80793afe4f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
1.3 KiB
Signing activation readiness — RPF-WP-0035-T04
The user requested completion of T04. Concurrent session work landed platform
commit 5d28893 and prepared State Hub chart wiring and STATE-WP-0088. Avoid
overlapping live activation with that session; no credential mutation or API
outage was performed during this review.
Read-only SSH checks confirmed kube-system UID
a553c742-0115-43d4-99a4-a5ca56fe0786, one ready State Hub API replica, image
main-cdff3b7, and absence of ExternalSecret state-hub-rename-preflight.
The default workstation kubeconfig used localhost port 16443, whose listener
refused connection. The activation runbook now requires verified cluster access
before login, and the writer refuses a different cluster before OpenBao access
or key generation. A regression test covers this refusal.
Credential routing selected openbao-platform-admin-login, verdict
founder_required, identity act oidc_login. This requires attended operator
OIDC/MFA through the contained Warden envelope. It cannot be substituted with
root or workload authority. No new login was initiated while the other session's
activation ownership remained unconfirmed.
T04 remains in progress: live custody, ESO delivery, signed preflight, and fenced rotation/invalidation/recovery evidence remain outstanding.