6a394c86de
Founder run: entry (2 versions) deleted, operators/nextcloud/backup unchanged, one-shot token revoked and policy deleted, no value read. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 469992@bnt-lap001 Assistant-Session: e4b8e420-df0a-441d-83ae-7f19130594d9
61 lines
2.6 KiB
Markdown
61 lines
2.6 KiB
Markdown
---
|
|
id: RPF-WP-ADHOC-2026-10-10
|
|
type: workplan
|
|
title: "Retire the deprecated operators/nextcloud credential"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: claude-code
|
|
topic_slug: railiance
|
|
created: "2026-10-10"
|
|
updated: "2026-10-10"
|
|
state_hub_workstream_id: "2d2c3bd2-d05b-5adc-9559-4d6bb360b751"
|
|
---
|
|
|
|
# RPF-WP-ADHOC-2026-10-10 — retire operators/nextcloud
|
|
|
|
## Delete the deprecated base entry, keep operators/nextcloud/backup
|
|
|
|
```task
|
|
id: RPF-WP-ADHOC-2026-10-10-T01
|
|
status: done
|
|
priority: low
|
|
state_hub_task_id: "d7b91134-13cf-55b8-9291-14efca9465d6"
|
|
```
|
|
|
|
The founder confirmed on 2026-10-10 that `operators/nextcloud` (the base entry)
|
|
is a deprecated credential to remove. The live backup account stays at
|
|
`operators/nextcloud/backup`. The delete cannot be done from the UI by design:
|
|
`operator-custody` is delete-free and `platform-admin` has no grant on the
|
|
`operators` mount (openbao/policies/operator-custody.hcl).
|
|
|
|
`scripts/operators_entry_retire.py` does it without granting anything standing.
|
|
As platform-admin it writes a one-shot policy (`read`/`delete` on
|
|
`operators/metadata/nextcloud`, `read` on the backup sibling's metadata,
|
|
`revoke-self`) and mints a 60s, 8-use orphan token holding only that policy. It
|
|
proves the entry and the sibling exist, then metadata-deletes the entry with that
|
|
token. It then proves the entry is absent and the sibling unchanged, revokes the
|
|
token and deletes the policy on every path. It prints nothing and reads no value.
|
|
7 offline tests.
|
|
|
|
```bash
|
|
cd ~/railiance-platform && git pull --ff-only
|
|
export BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200
|
|
unset BAO_TOKEN VAULT_TOKEN
|
|
W='warden access openbao-platform-admin-login --exec --'
|
|
$W python3 scripts/operators_entry_retire.py --dry-run --confirm 'RETIRE operators/nextcloud' --receipt ~/operators-nextcloud-dry.json
|
|
cat ~/operators-nextcloud-dry.json
|
|
$W python3 scripts/operators_entry_retire.py --confirm 'RETIRE operators/nextcloud' --receipt ~/operators-nextcloud-retire.json
|
|
cat ~/operators-nextcloud-retire.json
|
|
```
|
|
|
|
**Done when:** the receipt says `retired`, with `sibling_after` equal to
|
|
`sibling_before`, `token_revoked` and `policy_deleted` true; and ops-mason drops
|
|
`operators/nextcloud` from its custody descriptions.
|
|
|
|
2026-10-10 done: the founder ran the dry run and then the retirement. Outcome
|
|
`retired`: `operators/nextcloud` (2 versions) was deleted, and
|
|
`operators/nextcloud/backup` is unchanged (v2, 2 versions). The token was
|
|
revoked and the one-shot policy deleted; no value was read. Evidence:
|
|
`docs/evidence/2026-10-10-operators-nextcloud-retire.json`. ops-mason was told
|
|
to drop the entry from its custody descriptions.
|