railiance-platform/workplans/RPF-WP-0051-informed-decision-requester-workload-delivery.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	origin	origin_ref	state_hub_workstream_id
RPF-WP-0051	workplan	Prepare and admit informed-decision requester workload delivery	financials	railiance-platform	finished	codex	platform-services	2026-10-04	2026-10-05	implementation	routed	RPF-WP-0050-T03; INFD-WP-0005-T05; cd811073-d6db-41cf-8a57-10df0b360eab	a27c47bc-4b0d-513b-bfb2-1eb404fde5a9

The founder selected existing batched attended custody and delegated relevance selection for the 2026-10-04 10:00 Europe/Berlin preparation window, then directed platform to continue. This work owns the new workload reader for existing requester custody. Existing issuer registration and applied CCR-2026-0026/0027 are preserved. Private listener, TokenReview transport, runtime OIDC exchange, submitter admission and live intake rollout remain separately owned.

Prepare exact workload reader and owner review bundle

id: RPF-WP-0051-T01
status: done
priority: high
state_hub_task_id: "3de19f19-d18a-5714-858e-db8dc05e44ca"

Allocate proposed CCR-2026-0032; render exact-path policy and prospective Kubernetes-auth role, namespace-restricted ESO, dedicated auth ServiceAccount and read-only review-pod mount proposal. Keep the bundle outside all active GitOps rendering. Validate the actual source bundle and record its digests; preparation supplies no credentials, admitted identity or native receipt.

2026-10-04: Prepared and validated actual proposed CCR-2026-0032 and generator input, canonical exact-path policy, prospective auth payload, namespace-restricted ESO, dedicated auth ServiceAccount and required read-only mount proposal. Added silent attended metadata child with reviewed-digest/status/binding/envelope gates, both-object preflight, conflict refusal, missing-only writes and readback. Ten focused helper tests, fourteen scaffold regressions and seven window regressions pass; actual bundle checks verify path/namespace/TTL/projection/annotation limits and proposed-state refusal. Separate INFD-WP-0005-T05 decision checklist maps the CCR/lane/receipt contract and remains NOT READY. No live action or issuer change.

Obtain exact owner runtime and binding acceptance

id: RPF-WP-0051-T02
status: done
priority: high
state_hub_task_id: "dfc17e0a-9f63-5a97-b87e-13bd3a8325d6"

Review docs/credential-lane-designs/informed-decision-requester-workload.md against INFD-WP-0005-T05 and its owner dependency contract. Confirm ESO token creation authority for the exact ServiceAccount. A draft identity is not an owner acceptance. Retain exact immutable runtime/config references and a bounded positive/negative/rotation/revocation proof plan before promotion.

2026-10-04: Founder authorized the prepared owner coordination requests. Sent request 2c1507b2-b361-4ef9-b5d4-3245014c7c52 to informed-decision on preparation thread f84637fa-2355-4971-a2dc-7f1fd01710a8, reviewing source commit 6b91d510395215d178d60ee8884e7fc00930a0cf. It carries the design approval and asks for exact binding/mount/runtime/verification ownership and remaining native evidence. Hub creation receipt is retained; owner acceptance is still outstanding.

2026-10-04 owner-return review: source binding/mount acceptance and rotating RequesterTokenProvider/compose_intake implementation are delivered at eb9614c2677c7f07c9d78eee7543f95f329d2c83; exact-primary source receipt is f06b7e9c53d3477f1e690ed8259f2eaab3661f91. Replies 17bcfb39 and d304e328 and informed-decision/docs/requester-workload-owner-review.md retain 37 focused owner tests and remaining process/transport/publication gaps. Platform's explicit SubjectAccessReview of the actual controller confirms TokenRequest permission for the namespace without minting a token. T02 waits only on independent owner source readiness, not its entire live task (which needs platform delivery). Native custody/delivery acceptance remains T03. Plan moved to blocked after completing available local preparation; concrete requirements/reopen conditions are in this window's dependency-requirements.md.

Apply and accept the scoped workload delivery

id: RPF-WP-0051-T03
status: done
priority: high
depends_on: [RPF-WP-0051-T02]
needs_human: false
decision_id: "0d6792b6-59e4-4fa0-887a-c4e51ea8e131"
state_hub_task_id: "abbe62c9-8520-563a-9f8a-e12b5209af77"

The founder approves the exact new reader, then runs the reviewed contained metadata child in their terminal. Apply only the new policy/role; do not seed, rotate or reapply historical requester custody. Promote ESO/runtime through their actual owner deployment paths after diff/server dry-run and resource checks. Accept delivery, exact token-policy/identity/TTL, sibling/list denial, create-only exchange and cleanup/revocation receipts. Revoke this reader on abort without touching the issuer or historical verifier/attended-reader lanes.

