coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/.custodian-brief.md
custodian-sync 211393a714
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
chore(consistency): sync task status from DB [auto] 
Updated by fix-consistency on 2026-09-21:
  - update .custodian-brief.md for railiance-platform

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
2026-09-21 19:20:27 +02:00

5.2 KiB
Raw Blame History

Custodian Brief — railiance-platform

Domain: financials
Last synced: 2026-09-21 17:20 UTC
State Hub: http://127.0.0.1:8000 (adjust if running on a remote machine)

Active Workstreams

Retract public OpenBao listener behind operator-only access

Progress: 2/3 done | workplan_id: 6dda6039-295e-5cac-aef6-3183c3218649

Open tasks:

  • ► T03 — Complete the attended operator cutover 8850d742

Onboard rapp-policy-nexus to the ArgoCD production lane

Progress: 0/5 done | workplan_id: ec41a4bd-df18-5b07-9b63-ccb80d9f001c

Open tasks:

  • ! Agree where policy-nexus's manifests live 49143c5e
  • ! Prepare the Application and the dry-run evidence 2afb1aac
  • ! Adopt policy-nexus (live, founder go-ahead) 8638fa73
  • · Confirm ArgoCD actually reconciles on railiance01 d6a7a480
  • · Declare the platform's own direct-apply gap 91431560

ArgoCD phase B: adopt the four existing Applications on railiance01

Progress: 2/8 done | workplan_id: 98140775-3b9a-5cf9-9af6-722502d487dc

Open tasks:

  • ! Adopt issue-core (from rapp-issue-core) 0e619658
  • ! Adopt external-secrets (highest risk) 4ca54868
  • ! Turn the root back to the production lane 844ff115
  • ► Adopt openbao-secretstore (lowest risk) 6d5fc801
  • ► Adopt target-revenue d418068a
  • · Plan phase C: retire coulombcore's ArgoCD 55d1382f

Move openbao-activity-core and openbao-email-connect off expired static tokens to Kubernetes auth

Progress: 0/6 done | workplan_id: 0edc6426-9cc8-5bbe-88ea-c27d9862d96e

Open tasks:

  • ! T01 OpenBao roles and policies (founder, admin credential) 766ec8d9
  • ! T03 Apply the ServiceAccounts and switch the two stores (founder go-ahead) ea84219a
  • ! T04 Verify 8416600e
  • ! T05 Rollback (only if T03/T04 fails) 6bccc229
  • ! T06 Retire the two static-token Secrets f56d7096
  • · T02 Confirm the declared manifests are the ones to apply 27819462

Close Forgejo primary backup coverage on Scaleway

Progress: 3/4 done | workplan_id: 7beec1a7-aa82-5a36-9a66-6b60008a2455

Open tasks:

  • ► Establish primary full-archive delivery and application recovery a4807df0

Coordinate audit-core temporary custody and recovery exercises

Progress: 2/4 done | workplan_id: 88c4ef7f-0af8-580e-90dc-a2bae2675a4d

Open tasks:

  • ► T02 — Define the runtime database lease recovery exercise caba7fcd
  • ► T03 — Define the coordinated railiance01 reboot exercise 09cf4065

Coordinate KeyCape live Secret exposure recovery

Progress: 2/6 done | workplan_id: 038bc3c0-4492-5b91-95eb-ae515ca205df

Open tasks:

  • ! T04 — Execute the attended rotation dbf31617
  • ! T05 — Prove predecessor denial and close c4c23dfb
  • ► T03 — Collect exact owner acknowledgements e019c166
  • ► T06 — Publish the Railiance/OpenBao custody handoff 69326850

Close S3 service assurance and ownership gaps

Progress: 4/7 done | workplan_id: ca639c3d-3a87-5fa4-ad13-6f2e014b0c84

Open tasks:

  • ! Produce S3 signals and prove their delivery to the evidence owner 5351e0e4
  • ! Obtain acceptance for compatibility assets and derived-record cleanup 3b74f79c
  • ! Make backup freshness and recurring recovery evidence checkable d64446fb

Coordinate KeyCape live Secret exposure recovery

Progress: 3/6 done | workplan_id: b2c25a01-4a80-55c1-90cf-8538000f7e0e

Open tasks:

  • ! T03 — Collect exact owner acknowledgements 714ae011
  • ! T05 — Prove predecessor denial and close 9cb5fa67
  • ! T06 — Publish the Railiance/OpenBao custody handoff 3b9748c4

Implement reviewed credential lanes with separate owner gates

Progress: 3/8 done | workplan_id: 975db491-5412-5e27-8e34-14a2417bb039

Open tasks:

  • ! Accept and provision secrets-engine service JWT login e0c82ea9
  • ! Implement the platform operator-write CCR contract and Fluid lane f47e5bc5
  • ! Admit the separate approval client-side readers 68bff751
  • ! Dispose of the ungoverned whynot-design npm duplicate 0dd7c9a5
  • ► Admit the two factory audit-sender custody lanes 0ef52c26

Coordinate audit-core temporary custody and recovery exercises

Progress: 2/4 done | workplan_id: f4640325-e89c-591d-b58e-ec6b087900ac

Open tasks:

  • ! T02 — Define the runtime database lease recovery exercise fda4262a
  • ! T03 — Define the coordinated railiance01 reboot exercise ba729d18

Retract public OpenBao listener behind operator-only access

Progress: 2/3 done | workplan_id: 6f8a6cbc-c076-5f0a-ade2-281a7ec71360

Open tasks:

  • ! T03 — Complete the attended operator cutover 99f8b41f

Inbox Hygiene

Stale unread: 3 message(s) older than 3 day(s) — triage at session start. Missing thread_id: 1 unread message(s) lack supersession chains.

  • ! flex-auth: FLEX-WP-0020 handoff request (consumer) b55a40cb
  • ! grok: Re: RMASTER-WP-0020-T09: S3 public OpenBao listener retracted d071fcd7

MCP Orientation (when available)

If the state-hub MCP server is reachable, call: get_domain_summary("financials") This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.