{
  "interface": "railiance.owner-review",
  "version": 1,
  "workplan_id": "RAILIANCE-WP-0024",
  "workplan_uuid": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d",
  "base_revision": "3f9e453",
  "receipt_destination": "railiance-platform",
  "decisions": [
    "approve",
    "request-changes"
  ],
  "task_owners": {
    "RAILIANCE-WP-0024-T02": [
      "audit-core",
      "rapp-postgres",
      "railiance-platform"
    ],
    "RAILIANCE-WP-0024-T03": [
      "audit-core",
      "rapp-postgres",
      "railiance-cluster",
      "railiance-infra",
      "railiance-platform"
    ]
  },
  "owners": {
    "audit-core": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py"
      ],
      "assertions": [
        "The database-lease exercise uses only synthetic load and proves health 200, readiness and requests fail retryably with 503, then recover without changing the audit-core pod UID or restart count.",
        "The approved load driver implements the exact start, probe, stop and summary contract and cannot expose credential values.",
        "The reboot exercise proves audit-core health, readiness, database integrity and the approved synthetic E2 path after dependencies recover."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    },
    "rapp-postgres": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py",
        "docs/audit-core-database-lease-approval.example.json"
      ],
      "assertions": [
        "Lease selection aborts unless exactly one live handle exists below database/creds/audit-core-runtime and its issue time coheres with the ExternalSecret refresh.",
        "The action revokes only that exact lease handle; it never revokes the role prefix, an External Secrets parent lease, or another database consumer.",
        "Recovery uses ordinary ExternalSecret refresh and mounted-file reread, with no pod restart, database restore or credential value in evidence.",
        "After the coordinated reboot, the same platform-pg PVC and cluster identity return 1/1 Ready with ContinuousArchiving true and no re-bootstrap or in-place restore shortcut.",
        "The reboot hold point requires a fresh completed Barman backup and healthy WAL archiving before the host action."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    },
    "railiance-cluster": {
      "tasks": [
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "docs/openbao-reboot-snapshot-receipt.example.json"
      ],
      "assertions": [
        "Recovery is ordered host, node/k3s, CoreDNS and operators before application readiness; application lag is not treated as host failure.",
        "The exercise does not reinstall k3s, replace PVCs or alter firewall policy as a recovery shortcut.",
        "External Secrets stale-provider recovery is bounded to the documented controller reconciliation path and preserves value-safe evidence."
      ],
      "checks": [
        "focused-unit-tests",
        "node-reboot-preflight"
      ]
    },
    "railiance-infra": {
      "tasks": [
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "docs/openbao-reboot-snapshot-receipt.example.json"
      ],
      "assertions": [
        "An attended operator has independently verified provider-console access before the window and performs an ordinary reboot only.",
        "Host-return, access-recovery and abort/escalation ownership are explicit; no ad hoc firewall, operating-system or k3s reinstall is authorized.",
        "The reboot is gated on a current verified encrypted off-host OpenBao snapshot receipt and named recovery owners."
      ],
      "checks": [
        "focused-unit-tests",
        "node-reboot-preflight"
      ]
    },
    "railiance-platform": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py",
        "docs/audit-core-database-lease-approval.example.json",
        "docs/openbao-reboot-snapshot-receipt.example.json"
      ],
      "assertions": [
        "T02 remains gated on a named window, abort operator, exact owner receipts and a revision-pinned synthetic-load driver; repository access alone cannot revoke a lease.",
        "T02 revokes only the selected runtime handle, forces only the database ExternalSecret and records no credential values or OpenBao response bodies.",
        "T03 remains gated on a verified encrypted off-host OpenBao snapshot receipt, 2-of-3 Shamir quorum, provider-console access, all owner receipts and a final attended go/no-go.",
        "The platform owner preserves the mutation freeze and ordered OpenBao/ESO recovery boundary and does not initialize OpenBao, restore in place or restart audit-core as a shortcut."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    }
  },
  "artifact_sha256": {
    "docs/audit-core-database-lease-approval.example.json": "360d49d0bea7ca376405974403036bff080533728f133d237f30f4ee3bb943e0",
    "docs/audit-core-database-lease-recovery.md": "5aa8f2723d7216d775990e0b2cd770290284b62d185526a9dffe7d6a4f925d95",
    "docs/openbao-reboot-snapshot-receipt.example.json": "b95903a3e1aacb607eecc3f0440f08e62480d09da47bd7ab96c3eb8814f2eaee",
    "docs/railiance01-coordinated-reboot.md": "9969c2f498587710154e8d9a650fb8a13159e9e7b99918291dbdf577b131b7e7",
    "scripts/audit-core-database-lease-recovery.py": "c87fb026c527fc17116067c5742d324340707ce4aecf440d0d4e618db9b872a1",
    "scripts/audit-core-recovery-preflight.py": "802f73fa4352f64bc0972d813e3dd874f3ec2f428e162b23158c9d8d6fd8e710"
  }
}