4a284f0a3b
Founder direction 2026-10-06 and ops-mason plan keycape-secrets-engine-openbao-client-custody (658cdbc, MASON-WP-0009): the client secret lives only in OpenBao. - CCR-2026-0033: consumer file and secrets-engine D1-D4 removed; KV metadata declared (cas_required, max_versions=2, delete_version_after=0s, custom_metadata); target.domain infotech; live order and roll-forward rollback revised; status stays proposed. - New sibling CCR-2026-0034 + policy: attended OIDC operator reader on auth/netkingdom, read data path + revoke-self only, 5m/4 uses, no default policy, bound groups=net-kingdom-admins and /assurance/level=aal2 (KeyCape 7d96ee4). Proposed, bound claims unconfirmed (founder item for both readers). - credential-change.py: OIDC roles carry token_max_ttl/explicit_max_ttl/no_default_policy/ num_uses/type and bound_claims_type (string only); token_revoke_self policy option; validated openbao.kv_metadata. Tests added. - Custody child: consumer write and check-secret-file removed; cas=0 create / --rotate cas=<current>; compare-before-write metadata put; refusals unchanged. - Founder runbook (keycape/founder-runbook.md), window docs, RPF-WP-0035-T09 (waits on A1/A2/A3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 132360@bnt-lap001 Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b |
||
|---|---|---|
| .. | ||
| archived | ||
| .gitkeep | ||
| README.md | ||
| RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | ||
| RPF-WP-0025-openbao-operator-only-access.md | ||
| RPF-WP-0027-keycape-live-secret-exposure-recovery.md | ||
| RPF-WP-0029-backup-credential-default-removal.md | ||
| RPF-WP-0035-credential-lane-implementation.md | ||
| RPF-WP-0036-platform-service-assurance.md | ||
| RPF-WP-0038-forgejo-scaleway-primary-coverage.md | ||
| RPF-WP-0039-vergabe-demo-company-database.md | ||
| RPF-WP-0040-keycape-factor-credential-custody.md | ||
| RPF-WP-0041-state-hub-105m-not-provisioning.md | ||
| RPF-WP-0042-informed-decision-sitting-requester.md | ||
| RPF-WP-0043-policy-nexus-argocd-onboarding.md | ||
| RPF-WP-0044-argocd-phase-b-adopt-existing-applications.md | ||
| RPF-WP-0045-eso-kubernetes-auth-activity-core-email-connect.md | ||
| RPF-WP-0046-eso-database-token-renewal.md | ||
| RPF-WP-0047-bao-coulomb-social-notice-page.md | ||
| RPF-WP-0048-activity-core-gitops-adoption.md | ||
| RPF-WP-0049-platform-root-custody-record-delivery.md | ||
| RPF-WP-0050-attended-provisioning-preparation.md | ||
| RPF-WP-0051-informed-decision-requester-workload-delivery.md | ||
Current platform work
Reviewed September 27, 2026. Eight workplans remain blocked with 23 waiting
tasks. No active, ready or proposed source workplan remains. Completed work
retains its IDs and managed UUIDs, including plans under archived/.
| Workplan | Remaining tasks | Next dependency |
|---|---|---|
| RPF-WP-0015 | T02/T03 | Fresh recovery windows, synthetic sender/abort owner and snapshot/quorum/access evidence |
| RPF-WP-0027 | T03/T06 | Complete historical resolver custody/routing contract; T05 closed from September 23 operator disposition and owner receipt |
| RPF-WP-0035 | T02/T03/T06/T07/T08 | Exact service registration/custody, human memo acceptance, reader/disablement returns, governed npm migration and formerly-valid audit-bearer revocation proof |
| RPF-WP-0036 | T03/T04/T06 | Current recovery/cadence/custody evidence, Q2 production delivery and owner/projection acceptance; local archive adapter implemented |
| RPF-WP-0038 | T04 | Durable scheduled caller, canonical verified inventory and quota/retention gates; September 15 cutover/expiration hold persists |
| RPF-WP-0043 | T02/T03/T04 | Cross-owner chart/values agreement, committed values and source access, zero-diff proof and adoption |
| RPF-WP-0044 | T03–T08 | Per-app promotion gates, issue-core credentials/ownership, target-revenue hook acceptance, ESO adoption/observation and readable old-controller inventory |
| RPF-WP-0048 | T02 | Healthy observation through September 28 at 16:06:22 Berlin plus bounded authenticated release broker/admission and rollback proof |
Latest review and evidence. No new task or workplan was created. Existing completed credential reviews, delivery, retention projection and rotations are not reopened by these waits.
Source files are authoritative. The generated brief still contains retired aliases and stale statuses; do not recreate work from it. Routine synchronization uses the exact-commit Repo Manager receipt described in AGENTS.md. Legacy alias repair remains the scoped owner dependency in WP-0036-T06.