{
  "interface": "railiance.owner-review",
  "version": 1,
  "workplan_id": "RAILIANCE-WP-0024",
  "workplan_uuid": "88c4ef7f-0af8-580e-90dc-a2bae2675a4d",
  "base_revision": "3f9e453",
  "receipt_destination": "railiance-platform",
  "decisions": [
    "approve",
    "request-changes"
  ],
  "task_owners": {
    "RAILIANCE-WP-0024-T02": [
      "audit-core",
      "rapp-postgres",
      "railiance-platform"
    ],
    "RAILIANCE-WP-0024-T03": [
      "audit-core",
      "rapp-postgres",
      "railiance-cluster",
      "railiance-infra",
      "railiance-platform"
    ]
  },
  "owners": {
    "audit-core": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py",
        "scripts/audit_core_synthetic_sender_lane.py",
        "scripts/t02-attended-window.py"
      ],
      "assertions": [
        "The database-lease exercise uses only synthetic load and proves health 200, readiness and requests fail retryably with 503, then recover without changing the audit-core pod UID or restart count.",
        "The approved load driver implements the exact start, probe, stop and summary contract and cannot expose credential values.",
        "The reboot exercise proves audit-core health, readiness, database integrity and the approved synthetic E2 path after dependencies recover."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    },
    "rapp-postgres": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py",
        "docs/audit-core-database-lease-approval.example.json",
        "scripts/t02-attended-window.py"
      ],
      "assertions": [
        "Lease selection aborts unless exactly one live handle exists below database/creds/audit-core-runtime and its issue time coheres with the ExternalSecret refresh.",
        "The action revokes only that exact lease handle; it never revokes the role prefix, an External Secrets parent lease, or another database consumer.",
        "Recovery uses ordinary ExternalSecret refresh and mounted-file reread, with no pod restart, database restore or credential value in evidence.",
        "After the coordinated reboot, the same platform-pg PVC and cluster identity return 1/1 Ready with ContinuousArchiving true and no re-bootstrap or in-place restore shortcut.",
        "The reboot hold point requires a fresh completed Barman backup and healthy WAL archiving before the host action."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    },
    "railiance-cluster": {
      "tasks": [
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "docs/openbao-reboot-snapshot-receipt.example.json"
      ],
      "assertions": [
        "Recovery is ordered host, node/k3s, CoreDNS and operators before application readiness; application lag is not treated as host failure.",
        "The exercise does not reinstall k3s, replace PVCs or alter firewall policy as a recovery shortcut.",
        "External Secrets stale-provider recovery is bounded to the documented controller reconciliation path and preserves value-safe evidence."
      ],
      "checks": [
        "focused-unit-tests",
        "node-reboot-preflight"
      ]
    },
    "railiance-infra": {
      "tasks": [
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "docs/openbao-reboot-snapshot-receipt.example.json"
      ],
      "assertions": [
        "An attended operator has independently verified provider-console access before the window and performs an ordinary reboot only.",
        "Host-return, access-recovery and abort/escalation ownership are explicit; no ad hoc firewall, operating-system or k3s reinstall is authorized.",
        "The reboot is gated on a current verified encrypted off-host OpenBao snapshot receipt and named recovery owners."
      ],
      "checks": [
        "focused-unit-tests",
        "node-reboot-preflight"
      ]
    },
    "railiance-platform": {
      "tasks": [
        "RAILIANCE-WP-0024-T02",
        "RAILIANCE-WP-0024-T03"
      ],
      "artifacts": [
        "docs/audit-core-database-lease-recovery.md",
        "docs/railiance01-coordinated-reboot.md",
        "scripts/audit-core-recovery-preflight.py",
        "scripts/audit-core-database-lease-recovery.py",
        "docs/audit-core-database-lease-approval.example.json",
        "docs/openbao-reboot-snapshot-receipt.example.json",
        "scripts/audit_core_synthetic_sender_lane.py",
        "scripts/t02-attended-window.py",
        "scripts/openbao-reboot-snapshot.py"
      ],
      "assertions": [
        "T02 remains gated on a named window, abort operator, exact owner receipts and a revision-pinned synthetic-load driver; repository access alone cannot revoke a lease.",
        "T02 revokes only the selected runtime handle, forces only the database ExternalSecret and records no credential values or OpenBao response bodies.",
        "T03 remains gated on a verified encrypted off-host OpenBao snapshot receipt, 2-of-3 Shamir quorum, provider-console access, all owner receipts and a final attended go/no-go.",
        "The platform owner preserves the mutation freeze and ordered OpenBao/ESO recovery boundary and does not initialize OpenBao, restore in place or restart audit-core as a shortcut."
      ],
      "checks": [
        "focused-unit-tests",
        "database-lease-preflight",
        "node-reboot-preflight"
      ]
    }
  },
  "artifact_sha256": {
    "docs/audit-core-database-lease-approval.example.json": "87e57e3290074508c6517938acf8c7fc1a75d977b8ff630f247a4ff5d2ee45c6",
    "docs/audit-core-database-lease-recovery.md": "8dfd3fb59c551df0346d2569674227bb2f4e763c3bf058453035591073e20794",
    "docs/openbao-reboot-snapshot-receipt.example.json": "b95903a3e1aacb607eecc3f0440f08e62480d09da47bd7ab96c3eb8814f2eaee",
    "docs/railiance01-coordinated-reboot.md": "975bd3167cd1c3da152fafc8bcf882fb15dade92a89f60e82495cf34201fc81b",
    "scripts/audit-core-database-lease-recovery.py": "332405cd6fce36d3df5588e7622065e3655eea0e4256766eb07c743349f29b17",
    "scripts/audit-core-recovery-preflight.py": "d870d7763fabb9d01f72c157f82419257fd1bf9c2705e1661a98022b1caa29ba",
    "scripts/audit_core_synthetic_sender_lane.py": "8a9c40cfdfd5cfe276bbf3ab79ecdf8e5f18cb85a2811423f54fa3808a4c57a4",
    "scripts/t02-attended-window.py": "c4531d2daf6b2658cf8e94c9761d9cfe6333cca646b1d1692103945144fd775d",
    "scripts/openbao-reboot-snapshot.py": "1370a40b75cfd89fe9cc60a9ba064414e6baa57349738fbb8bb26bc8804d96d8"
  }
}