coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/.custodian-brief.md
custodian-sync 1cc1b14488
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-10-08:
  - update .custodian-brief.md for railiance-platform

Assistant: grok
Assistant-Session: 01a11cdb-f9fe-7011-947c-936e72007e54
2026-10-08 21:29:20 +02:00

9.8 KiB
Raw Blame History

Custodian Brief — railiance-platform

Domain: financials
Last synced: 2026-10-08 19:29 UTC
State Hub: http://127.0.0.1:8000 (adjust if running on a remote machine)

Active Workstreams

Admit Coulomb paired archives and independent email-ledger recovery

Progress: 0/6 done | workplan_id: cb55e474-c7a5-5c6f-bd72-ce65f853e3e3

Open tasks:

  • ! T02 — Admit offsite prefix, retention and caller custody b06f1a44
  • ! T03 — Activate and verify retrieval and application recovery 871c14da
  • ! T05 — Admit the independent email-connect ledger archive caller 3f744ce6
  • ► T01 — Review and accept the paired backup execution identity ceb58abf
  • ► T06 — Prepare atomic pair custody and its admitted front door ce950b3c
  • · T04 — Bind monitoring and recurring recovery custody 687fd36d

Coordinate audit-core temporary custody and recovery exercises

Progress: 2/4 done | workplan_id: f4640325-e89c-591d-b58e-ec6b087900ac

Open tasks:

  • ! T02 — Define the runtime database lease recovery exercise fda4262a (wait: Value-safe lease revoke/expire exercise must be coordinated with rapp-postgres and audit-core.)
  • ! T03 — Define the coordinated railiance01 reboot exercise ba729d18 (wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)

ArgoCD phase B: adopt the four existing Applications on railiance01

Progress: 2/8 done | workplan_id: 98140775-3b9a-5cf9-9af6-722502d487dc

Open tasks:

  • ! Adopt openbao-secretstore (lowest risk) 6d5fc801 (wait: Adopted 2026-09-21; the follow-on step (issue-core adoption, then automation) waits on the founder's go-ahead.)
  • ! Adopt issue-core (from rapp-issue-core) 0e619658 (wait: Founder go-ahead plus rapp-issue-core's agreement (hub message) that ArgoCD owns production and make deploy stops being a production path.)
  • ! Adopt target-revenue d418068a (wait: Adopted 2026-09-21; remaining preconditions and the next step wait on the founder's go-ahead.)
  • ! Adopt external-secrets (highest risk) 4ca54868 (wait: Founder go-ahead for the ESO adoption after adding CRD Prune=false,Delete=false and re-running the diff.)
  • ! Turn the root back to the production lane 844ff115 (wait: Founder go-ahead to restore automated prune/selfHeal on railiance-apps-root once T03-T06 are proven.)
  • ! Plan phase C: retire coulombcore's ArgoCD 55d1382f (wait: Planning only; needs an operator read-only check of coulombcore's ArgoCD, outside agent session scope.)

Close Forgejo primary backup coverage on Scaleway

Progress: 3/4 done | workplan_id: 7beec1a7-aa82-5a36-9a66-6b60008a2455

Open tasks:

  • ! Establish primary full-archive delivery and application recovery a4807df0 (wait: Operator chooses the independent archive prefix and confirms retention/caller contract and bounded worker credential delivery before the primary archive retrieval.)

Coordinate KeyCape live Secret exposure recovery

Progress: 4/6 done | workplan_id: b2c25a01-4a80-55c1-90cf-8538000f7e0e

Open tasks:

  • ! T03 — Collect exact owner acknowledgements 714ae011 (wait: Attended resolver run: postchecks outstanding; NetKingdom asked to package the complete sequence as one receipt-producing command for the next attended session.)
  • ! T06 — Publish the Railiance/OpenBao custody handoff 3b9748c4 (wait: Platform/OpenBao owner must publish the non-secret routing receipt for both lanes through the attended handoff; values are never inferred.)

Close S3 service assurance and ownership gaps

Progress: 4/7 done | workplan_id: ca639c3d-3a87-5fa4-ad13-6f2e014b0c84

Open tasks:

  • ! Make backup freshness and recurring recovery evidence checkable d64446fb (wait: activity-core replied (not accepted yet): role acceptance is the founder decision ACTIVITY-WP-0042-T01 (D2); then ACTIVITY-WP-0042 bounded operation, S3 OpenBao credential route, repaired openbao-activity-core store and per-run approval-engine approval.)
  • ! Produce S3 signals and prove their delivery to the evidence owner 5351e0e4 (wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)
  • ! Obtain acceptance for compatibility assets and derived-record cleanup 3b74f79c (wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)

Adopt activity-core application runtime into railiance01 GitOps

Progress: 2/3 done | workplan_id: b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54

Open tasks:

  • ! Observe adoption and enforce bounded promotion readiness 63b44949 (wait: 24h soak after adoption, then founder confirmation of the scoped identity and checks before automated sync; ACTIVITY-WP-0041 owns publication and the promotion guard.)

