codex
e4af2a1d10
RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
70 lines
2.1 KiB
Markdown
70 lines
2.1 KiB
Markdown
---
|
|
id: RPF-WP-0014
|
|
type: workplan
|
|
title: "Hub-core candidate credential lanes"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-08-21"
|
|
updated: "2026-08-22"
|
|
related:
|
|
- CORE-WP-0010
|
|
- RAPPCOREHUB-WP-0002
|
|
- RAPP-POSTGRES-WP-0004
|
|
state_hub_workstream_id: "ab1c2145-528b-50af-b36e-161f28325848"
|
|
---
|
|
|
|
# Hub-core candidate credential lanes
|
|
|
|
## Extend exact-scope policy and projections
|
|
|
|
```task
|
|
id: RPF-WP-0014-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "b30ba596-14c8-54c2-92fc-530bbbc965a8"
|
|
```
|
|
|
|
Add only `database/creds/hub-core-runtime` and
|
|
`database/creds/hub-core-migration` to the existing namespace-limited Core Hub
|
|
database store, with separate five-minute ExternalSecret projections.
|
|
|
|
## Activate and verify production lanes
|
|
|
|
```task
|
|
id: RPF-WP-0014-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "68766bac-d032-57f9-84cd-a8725cbe0ada"
|
|
```
|
|
|
|
Apply the reviewed policy and projections after rapp-postgres creates the
|
|
roles. Verify store validity, SecretSynced status, role separation, and lease
|
|
rotation without reading or logging values.
|
|
|
|
Completed 2026-08-22. The exact policy, projections, SecretSynced state, role
|
|
separation, and production runtime/migration handoff passed on 2026-08-21. A
|
|
subsequent scheduled five-minute reconciliation advanced both target Secret
|
|
resource versions. After projected-volume propagation, the candidate watcher
|
|
replaced only its application child while the pod UID remained stable,
|
|
readiness stayed true, and the container restart count stayed zero. No
|
|
credential value was read or logged. Evidence:
|
|
`docs/evidence/core-hub-private-shadow-2026-08-21.md`.
|
|
|
|
## Hand off the private candidate
|
|
|
|
```task
|
|
id: RPF-WP-0014-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "0af38f5b-7f59-5e14-8046-646c6fe526cd"
|
|
```
|
|
|
|
Confirm both Secret metadata objects are ready, then hand the candidate
|
|
migration and rollout gate back to `RAPPCOREHUB-WP-0002-T03`.
|
|
|
|
Completed 2026-08-21. Both projected Secret metadata objects were Ready, the
|
|
migration completed, and the candidate advanced through all route groups to
|
|
production authority without exposing credential values.
|