coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/docs
History
codex f3ba7ca882
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Admit KeyCape approval-engine client custody paths and delivery 
Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the
field name is corrected to CLIENT_SECRET for the platform uppercase convention
and the CCR validator. Kubernetes delivery references are confirmed against the
live sso namespace. Attended authority is the governed openbao-platform-admin-login
lane, and the rollout is one attended window ordered after the Authelia issuer
precondition.

Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited
ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05.
Nothing is applied and no value exists: both CCRs remain proposed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
2026-09-08 14:53:32 +02:00
..
adr Implement S3 service assurance and admission checks 2026-09-05 11:43:55 +02:00
credential-lane-designs Admit KeyCape approval-engine client custody paths and delivery 2026-09-08 14:53:32 +02:00
evidence Verify telemetry essentials recovery from versioned Scaleway archive 2026-09-06 23:46:20 +02:00
apps-pg.md Finish RPF-WP-0019 apps-pg controls and recovery 2026-08-20 22:58:45 +02:00
argocd-gitops.md Document recovered ESO lanes and recognize explicit invalid-token responses 2026-09-05 18:51:40 +02:00
audit-core-database-lease-approval.example.json Harden WP-0024 recovery execution gates 2026-08-22 14:00:18 +02:00
audit-core-database-lease-recovery.md Correct WP-0024 lease selection contract 2026-08-22 14:46:12 +02:00
audit-core-whitehat-e2-credential-projection.md Add attended Whitehat E2 credential projection 2026-08-22 12:59:38 +02:00
backup-credential-recovery.md Record verified Forgejo Scaleway backup and recovery 2026-09-06 01:03:02 +02:00
backup-provider-coverage.md Verify full and essentials recovery and implement bounded retention tooling 2026-09-06 11:10:50 +02:00
backup-storage-tiers.md Verify full and essentials recovery and implement bounded retention tooling 2026-09-06 11:10:50 +02:00
cnpg-option-a-backup.md Include user-engine in offsite CNPG backups 2026-07-30 00:05:58 +02:00
coding-agent-openbao-identity.md Finish coding-agent high-risk boundary coverage 2026-08-22 10:03:54 +02:00
consumption-mode-enforcement.md Finish RAILIANCE-WP-0017 consumption-mode enforcement 2026-08-15 14:56:02 +02:00
credential-broker.md Adopt canonical flex-auth credential checks 2026-08-23 14:03:40 +02:00
credential-change-approval.md Close CCR drift and high-risk policy gaps 2026-08-21 01:29:28 +02:00
credential-lane-lifecycle-runbook.md Update Gitea prose to Forgejo; place forge; record ArgoCD as an open decision 2026-08-11 22:41:30 +02:00
custody-projection-contract.example.json Add versioned ephemeral custody lifecycle 2026-08-22 21:56:42 +02:00
ephemeral-custody-lifecycle.md Add versioned ephemeral custody lifecycle 2026-08-22 21:56:42 +02:00
eso-auth-recovery.md Document recovered ESO lanes and recognize explicit invalid-token responses 2026-09-05 18:51:40 +02:00
forgejo-backup.md Verify Scaleway primary recovery and distinguish secondary backup coverage 2026-09-06 00:34:43 +02:00
forgejo-package-prune.md Add failure-safe cluster image capture hook 2026-09-05 10:04:38 +02:00
keycape-exposure-rotation-approval.example.json Record final KeyCape recovery receipt 2026-08-23 14:51:50 +02:00
keycape-live-secret-exposure-recovery.md Record final KeyCape recovery receipt 2026-08-23 14:51:50 +02:00
net-kingdom-credential-custody-contract.md Draft NetKingdom credential custody contract 2026-08-23 21:48:29 +02:00
openbao-approved-automation-delegation.md Close delegated prod applier pilot 2026-07-01 23:34:13 +02:00
openbao-emergency-drill-evidence.example.json Add OpenBao emergency drill evidence validator 2026-06-02 00:08:17 +02:00
openbao-public-listener-transition.md feat(RAILIANCE-WP-0027): add contained callback role update 2026-08-23 14:37:01 +02:00
openbao-reboot-snapshot-receipt.example.json Harden WP-0024 recovery execution gates 2026-08-22 14:00:18 +02:00
openbao-restore-drill-evidence.example.json Add OpenBao restore evidence validator 2026-06-01 23:57:00 +02:00
openbao.md feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access 2026-08-23 12:50:23 +02:00
placement-policy.md Implement S3 service assurance and admission checks 2026-09-05 11:43:55 +02:00
platform-ownership-handoffs.md Review blocked platform obligations and archive completed ESO recovery 2026-09-05 21:16:53 +02:00
postgresql-ha.md Finish architecture-cleanup RAILIANCE-WP-0016 T05 2026-08-15 14:43:44 +02:00
put-backup-object-storage.md docs: how to add APPLICATION_ID for the backup bucket policy 2026-08-14 19:52:08 +02:00
railiance01-coordinated-reboot.md Harden WP-0024 recovery execution gates 2026-08-22 14:00:18 +02:00
rapp-credential-lane-binding.md retarget: CCR-2026-0012 is the general backup object-store lane 2026-08-14 19:19:56 +02:00
rapp-openbao-boundary.md Document rapp-openbao compatibility handoff 2026-07-26 10:39:40 +02:00
rapp-openbao-compatibility-handoff.md Document rapp-openbao compatibility handoff 2026-07-26 10:39:40 +02:00
rapp-platform-service-pattern.md Close RAILIANCE-WP-0015-T06 rapp credential-lane binding 2026-08-14 00:47:28 +02:00
rapp-postgres-boundary.md Broker audit-core dynamic database credentials 2026-08-10 19:36:30 +02:00
reuse-surface-runtime-secrets-rotation-runbook.md Add reuse-surface secrets rotation runbook (RAILIANCE-WP-0011-T04) 2026-07-08 00:01:21 +02:00
s3-consumer-interfaces.md Implement S3 service assurance and admission checks 2026-09-05 11:43:55 +02:00
service-assurance.md Validate OpenBao snapshot evidence and record assurance closure gates 2026-09-06 15:24:58 +02:00
tenancy-posture.md Finish RPF-WP-0019 apps-pg controls and recovery 2026-08-20 22:58:45 +02:00
WH-ENG-20260822-AUDIT-E2-03-custody-contract.json Approve audit E2 third custody contract 2026-08-22 23:30:07 +02:00
whynot-design-npm-publish-handoff.md Update Gitea prose to Forgejo; place forge; record ArgoCD as an open decision 2026-08-11 22:41:30 +02:00
workload-kv-access-lanes.md Document recovered ESO lanes and recognize explicit invalid-token responses 2026-09-05 18:51:40 +02:00
wp0024-owner-review-interface.md Add direct WP-0024 load driver handoff 2026-08-22 16:17:03 +02:00