coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RPF-WP-0006-rapp-openbao-extraction-boundary.md
codex e4af2a1d10
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): migrate active workplans off the retired RAILIANCE-WP prefix 
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix
registry already lists it retired). Three repositories independently used one
number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here,
a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This
repository also carried two files both numbered 0016.

Active workplans move to the successor prefix and are renumbered from 0001 in
historical order. Archived workplans keep their historical identifiers.

Projection UUIDs are re-derived from the new canonical ids. Records already
registered under the old identifiers leave orphaned hub rows behind; that debt
is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands.

Refs CUST-WP-0068-T03

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 22:58:35 +02:00

4.2 KiB
Raw Permalink Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
RPF-WP-0006 workplan rapp-openbao extraction boundary financials railiance-platform finished codex railiance 2026-07-25 2026-07-26 8d292bab-76dd-5ac3-b39d-6bc460ce27d7

RPF-WP-0006 - rapp-openbao extraction boundary

Goal

Prepare the first rapp-* extraction by separating the OpenBao workload package surface from the broader S3 platform ownership in railiance-platform.

This workplan follows the first-wave rapp-* order defined in /home/worsch/railiance-master/docs/rapp-first-wave-candidates.md.

Boundaries

This workplan may:

  • identify which OpenBao assets belong to a future rapp-openbao
  • record which OpenBao-related concerns remain platform-owned
  • prepare the handoff contract between the future wrapper and S3 platform policy

It must not:

  • weaken railiance-platform as the owner of secrets custody and policy
  • move shared credential lane or approval machinery into the workload wrapper
  • require a repo rename or live deployment change before the package boundary is clear

T01 - Separate package assets from platform-governance assets

id: RPF-WP-0006-T01
status: done
priority: high
state_hub_task_id: "5c0e5411-e47a-5a90-9005-b01762351c0a"

Classify the current OpenBao-related files into:

  • workload package assets for rapp-openbao
  • shared platform governance and policy that stays in railiance-platform

Done when the distinction is written against real file paths and current usage.

2026-07-25: Added docs/rapp-openbao-boundary.md with file-path classification for OpenBao package assets, split-before-move assets, and retained S3 governance material.

T02 - Define the first rapp-openbao move set

id: RPF-WP-0006-T02
status: done
priority: high
state_hub_task_id: "3e5f8893-d440-5ce5-a436-3f84edad2e7b"

Prepare the first move set for the wrapper, including likely candidates such as:

  • Helm values and middleware for the OpenBao workload
  • UI overlay wrapper assets
  • workload-specific deploy/verify scripts
  • workload-health and recovery runbooks

Done when the future wrapper has a concrete first file inventory.

2026-07-25: Recorded the first move set in docs/rapp-openbao-boundary.md, centered on Helm values, UI overlay assets, OpenBao deploy/verify helpers, and the matching Makefile targets.

T03 - Record the retained S3 platform responsibilities

id: RPF-WP-0006-T03
status: done
priority: high
state_hub_task_id: "9a6a2cd9-9306-5721-9652-85f007043c19"

Record what must remain in railiance-platform, including:

  • runtime secret custody as a platform capability
  • workload lane policy and approval flows
  • cross-workload secret delivery conventions
  • platform-wide operator guidance that is not OpenBao-package specific

Done when the wrapper cannot be mistaken for the new S3 ownership home.

2026-07-25: Recorded retained S3 responsibilities in docs/rapp-openbao-boundary.md, including platform-admin policy, workload KV lane governance, delegated automation, credential grants, and SSH signing.

T04 - Prepare the repo-creation handoff for rapp-openbao

id: RPF-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "a276f76b-48a7-512c-b0f8-786225d88683"

Blocked on T01-T03 and the creation of the future rapp-openbao repo.

Prepare the minimal handoff needed to create the wrapper repo without breaking current operators or losing source-of-truth clarity inside railiance-platform.

Done when the future package extraction can start from a stable boundary.

2026-07-26: Added docs/rapp-openbao-compatibility-handoff.md to define the current migration-window split: rapp-openbao is now the canonical home for package-owned deploy/overlay/smoke assets, while railiance-platform retains bootstrap, policy, credential-lane governance, and authenticated verification. docs/rapp-openbao-boundary.md, docs/openbao.md, and SCOPE.md now point to that split explicitly, so current operators can keep using temporary platform copies without losing source-of-truth clarity.

Notes

This workplan is repo-local. The framework-level sequencing stays in railiance-master/workplans/RMASTER-WP-0017-rail-rapp-reef-repo-separation.md.