036060` -## Inbox Hygiene - -**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 1 unread message(s) lack supersession chains. - --- ## MCP Orientation (when available)