2d79c2e4e5
Updated by fix-consistency on 2026-09-21: - update .custodian-brief.md for railiance-platform Assistant: claude-code Assistant-Model: opus Assistant-Process: 63291@bnt-lap001 Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
111 lines
4.6 KiB
Markdown
111 lines
4.6 KiB
Markdown
<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
|
|
# Custodian Brief — railiance-platform
|
|
|
|
**Domain:** financials
|
|
**Last synced:** 2026-09-21 17:15 UTC
|
|
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
|
|
|
## Active Workstreams
|
|
|
|
### Retract public OpenBao listener behind operator-only access
|
|
Progress: 2/3 done | workplan_id: `6dda6039-295e-5cac-aef6-3183c3218649`
|
|
|
|
**Open tasks:**
|
|
- ► T03 — Complete the attended operator cutover `8850d742`
|
|
|
|
### Close Forgejo primary backup coverage on Scaleway
|
|
Progress: 3/4 done | workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`
|
|
|
|
**Open tasks:**
|
|
- ► Establish primary full-archive delivery and application recovery `a4807df0`
|
|
|
|
### Onboard rapp-policy-nexus to the ArgoCD production lane
|
|
Progress: 0/5 done | workplan_id: `ec41a4bd-df18-5b07-9b63-ccb80d9f001c`
|
|
|
|
**Open tasks:**
|
|
- ! Agree where policy-nexus's manifests live `49143c5e`
|
|
- ! Prepare the Application and the dry-run evidence `2afb1aac`
|
|
- ! Adopt policy-nexus (live, founder go-ahead) `8638fa73`
|
|
- · Confirm ArgoCD actually reconciles on railiance01 `d6a7a480`
|
|
- · Declare the platform's own direct-apply gap `91431560`
|
|
|
|
### ArgoCD phase B: adopt the four existing Applications on railiance01
|
|
Progress: 2/8 done | workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
|
|
|
|
**Open tasks:**
|
|
- ! Adopt issue-core (from rapp-issue-core) `0e619658`
|
|
- ! Adopt external-secrets (highest risk) `4ca54868`
|
|
- ! Turn the root back to the production lane `844ff115`
|
|
- ► Adopt openbao-secretstore (lowest risk) `6d5fc801`
|
|
- ► Adopt target-revenue `d418068a`
|
|
- · Plan phase C: retire coulombcore's ArgoCD `55d1382f`
|
|
|
|
### Coordinate audit-core temporary custody and recovery exercises
|
|
Progress: 2/4 done | workplan_id: `88c4ef7f-0af8-580e-90dc-a2bae2675a4d`
|
|
|
|
**Open tasks:**
|
|
- ► T02 — Define the runtime database lease recovery exercise `caba7fcd`
|
|
- ► T03 — Define the coordinated railiance01 reboot exercise `09cf4065`
|
|
|
|
### Coordinate KeyCape live Secret exposure recovery
|
|
Progress: 2/6 done | workplan_id: `038bc3c0-4492-5b91-95eb-ae515ca205df`
|
|
|
|
**Open tasks:**
|
|
- ! T04 — Execute the attended rotation `dbf31617`
|
|
- ! T05 — Prove predecessor denial and close `c4c23dfb`
|
|
- ► T03 — Collect exact owner acknowledgements `e019c166`
|
|
- ► T06 — Publish the Railiance/OpenBao custody handoff `69326850`
|
|
|
|
### Close S3 service assurance and ownership gaps
|
|
Progress: 4/7 done | workplan_id: `ca639c3d-3a87-5fa4-ad13-6f2e014b0c84`
|
|
|
|
**Open tasks:**
|
|
- ! Produce S3 signals and prove their delivery to the evidence owner `5351e0e4`
|
|
- ! Obtain acceptance for compatibility assets and derived-record cleanup `3b74f79c`
|
|
- ! Make backup freshness and recurring recovery evidence checkable `d64446fb`
|
|
|
|
### Coordinate KeyCape live Secret exposure recovery
|
|
Progress: 3/6 done | workplan_id: `b2c25a01-4a80-55c1-90cf-8538000f7e0e`
|
|
|
|
**Open tasks:**
|
|
- ! T03 — Collect exact owner acknowledgements `714ae011`
|
|
- ! T05 — Prove predecessor denial and close `9cb5fa67`
|
|
- ! T06 — Publish the Railiance/OpenBao custody handoff `3b9748c4`
|
|
|
|
### Implement reviewed credential lanes with separate owner gates
|
|
Progress: 3/8 done | workplan_id: `975db491-5412-5e27-8e34-14a2417bb039`
|
|
|
|
**Open tasks:**
|
|
- ! Accept and provision secrets-engine service JWT login `e0c82ea9`
|
|
- ! Implement the platform operator-write CCR contract and Fluid lane `f47e5bc5`
|
|
- ! Admit the separate approval client-side readers `68bff751`
|
|
- ! Dispose of the ungoverned whynot-design npm duplicate `0dd7c9a5`
|
|
- ► Admit the two factory audit-sender custody lanes `0ef52c26`
|
|
|
|
### Coordinate audit-core temporary custody and recovery exercises
|
|
Progress: 2/4 done | workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac`
|
|
|
|
**Open tasks:**
|
|
- ! T02 — Define the runtime database lease recovery exercise `fda4262a`
|
|
- ! T03 — Define the coordinated railiance01 reboot exercise `ba729d18`
|
|
|
|
### Retract public OpenBao listener behind operator-only access
|
|
Progress: 2/3 done | workplan_id: `6f8a6cbc-c076-5f0a-ade2-281a7ec71360`
|
|
|
|
**Open tasks:**
|
|
- ! T03 — Complete the attended operator cutover `99f8b41f`
|
|
|
|
## Inbox Hygiene
|
|
|
|
**Stale unread:** 3 message(s) older than 3 day(s) — triage at session start.
|
|
**Missing thread_id:** 1 unread message(s) lack supersession chains.
|
|
- ! flex-auth: FLEX-WP-0020 handoff request (consumer) `b55a40cb`
|
|
- ! grok: Re: RMASTER-WP-0020-T09: S3 public OpenBao listener retracted `d071fcd7`
|
|
|
|
---
|
|
## MCP Orientation (when available)
|
|
|
|
If the state-hub MCP server is reachable, call:
|
|
`get_domain_summary("financials")`
|
|
This provides richer cross-domain context.
|
|
If the MCP call fails, use this file as your orientation source.
|