{
  "schema": "railiance-platform.bounded-native-plan-review.v1",
  "reviewer": "railiance-platform-owner (agent railiance-platform, codex)",
  "work_item": "RPF-WP-0035-T12",
  "decision": "approved",
  "scope": "Exact P4/R2 Platform custody/read-lane and existing Argo Application manual-sync/freeze execution proposal, contingent on mandatory observed execution gates. Owner plan review only; not founder approval, native execution, CCR approval recording or completed native-admission disposition.",
  "intent_basis": "INTENT Secure Custody, Stable Interfaces and Operable and Observable; Staff PEP-shaped attended founder-gated effects. SCOPE retains OpenBao custody/policy/delivery acceptance, not workload/Helm, cluster runtime/storage, identity or authorization ownership.",
  "exact_revisions": {
    "platform_revision": "84c529f239c81e6d3ca337015700b03e3a862f53",
    "packet_p4_manifest_sha256": "9eec861838a8e9138f2c821cff3014998fbe74bb01447642bf50d44e8b3b7cb3",
    "rollout_r2_manifest_sha256": "5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
    "chart_revision": "dc042022f7c30671cf0a7605cf43ef6d96d04242",
    "image_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
    "image_digest": "sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
    "deployment_projection_sha256": "8ce375f065552c551538f3acc7300c427407057eeff1d0b43755bfdf8a46169c",
    "ccr_proposed_sha256": "44bbbf4aff84c3b085afdb14708106fd9a12ac03a0c47774913931a87fb94ada"
  },
  "evidence": {
    "live_preflight_sha256": "7a45f821e57b6ea9a4603db52a603ab230016da2d4145d1b772baa7f4a11840b",
    "observed_at": "2026-10-16T18:53:06.325922+00:00",
    "all_seven_server_dry_runs_accepted": true,
    "projection_source_matches_server_admitted_stopped_render": true,
    "held_fence": false,
    "actual_signer_stopped": false,
    "application_supplement_sha256": "f02a9b595d9246a358d19b37bdad8fde158b7f0c9657a6ff088874732511a32c",
    "application_supplement_observed_at": "2026-10-16T19:12:36.858755+00:00",
    "application_collector_sha256": "sha256:151f54e7815d97f0e28437f8db17f20c1eb436dce56ec332d36b88e0abfbc91d"
  },
  "platform_read_lane": {
    "ccr": "CCR-2026-0050",
    "policy": "workload-kv-read-flex-auth-envelope-signing",
    "role": "external-secrets-flex-auth-envelope-signing",
    "sa": "flex-auth/flex-auth-envelope-signing-eso",
    "audience": "openbao",
    "ttl_seconds": 900,
    "max_ttl_seconds": 900,
    "explicit_max_ttl_seconds": 900,
    "no_default_policy": true,
    "permissions": "Exact platform/data/workloads/flex-auth/envelope-signing read plus lookup-self read/revoke-self update; no metadata/list/sibling/write/delete grant. KV document has all three fields; ESO projects only ED25519_PRIVATE_KEY to seed. No field-level authorization claim.",
    "delivery": "Namespaced SecretStore flex-auth/openbao-flex-auth-envelope-signing and ExternalSecret flex-auth/flex-auth-secrets-engine-envelope-signing; Owner target creation, Retain deletion, 5m refresh; dedicated SA automount false. This proposed namespaced lane does not mutate existing ClusterSecretStore/openbao or legacy ESO token renewer."
  },
  "observed_application_scope": [
    {
      "name": "railiance-apps-root",
      "uid": "3078d1f5-07c2-44cc-bff7-c2ee2a2c9e7c",
      "automated": false,
      "last_phase": "Succeeded",
      "relevance": "Parent of existing nine Applications; hold manual sync during ceremony to prevent child source/policy changes.",
      "source": {
        "chart": null,
        "path": "argocd/railiance01/applications",
        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
        "targetRevision": "main"
      },
      "queued_operation_present": false,
      "resource_tuples": [
        {
          "kind": "Application",
          "name": "activity-core",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "bao-notice",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "eso-token-renewer",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "informed-decision",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "informed-decision-requester",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "openbao-secretstore",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "secret-annotation-guard",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "state-hub-memo-dispatch",
          "namespace": "argocd"
        },
        {
          "kind": "Application",
          "name": "target-revenue",
          "namespace": "argocd"
        }
      ],
      "resource_version": "76247264"
    },
    {
      "name": "informed-decision",
      "uid": "499868f2-eabc-4df4-ae31-b89ce58d750d",
      "automated": false,
      "last_phase": "Succeeded",
      "relevance": "Resource inventory includes NetworkPolicies informed-decision-lifecycle-ingress and informed-decision-review-ingress in flex-auth. Hold manual sync affecting those policies; no signer Deployment/ESO resource ownership observed.",
      "source": {
        "chart": null,
        "path": "deploy/lifecycle",
        "repoURL": "https://forgejo.coulomb.social/coulomb/informed-decision.git",
        "targetRevision": "312ab97e876e17341bf16f9e95397e14c2ac2720"
      },
      "queued_operation_present": false,
      "resource_tuples": [
        {
          "kind": "ConfigMap",
          "name": "informed-decision-runtime-6c221878d051",
          "namespace": "informed-decision"
        },
        {
          "kind": "ConfigMap",
