---
id: RPF-WP-0014
type: workplan
title: "Hub-core candidate credential lanes"
domain: financials
repo: railiance-platform
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-21"
updated: "2026-08-22"
related:
  - CORE-WP-0010
  - RAPPCOREHUB-WP-0002
  - RAPP-POSTGRES-WP-0004
state_hub_workstream_id: "ab1c2145-528b-50af-b36e-161f28325848"
---

# Hub-core candidate credential lanes

## Extend exact-scope policy and projections

```task
id: RPF-WP-0014-T01
status: done
priority: high
state_hub_task_id: "b30ba596-14c8-54c2-92fc-530bbbc965a8"
```

Add only `database/creds/hub-core-runtime` and
`database/creds/hub-core-migration` to the existing namespace-limited Core Hub
database store, with separate five-minute ExternalSecret projections.

## Activate and verify production lanes

```task
id: RPF-WP-0014-T02
status: done
priority: high
state_hub_task_id: "68766bac-d032-57f9-84cd-a8725cbe0ada"
```

Apply the reviewed policy and projections after rapp-postgres creates the
roles. Verify store validity, SecretSynced status, role separation, and lease
rotation without reading or logging values.

Completed 2026-08-22. The exact policy, projections, SecretSynced state, role
separation, and production runtime/migration handoff passed on 2026-08-21. A
subsequent scheduled five-minute reconciliation advanced both target Secret
resource versions. After projected-volume propagation, the candidate watcher
replaced only its application child while the pod UID remained stable,
readiness stayed true, and the container restart count stayed zero. No
credential value was read or logged. Evidence:
`docs/evidence/core-hub-private-shadow-2026-08-21.md`.

## Hand off the private candidate

```task
id: RPF-WP-0014-T03
status: done
priority: high
state_hub_task_id: "0af38f5b-7f59-5e14-8046-646c6fe526cd"
```

Confirm both Secret metadata objects are ready, then hand the candidate
migration and rollout gate back to `RAPPCOREHUB-WP-0002-T03`.

Completed 2026-08-21. Both projected Secret metadata objects were Ready, the
migration completed, and the candidate advanced through all route groups to
production authority without exposing credential values.