railiance-platform/registry/capabilities/capability.railiance.platform-services.md

id	name	summary	owner	status	domain	tags	maturity	external_evidence	discovery	availability	relations	evidence	consumer_guidance	promotion_history
capability.railiance.platform-services	Secret custody and platform data services	OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.	railiance-platform	draft	financials	railiance platform secrets postgres security netkingdom framework-reuse	discovery availability current target confidence rationale D3 D4 medium SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, scoped to shared cluster services (PostgreSQL HA, Valkey, secrets, identity integration, object storage). current target confidence rationale A2 A3 medium Source interface assessed 2026-10-14: OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts. Availability describes the delivery form, not production acceptance. Package ownership is split to rapp repos; caches and object services are demand-led.	completeness reliability level confidence basis satisfied_expectations broken_expectations out_of_scope_expectations C1 low scope_vs_intent_and_consumer_expectations OpenBao/Vault secret-management apply/verify scripting credential-change tooling level confidence basis known_reliability_risks R0 low consumer_quality_signals no top-level packaging; scripts/tools have no unified install path	intent includes excludes assumptions use_cases research_memos OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts Package ownership is split to rapp repos; caches and object services are demand-led U04: Protected operation obtains and consumes exact human approval before its side effect U05: Operator provisions and delivers a scoped workload credential through the approved owner lane U07: Owner inventories, rotates, revokes and detects exposure of credentials U10: Operator recovers identity, custody or data with independently held recovery material U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings	current_level target_level current_artifacts target_artifacts consumption_modes A2 A3 SCOPE.md docs/openbao.md CLI source	depends_on supports related_to capability.railiance.openbao-package capability.railiance.postgres-isolation-recovery capability.iam.key-cape capability.security.credential-lifecycle	documentation tests consumer_feedback bug_reports incidents SCOPE.md docs/openbao.md tests/	recommended_for not_recommended_for known_limitations Protected operation obtains and consumes exact human approval before its side effect Operator provisions and delivers a scoped workload credential through the approved owner lane Owner inventories, rotates, revokes and detects exposure of credentials Operator recovers identity, custody or data with independently held recovery material Platform owner deploys and rolls back a workload with explicit substrate and custody bindings Package ownership is split to rapp repos; caches and object services are demand-led Package ownership is split to rapp repos; caches and object services are demand-led 2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.

Secret custody and platform data services

OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.

Reuse boundary

Package ownership is split to rapp repos; caches and object services are demand-led.

Supported use cases

• U04: Protected operation obtains and consumes exact human approval before its side effect
• U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
• U07: Owner inventories, rotates, revokes and detects exposure of credentials
• U10: Operator recovers identity, custody or data with independently held recovery material
• U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings

Evidence and integration

• SCOPE.md
• docs/openbao.md

Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.