          "name": "informed-decision-runtime-c81577741a09",
          "namespace": "informed-decision"
        },
        {
          "kind": "ConfigMap",
          "name": "informed-decision-workload-registry",
          "namespace": "informed-decision"
        },
        {
          "kind": "PersistentVolumeClaim",
          "name": "informed-decision-data",
          "namespace": "informed-decision"
        },
        {
          "kind": "Service",
          "name": "informed-decision",
          "namespace": "informed-decision"
        },
        {
          "kind": "Service",
          "name": "informed-decision-workload",
          "namespace": "informed-decision"
        },
        {
          "kind": "ServiceAccount",
          "name": "review",
          "namespace": "informed-decision"
        },
        {
          "kind": "Deployment",
          "name": "informed-decision",
          "namespace": "informed-decision"
        },
        {
          "kind": "NetworkPolicy",
          "name": "informed-decision-review-ingress",
          "namespace": "approval-engine"
        },
        {
          "kind": "NetworkPolicy",
          "name": "informed-decision-lifecycle-ingress",
          "namespace": "flex-auth"
        },
        {
          "kind": "NetworkPolicy",
          "name": "informed-decision-review-ingress",
          "namespace": "flex-auth"
        },
        {
          "kind": "NetworkPolicy",
          "name": "informed-decision-review",
          "namespace": "informed-decision"
        },
        {
          "kind": "ClusterRole",
          "name": "informed-decision-tokenreview",
          "namespace": null
        },
        {
          "kind": "ClusterRoleBinding",
          "name": "informed-decision-tokenreview",
          "namespace": null
        }
      ],
      "resource_version": "76247431"
    },
    {
      "name": "openbao-secretstore",
      "uid": "f2932505-e649-4b99-b505-4789ed21301f",
      "automated": false,
      "last_phase": "Succeeded",
      "relevance": "Owns ClusterSecretStore/openbao only; existing shared delivery controller-adjacent app. No proposed signer namespaced lane ownership observed; preserve existing state and no related manual sync during ceremony.",
      "source": {
        "chart": null,
        "path": "argocd/platform-addons/openbao-secretstore",
        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
        "targetRevision": "d2dbc19c254247652c49fda8721c80d53bca206a"
      },
      "queued_operation_present": false,
      "resource_tuples": [
        {
          "kind": "ClusterSecretStore",
          "name": "openbao",
          "namespace": null
        }
      ],
      "resource_version": "76247497"
    },
    {
      "name": "eso-token-renewer",
      "uid": "b10d1e31-08da-4364-b537-4e166eeeb25e",
      "automated": false,
      "last_phase": "Succeeded",
      "relevance": "Owns legacy renewer ConfigMap/SA/CronJob in external-secrets, not new dedicated Kubernetes-auth role. Preserve unchanged; no stop/disable of unrelated shared renewer proposed.",
      "source": {
        "chart": null,
        "path": "argocd/platform-addons/eso-token-renewer",
        "repoURL": "https://forgejo.coulomb.social/coulomb/railiance-platform.git",
        "targetRevision": "b2ebe108495c4d06ebb6ca33893ea4a2a23c9725"
      },
      "queued_operation_present": false,
      "resource_tuples": [
        {
          "kind": "ConfigMap",
          "name": "eso-token-renewer-worker-5c86dt7fm7",
          "namespace": "external-secrets"
        },
        {
          "kind": "ServiceAccount",
          "name": "eso-token-renewer",
          "namespace": "external-secrets"
        },
        {
          "kind": "CronJob",
          "name": "eso-token-renewer",
          "namespace": "external-secrets"
        }
      ],
      "resource_version": "76246569"
    }
  ],
  "observed_signer_controller": "No Application in the current complete inventory owns flex-auth-secrets-engine Deployment, signer SecretStore/ExternalSecret or outbox PVC. Helm release revision4 and native Deployment/ReplicaSet controller are actual signer write path; Access owns exact manual/CI/Helm writer freeze. No new signer Argo adoption or controller configuration change is proposed.",
  "mandatory_execution_gates": [
    "Initial founder rollout/CCR decision may authorize only its explicitly enumerated read-lane apply and Access stopped-candidate preparation effects under reviewed owner scopes; it does not require those effects to exist before authorization. After that authorization and execution, assemble separately reviewed final one-use custody scope from approved CCR bytes/confirmed native bindings, authenticated founder entity, future absolute UTC expiry, held exclusive-window receipt, stopped native projection/fence and independent consumer baseline. All five dispositions bind this exact completed scope before custody. Actual founder/expiry/CCR/window remain null in frozen P4 preparation; this review fills none.",
    "Before window refresh exact Application UID/source revision/resource tuples/current operation and manual sync settings for the identified apps and root. Freeze explicit manual sync/CI/Helm actors by founder executor/abort-owner agreement; require no pending/running Argo operation affecting relevant resources. Last Succeeded alone is not proof of no newly queued operation. Preserve before-state metadata; no speculative absence-of-all-possible-writers requirement. The19:12:36 supplement establishes all four selected Applications manual/no queued operation at that time, not a reserved future window.",
