railiance-platform/argocd/platform-addons
codex 1a6d83ace9 CUST-WP-0071-T05: default-deny egress, hub delivery env, widen platform-addons project
Founder decision 2026-10-21 (T05 follow-up): custodian-assessment gets
default-deny ingress/egress with egress only to DNS, kube-apiserver
(10.43.0.1:443, 92.205.62.239:6443), Prometheus 9090 and State Hub 8000.
The railiance-platform-addons AppProject source admits PersistentVolumeClaim
and NetworkPolicy (bootstrap is hand-applied; not applied here). CronJob gets
STATE_HUB_URL. Re-vendored the-custodian sources at 9edd315. Still suspended
and unregistered.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
2026-10-21 08:41:37 +02:00
..
bao-notice RPF-WP-0047: HSTS for bao.coulomb.social only (no includeSubDomains) 2026-09-24 00:56:22 +02:00
custodian-agents RPF-WP-0062-T01: custodian agent observer identity manifests (CUST-WP-0073-T02) 2026-10-20 13:38:05 +02:00
custodian-allocation-review CUST-WP-0071-T05: default-deny egress, hub delivery env, widen platform-addons project 2026-10-21 08:41:37 +02:00
eso-token-renewer RPF-WP-0046-T04: adopt eso-token-renewer Application (pinned b2ebe10); close RPF-WP-0045 2026-09-23 20:17:42 +02:00
informed-decision-requester Align requester audience projection with installed ESO schema 2026-10-04 23:18:33 +02:00
openbao-secretstore CCR-2026-0031: core-hub Forgejo source store and ExternalSecret, applied on railiance01 2026-10-03 10:11:38 +02:00
secret-annotation-guard docs(security): record verified annotation guard and approved orphan cleanup 2026-09-28 18:14:34 +02:00