9f83e426c7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883
4.8 KiB
| id | type | title | domain | repo | status | owner | created | updated | related | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| RPF-WP-0035 | workplan | Implement reviewed credential lanes with separate owner gates | financials | railiance-platform | blocked | codex | 2026-09-05 | 2026-09-05 |
|
Credential lane implementation
One S3 queue for three designed lanes; each task keeps its own approval, execution and closure boundary. This replaces the implementation tasks in the three completed design workplans, not the designs themselves. No approval is inherited by consolidation. INTENT binding: secure custody, dependable delivery, stable consumer interfaces. Incident custody remains in RPF-WP-0027/0029.
Consolidate completed designs and owner dependencies
id: RPF-WP-0035-T01
status: done
priority: medium
Completed 2026-09-05. Preserved the three designs under
docs/credential-lane-designs/, identified native owner responsibilities and
linked each superseded task below. Owners have not been sent new requests and
no new external acceptance is claimed. STATE-WP-0085-T09 is already done;
the signing dependency belongs to the proposed FLEX-WP-0020-T05 cutover.
Accept and provision secrets-engine service JWT login
id: RPF-WP-0035-T02
status: wait
priority: high
Supersedes RPF-WP-0032-T02. Design:
docs/credential-lane-designs/secrets-engine-service-jwt.md.
Platform owns the exact JWT mount/role/policy, effective-policy negative tests and a metadata-only custody receipt. KeyCape owns issuer/JWKS and service registration (KEY-WP-0009); secrets-engine owns service authentication and authority consumption (SECRETS-WP-0008-T06, SECRETS-WP-0007-T04).
Unblock: confirmed HTTPS issuer/JWKS, exact claims and audience, consumer readiness, approved source and attended apply authority. A service login does not grant lane mutation authority. Do not build another identity provider or lifecycle engine here.
Done when: approved exact role succeeds for the intended service, wrong issuer/audience/subject/claims and unrelated secret access fail, bounded TTL and revocation are proven, the consumer explicitly opts into the verified contract, and rollback/cleanup receipts contain no secret material.
Implement the platform operator-write CCR contract and Fluid lane
id: RPF-WP-0035-T03
status: wait
priority: high
Supersedes RPF-WP-0033-T02. Design:
docs/credential-lane-designs/fluid-telegram-operator-kv.md.
Platform owns the per-path capability schema/validator, exact OpenBao policy and accepted custody coordinates. MASON-WP-0005 owns construction coordination and engine integration; KeyCape/NetKingdom own OIDC/MFA and group membership; FT-WP-0002 owns client CAS, prefix correction, output containment and Telegram application acceptance. Retain the existing read-only CCR semantics.
Unblock: accept tenant/path and per-entry field/capability matrix; confirm actual group/assurance and callbacks, reviewed construction contract and writer authority. Contract review can proceed without a live credential; the final schema cannot be treated as accepted solely because a draft exists.
Done when: validation rejects broad/unsupported grants, the consumer proves CAS=0 first-write behavior and no value output, approved identities can perform only the exact matrix, negative/expiry/revocation checks pass, custody is seeded through the separate writer, and the verified route has a safe handoff receipt. The unattended adapter remains a separate demand and gets no operator session.
Accept the needed signing lane and deliver it to the owning runtime
id: RPF-WP-0035-T04
status: wait
priority: medium
Supersedes RPF-WP-0034-T02. Design:
docs/credential-lane-designs/state-hub-preflight-signing.md.
Platform owns signing-key custody, exact read policy/role and scoped delivery acceptance. State Hub owns API chart/env wiring, all-replica rotation fencing and health. FLEX-WP-0020-T05 owns the rename preflight/cutover dependency; STATE-WP-0085-T09's adoption-plan delivery is already complete.
Unblock: State Hub/repo-manager and the consuming migration owner confirm that this transitional State Hub lane is still needed during retirement; record the target runtime, namespace/SA/auth audience and an executable rotation fence, plus approved writer and deployment window. Do not broaden the lane into a general repository-rename authority or provision for a stale demand.
Done when: protected one-time generation, API-only ESO delivery, negative access checks and a non-mutating signed preflight pass; every API replica uses the accepted version; rotation/invalidation and recovery are evidenced. No repository rename is part of S3 lane acceptance. If demand is withdrawn, record the owning decision and cancel this task explicitly rather than provision it.