    "Platform approves only source read-lane policy/role/delivery design here. Separate founder CCR decision and reviewed role/policy apply/readback are required; verify exact SA namespace/audience, native policy and all 900s/max/no-default attributes. Native positive/negative ESO login/path tests and safely reduced Ready/SecretSynced/version correspondence are separate evidence; no raw Secret/JWT outputs.",
    "Access installs exact stopped candidate through reviewed Helm path and authenticates competing workload writers; actual observedGeneration, Deployment/owned ReplicaSets0, no owned/terminating/signer-SA/seed-mount pods and no HPA must hold. Exact native projection must equal8ce375f, independently of successful server dry-run. Secrets owns stopped/failclosed consumer; cluster owns refreshed headroom/storage/PV retention.",
    "Founder runs only exact approved silent child/source/admission-file hash through attended Warden OIDC. Use private0700 receipt/admission custody,0600 files, trusted dependencies/runtime and explicit same-UID containment assessment. 5<remaining<=120 seconds at child start with fixed2s I/O caps; expired/early/changed scope refuses; no TTL widening/post-login refresh.",
    "One fixed CAS0 plus metadata setup/readback is distinct from CCR read grant. Fresh exact cluster/backend/entity/source/reader-policy and actual fence checks precede private effects; only durable authenticated public receipt may cross to Secrets. No private seed/credential output, external seed import, standing writer role or agent session.",
    "Keep signer and consumer fenced after CAS until independent Secrets public key/kid/fingerprint/trust admission, exact ESO/readback and Access mounted-runtime proofs. 120s ready abort and600s founder recovery hold apply to proposed rollout; no success inferred from source/public preparation.",
    "On any unknown custody/write/readback/fsync, hold fence and original unknown receipt; only independently reviewed R2 read-only recovery binds immutable original receipt and current/original source lineages. No CAS retry/remint, automatic cleanup, private seed restoration or retrospective success.",
    "Platform restores only captured safe manual Application/sync state under reviewed recovery disposition; never sync root merely to clear OutOfSync or enable automated/prune/selfheal. Access owns workload rollback and outbox preservation; unsigned05a remains failclosed for strict signed consumer. Secrets owns trust withdrawal/restoration; cluster owns PVC/PV retention. Compromise uses separately approved forward-only successor, never old-seed restoration."
  ],
  "owner_roles": [
    "access-engine-owner: workload/Helm",
    "railiance-platform-owner: custody/read-lane/existing Applications",
    "cluster-runtime-storage-owner: runtime/storage",
    "secrets-engine-owner: consumer/trust",
    "founder: exact decision/executor/abort authority"
  ],
  "cost_and_risk": "Platform preparation/new infrastructure EUR0. No monetary loss/risk ceiling granted. Seed compromise permits lifecycle forgery; controlled outage and node-local evidence loss need explicit founder disposition. Shared ESO/Argo controllers remain installed unchanged; Enablement review only if actual installation/controller configuration delta is later proposed.",
  "not_authorized": [
    "live Kubernetes/OpenBao/Argo mutation",
    "credential or Secret reads/TokenRequest",
    "native custody/trust/caller admission",
    "founder decision or completed native scope assent",
    "other-owner review"
  ],
  "open_metadata_detail": "Requested sanitized supplement successfully observed all four exact Application sources/revisions/resource tuples and no queued operation; proposed delivery objects/PVC absent. Refresh at authorized ceremony; no broader writer inventory demanded.",
  "workplan_status": "RPF-WP-0035-T12 remains progress; all native custody/acceptance gates remain open.",
  "observed_delivery_state": {
    "proposed_eso_sa_store_external_secret_and_pvc_absent": true,
    "deployment_field_managers": [
      "helm",
      "k3s"
    ],
    "signer_sa_field_managers": [
      "helm"
    ],
    "observations_grant_no_execution": true
  },
  "approval_stages": {
    "initial_rollout_ccr_decision": "Explicit founder scope for read role/policy/delivery apply and stopped Helm/PVC preparation only; source plan owner reviews support this proposal. No custody/public-trust/caller grant inferred.",
    "later_one_use_custody_assent": "Five exact dispositions bind completed approved CCR/native binding receipt, founder identity, absolute expiry, held window, actual fence/projection, source/image/baseline. Changed expiry changes scope.",
    "execution_produced_facts_not_initial_human_choices": [
      "actual stopped Helm revision",
      "PVC UID/PV UID and Retain readback after WFFC binding",
      "actual stopped fence/projection receipt",
      "held-window observation"
    ],
    "unresolved_human_choices": [
      "authenticated public founder OpenBao entity UUID (not inferred from hub-writer identity)",
      "concrete ceremony absolute UTC expiry/window for final exact scope",
      "accept or constrain proposed high seed-forgery/outage/local-evidence-loss scope; no monetary loss ceiling is established"
    ]
  }
}