93ac156adf
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
1.3 KiB
| id | type | title | domain | repo | status | owner | created | updated | flavor | origin | origin_ref | depends_on | related_repos | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RPF-WP-0055 | workplan | KeyCape client-secret rotation after first-generation lane acceptance | financials | railiance-platform | backlog | codex | 2026-10-10 | 2026-10-10 | residual | residual | RPF-WP-0054 |
|
5517b448-3721-55d8-b80d-d61e5e137089 |
Transferred from RPF-WP-0054-T07 before closing its first-generation lane. This is a separately scoped later capability, not a blocker of CAS-0 generation and not promoted demand. Do not implement unless demand or risk promotes it.
Design, admit and verify a coordinated rotation lane
id: RPF-WP-0055-T01
status: todo
priority: low
state_hub_task_id: "4b9c94fb-1251-5f12-b227-1d9d999cd8ed"
After one proven first-generation case run, design
keycape-client-secret-rotate: exact-path update with CAS = current version,
an attended window coordinated with ESO refresh and the KeyCape restart, and
rollback to the previous version. Obtain the independent owner contracts and
exact-action authorization before live changes. Verify the replacement in the
consumer, scoped delivery, cleanup/revocation and rollback; publish only
non-secret receipts. The existing create-only grant must not be widened merely
to perform this residual.