2026-10-04 founder design decision: Bernd answered "I approve" after review of the exact new delivery boundary, namespace-level trust and credential persistence beyond reader-token lifetime. Design approval for owner integration is recorded in CCR-2026-0032 and the lane contract. Owner binding/runtime acceptance and the separate concrete live go remain; no repeated design decision is required unless scope materially changes. The broader INFD-WP-0005-T05 decision remains open for runtime/listener acceptance and deployment. No credential action occurred.

Exact live delivery approval — 2026-10-04

Founder answered "I approve" to the concrete CCR-2026-0032 requester delivery following informed-decision c084600 release review. Source/runtime acceptance closes T02: private listener, CA-verified TokenReview, requester exchange and separate audience tokens are composed; immutable service 2768bd1 and worker 410fb6b passed recorded tests/scans. Approved CCR retains only the existing path, exact ESO identity, audience openbao, 900-second limits and read-only projection. The metadata child still requires the founder terminal OIDC/MFA. Native claims, delivery, negative proofs and revocation remain unproven under T03. No broader cutover or issuer rotation approval is inferred.

Attended child failure and bounded repair — 2026-10-04

Founder reported Warden exit 11; the local audit confirms child_failed. This does not prove that metadata stayed unchanged or that revocation succeeded. The installed bao binary against a synthetic HTTP 404 reproduces a helper bug: it emits exact path-specific No value found, not Code: 404. Updated handling accepts only the exact read diagnostic with exit 2 and empty stdout; denials, wrong paths and other failures refuse. Real installed-CLI tests cover missing objects, both writes/readbacks and an idempotent repeat without another write.

Each child now retains only fixed phase/exit metadata in docs/evidence/requester-metadata/*.json and remains silent. Twelve focused tests pass. The approved CCR and permissions are unchanged. A fresh attended attempt will compare both objects before any missing-only write and record its phase. Native delivery remains pending; do not mark the earlier attempt successful.

Native delivery result and required amendment — 2026-10-04

Founder reported exit 0 and helper receipt confirms metadata_verified. Created the reviewed dedicated manual ArgoCD application/project and synced three delivery objects from 4332c39 after diff/server dry-run. Corrected the draft audience field to serviceAccountRef.audiences using the installed ESO schema. Node IP and CPU headroom checked (3445m/4000m); no workload rollout or image change occurred.

ArgoCD sync succeeded; ClusterSecretStore and ExternalSecret are not Ready. Bounded condition inspection confirms 403 on auth/token/lookup-self. Existing ESO readers include self lookup/read and revoke/update, omitted by this packet. Prepared only that amendment and an exact-predecessor policy migration in the silent helper; 14 tests pass. CCR returns to proposed for changed capabilities, retaining original approval/application history. T03 stays waiting for amendment approval and fresh attended execution. Evidence: 2026-10-04-requester-delivery.json.

Founder explicitly approved lookup-self/read and revoke-self/update. Amended CCR approved and exact helper source/digest validated offline. Only fresh attended execution and native delivery proofs remain for this amendment; no renewed permission request is needed within this scope.

Native scoped delivery proven — 2026-10-04

Attended amendment exit 0 and metadata_verified receipt retained. After refresh, ArgoCD Synced, ClusterSecretStore Valid and ExternalSecret SecretSynced. Safe annotation helper confirms no duplicate credential annotation. Temporary native workloads proved exact identity/policy and TTL/max bounds; wrong namespace, ServiceAccount and audience refused; sibling GET and parent LIST refused. Projection is 0440 and equals the exact authorized KV field without emitting it.

Native exchange exposed requester client_secret_post incompatibility. Fixed informed-decision at 03f18d8 to use KeyCape client_secret_basic with form-encoded credential halves; image 804d89fb passes 664 tests/1 skipped, 13 container checks and zero HIGH/CRITICAL scan findings. With the service's exact Traefik HTTPS peer, native signed create-only exchange and approve/read/consume refusals all pass. The test reader self-revoked and post-revoke lookup fails; all eight temporary verification objects are removed. CCR is applied; actual review Deployment mount and cutover acceptance remain T03. Issuer rotation stays separately governed, not inferred from unchanged-file projection or callback unit tests.

Receiving service acceptance — 2026-10-05

The approved schema-5 service is live. Its actual receiving pod mounts the requester field read-only at 0440 and completes the pinned, signed create-only KeyCape exchange. Native intake created approval 22b30fe7-c565-46f2-8193-d8875975ad9e and retained its exact binding receipt. Public/private isolation, wrong caller and crossed-audience checks pass. No credential value was emitted.

Initial workload delivery is complete. Residual RPF-IN-0004 owns the separately governed issuer rotation and changed-projection/predecessor-rejection proof; this cutover neither performs nor authorizes rotation. Human acceptance of the decision product stays with INFD-WP-0007-T07 / STATE-WP-0096-T03.