Prepare generated attended windows and explicit value-custody choice

Progress: 3/4 done | workplan_id: 0c7e3b0c-1c36-568c-af51-b06f912a0f1d

Open tasks:

  • ! Bind a real dated window and owner receipt manifests 1ae5a6b8 (wait: Platform preparation and founder design choice are complete. Independent informed-decision runtime source/publication, KeyCape custody/registration/issuance, secrets-engine consumer custody coordinates and provider setup-link handoff remain; dependency-requirements.md names the exact owner deliveries.)

Implement reviewed credential lanes with separate owner gates

Progress: 3/9 done | workplan_id: 975db491-5412-5e27-8e34-14a2417bb039

Open tasks:

  • ! Accept and provision secrets-engine service JWT login e0c82ea9 (wait: KEY-WP-0037 now owns protected custody, real registration and native issuance. Platform issuer-reader source CCR-2026-0033 is prepared. secrets-engine must accept exact consumer host/file/delivery/rotation coordinates before the separate custody child is finalized; KeyCape exact-primary identity repair and separate live go remain.)
  • ! Implement the platform operator-write CCR contract and Fluid lane f47e5bc5 (wait: MASON-WP-0005-T02 source contract is done (ops-mason message 79570eb8). The attended policy/schema apply remains with the open provisioning decision.)
  • ! Admit the separate approval client-side readers 68bff751 (wait: INFD-WP-0001-T07/T08 terminal; remaining gate is human approval of the scoped delivery proof; front door stays non-resolvable.)
  • ! Dispose of the ungoverned whynot-design npm duplicate 0dd7c9a5 (wait: Founder HOLD (2026-09-21) on the legacy whynot-design npm pointer; custody disposition is an attended decision.)
  • ! Admit the two factory audit-sender custody lanes 0ef52c26 (wait: Provisioned and delivered 2026-09-11 (CCR-2026-0021/0022 applied); do not repeat. Receiver rollout with evidence_kind and native producer acceptance passed 2026-09-11. Remaining human acceptance: independent archive readback and revocation of the interim audit bearer tokens.)
  • ! Founder approval of the CCR-2026-0033 custody child 7c753be6 (wait: Waits for founder approvals: A1 ops-mason design (keycape-secrets-engine-openbao-client-custody, MASON-WP-0009); A2 revised CCR-2026-0033 plus sibling operator reader CCR-2026-0034 (platform-owner, key-cape-owner, net-kingdom-owner reviews; bound claims confirmed for both readers incl. groups=net-kingdom-admins and /assurance/level=aal2); A3 the exact custody-child decision id recorded in the CCR-2026-0033 review (not boundary decision 632a8893). secrets-engine D1-D4 are superseded (no consumer copy).)

Onboard rapp-policy-nexus to the ArgoCD production lane

Progress: 3/5 done | workplan_id: ec41a4bd-df18-5b07-9b63-ccb80d9f001c

Open tasks:

  • ! Adopt policy-nexus (live, founder go-ahead) 8638fa73 (wait: Founder go-ahead: the merge is a live production change (CONSTRUCT @ railiance-platform, activation=APPROVED); also needs the root automation restored in RPF-WP-0044-T07.)
  • ! Prepare the Application and the dry-run evidence 2afb1aac (wait: Draft is prepared. The attended read-only helm history / kubectl diff remains. This session did not touch the cluster.)

Coordinate KeyCape live Secret exposure recovery

Progress: 4/6 done | workplan_id: 038bc3c0-4492-5b91-95eb-ae515ca205df

Open tasks:

  • ! T03 — Collect exact owner acknowledgements e019c166 (wait: Canonical RPF-WP-0027-T03: complete platform custody acknowledgements remain missing.)
  • ! T06 — Publish the Railiance/OpenBao custody handoff 69326850 (wait: Canonical RPF-WP-0027-T06: complete field/auth/expiry/handoff contract absent; September 15 operator block remains in force.)

Coordinate audit-core temporary custody and recovery exercises

Progress: 2/4 done | workplan_id: 88c4ef7f-0af8-580e-90dc-a2bae2675a4d

Open tasks:

  • ! T02 — Define the runtime database lease recovery exercise caba7fcd (wait: Canonical RPF-WP-0015-T02: approved sender identity, fresh bounded attended window, named abort operator and live recovery receipt required.)
  • ! T03 — Define the coordinated railiance01 reboot exercise 09cf4065 (wait: Canonical RPF-WP-0015-T03: fresh outage approval, off-host snapshot, quorum/access evidence and owner execution required.)

Retract public OpenBao listener behind operator-only access

Progress: 2/3 done | workplan_id: 6f8a6cbc-c076-5f0a-ade2-281a7ec71360

Open tasks:

  • ! T03 — Complete the attended operator cutover 99f8b41f

Inbox Hygiene

Missing thread_id: 2 unread message(s) lack supersession chains.

MCP Orientation (when available)

If the state-hub MCP server is reachable, call: get_domain_summary("financials") This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.