coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/workplans/RAILIANCE-WP-0012-rapp-openbao-extraction-boundary.md
codex 09c6e41caa
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Document rapp-openbao compatibility handoff
2026-07-26 10:39:40 +02:00

4.2 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated state_hub_workstream_id
RAILIANCE-WP-0012 workplan rapp-openbao extraction boundary financials railiance-platform finished codex railiance 2026-07-25 2026-07-26 6ec5f317-e6c6-48e8-a7d4-850c13541641

RAILIANCE-WP-0012 - rapp-openbao extraction boundary

Goal

Prepare the first rapp-* extraction by separating the OpenBao workload package surface from the broader S3 platform ownership in railiance-platform.

This workplan follows the first-wave rapp-* order defined in /home/worsch/railiance-master/docs/rapp-first-wave-candidates.md.

Boundaries

This workplan may:

  • identify which OpenBao assets belong to a future rapp-openbao
  • record which OpenBao-related concerns remain platform-owned
  • prepare the handoff contract between the future wrapper and S3 platform policy

It must not:

  • weaken railiance-platform as the owner of secrets custody and policy
  • move shared credential lane or approval machinery into the workload wrapper
  • require a repo rename or live deployment change before the package boundary is clear

T01 - Separate package assets from platform-governance assets

id: RAILIANCE-WP-0012-T01
status: done
priority: high
state_hub_task_id: "498a89e1-67e1-4860-8c73-cc38dd92083c"

Classify the current OpenBao-related files into:

  • workload package assets for rapp-openbao
  • shared platform governance and policy that stays in railiance-platform

Done when the distinction is written against real file paths and current usage.

2026-07-25: Added docs/rapp-openbao-boundary.md with file-path classification for OpenBao package assets, split-before-move assets, and retained S3 governance material.

T02 - Define the first rapp-openbao move set

id: RAILIANCE-WP-0012-T02
status: done
priority: high
state_hub_task_id: "67526f71-0220-45fb-ab9d-8cef5628257c"

Prepare the first move set for the wrapper, including likely candidates such as:

  • Helm values and middleware for the OpenBao workload
  • UI overlay wrapper assets
  • workload-specific deploy/verify scripts
  • workload-health and recovery runbooks

Done when the future wrapper has a concrete first file inventory.

2026-07-25: Recorded the first move set in docs/rapp-openbao-boundary.md, centered on Helm values, UI overlay assets, OpenBao deploy/verify helpers, and the matching Makefile targets.

T03 - Record the retained S3 platform responsibilities

id: RAILIANCE-WP-0012-T03
status: done
priority: high
state_hub_task_id: "30036060-85ec-4a24-a428-9f31dd58f853"

Record what must remain in railiance-platform, including:

  • runtime secret custody as a platform capability
  • workload lane policy and approval flows
  • cross-workload secret delivery conventions
  • platform-wide operator guidance that is not OpenBao-package specific

Done when the wrapper cannot be mistaken for the new S3 ownership home.

2026-07-25: Recorded retained S3 responsibilities in docs/rapp-openbao-boundary.md, including platform-admin policy, workload KV lane governance, delegated automation, credential grants, and SSH signing.

T04 - Prepare the repo-creation handoff for rapp-openbao

id: RAILIANCE-WP-0012-T04
status: done
priority: medium
state_hub_task_id: "25bf2d11-4a85-4259-9027-79768a23a06c"

Blocked on T01-T03 and the creation of the future rapp-openbao repo.

Prepare the minimal handoff needed to create the wrapper repo without breaking current operators or losing source-of-truth clarity inside railiance-platform.

Done when the future package extraction can start from a stable boundary.

2026-07-26: Added docs/rapp-openbao-compatibility-handoff.md to define the current migration-window split: rapp-openbao is now the canonical home for package-owned deploy/overlay/smoke assets, while railiance-platform retains bootstrap, policy, credential-lane governance, and authenticated verification. docs/rapp-openbao-boundary.md, docs/openbao.md, and SCOPE.md now point to that split explicitly, so current operators can keep using temporary platform copies without losing source-of-truth clarity.

Notes

This workplan is repo-local. The framework-level sequencing stays in railiance-master/workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md.