coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/.custodian-brief.md
codex b06d1f0b37 build: adopt staged records and retain reviewed orientation snapshot 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
2026-10-19 13:30:55 +02:00

9 KiB
Raw Blame History

Custodian Brief — railiance-platform

Domain: financials
Last synced: 2026-10-18 10:49 UTC
State Hub: http://127.0.0.1:8000 (adjust if running on a remote machine)

Active Workstreams

Implement Platform bindings for the browser SecurityCase successor

Progress: 1/4 done | workplan_id: 43110f82-ef9f-5a46-a305-f0e287b7b226

Open tasks:

  • ► T01 — Bind the broker to reviewed acknowledged type sources afec2053
  • · T03 — Implement mint, guarded destruction and authenticated evidence b5d73ec6
  • · T04 — Implement and admit the delivery lane and capability 84f8b0a4

Prepare the exact seven private-source reader for reuse-surface

Progress: 4/5 done | workplan_id: b55a8aec-7457-563b-990b-4a55ca04d2f6

Open tasks:

  • ! Rotate or revoke dedicated seven-source reader within 90 days f0780e75

Coordinate audit-core temporary custody and recovery exercises

Progress: 3/4 done | workplan_id: f4640325-e89c-591d-b58e-ec6b087900ac

Open tasks:

  • ! T03 — Define the coordinated railiance01 reboot exercise ba729d18 (wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)

Self-service CCR intake: clients file and progress CCRs without a platform worker

Progress: 4/5 done | workplan_id: bad0cc9b-e8ad-572b-8d0d-fb3adb208b4a

Open tasks:

  • ! T05 — Client documentation and first self-service CCR 27797fa5

Admit hourly receiver cadence and exact Qonto collector custody

Progress: 3/4 done | workplan_id: d57eeafb-c406-5e1e-841c-5d1288aacabf

Open tasks:

  • ► Collect actual producer and independent observer acceptance 7d8e5315

Let the hub-writer caller prove its own reach and pick the workload role in the OpenBao UI

Progress: 3/4 done | workplan_id: 04f7c4aa-0a24-5d61-994d-2487ca6bfb91

Open tasks:

  • ► Deploy the overlay 94cdfd1c

Coordinate KeyCape live Secret exposure recovery

Progress: 4/6 done | workplan_id: b2c25a01-4a80-55c1-90cf-8538000f7e0e

Open tasks:

  • ! T03 — Collect exact owner acknowledgements 714ae011 (wait: Owner work first: NetKingdom packages the complete resolver sequence as one receipt-producing command; then it enters the attended-window checklist (D1 standing rule).)
  • ! T06 — Publish the Railiance/OpenBao custody handoff 3b9748c4 (wait: Owner work first: the OpenBao owner confirms mount/path/fields and writer/reader authority and publishes the non-secret routing receipt; the handoff enters the attended window only when a command exists.)

Admit the Playwright pilot and establish scoped consumer group access

Progress: 5/6 done | workplan_id: 31933d08-c877-5fda-aff9-6220c3705c92

Open tasks:

  • ! Connect platform identities and prove managed consumer operation a82762eb (wait: User admitted all identified platform humans and coding agents; their supported Kubernetes authentication/group-mapping route remains unimplemented.)

ArgoCD phase B: adopt the four existing Applications on railiance01

Progress: 5/8 done | workplan_id: 98140775-3b9a-5cf9-9af6-722502d487dc

Open tasks:

  • ! Adopt issue-core (from rapp-issue-core) 0e619658
  • ! Adopt external-secrets (highest risk) 4ca54868 (wait: Ordered D2 adoption: issue-core T04 must provide automated Argo health/diff and private/authenticated smoke proof; target-revenue T05 is already proven. No further founder approval is required.)
  • ! Turn the root back to the production lane 844ff115 (wait: Restore prune/selfHeal once T03-T06 have automated proof; no further founder go-ahead (D2).)

Onboard rapp-policy-nexus to the ArgoCD production lane

Progress: 3/5 done | workplan_id: ec41a4bd-df18-5b07-9b63-ccb80d9f001c

Open tasks:

  • ! Adopt policy-nexus (live, founder go-ahead) 8638fa73 (wait: Merge approved by D2; runs once T03 diff and root automation (RPF-WP-0044-T07) are proven.)
  • ! Prepare the Application and the dry-run evidence 2afb1aac (wait: Steps 1 and 3 done 2026-10-11 (docs/evidence/2026-10-11-policy-nexus-adoption-readonly-precheck.json, no stop condition). Step 2 render diff needs the railiance-apps values path from RAPP-POLICY-NEXUS-WP-0002-T02; agents can run it read-only via the k3s tunnel.)

Close Forgejo primary backup coverage on Scaleway

Progress: 3/4 done | workplan_id: 7beec1a7-aa82-5a36-9a66-6b60008a2455

Open tasks:

  • ! Establish primary full-archive delivery and application recovery a4807df0 (wait: Durable scheduled caller, verified inventory and quota/retention gates remain open; September 15 prohibits expiration and scheduled secondary cutover.)

Close S3 service assurance and ownership gaps

Progress: 4/7 done | workplan_id: ca639c3d-3a87-5fa4-ad13-6f2e014b0c84

Open tasks:

  • ! Make backup freshness and recurring recovery evidence checkable d64446fb (wait: D2 accepts the activity-core scheduling role; ACTIVITY-WP-0042 must supply the implemented bounded scheduler and scoped custody/execution proof before recurring backup/restore work can execute. No new founder go-ahead is required.)
  • ! Produce S3 signals and prove their delivery to the evidence owner 5351e0e4 (wait: Needs a concrete receiving contract from railiance-telemetry (RTEL-WP-0002) before health transport is accepted; unmonitored state retained meanwhile.)
  • ! Obtain acceptance for compatibility assets and derived-record cleanup 3b74f79c (wait: Owner-ready handoffs to railiance-forge, rapp-openbao and the ArgoCD bootstrap owner await acceptance; S3 custody contracts stay here until then.)

Adopt activity-core application runtime into railiance01 GitOps

Progress: 2/3 done | workplan_id: b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54

Open tasks:

  • ! Observe adoption and enforce bounded promotion readiness 63b44949

Implement reviewed credential lanes with separate owner gates

Progress: 7/13 done | workplan_id: 975db491-5412-5e27-8e34-14a2417bb039

Open tasks:

  • ! Accept and provision secrets-engine service JWT login e0c82ea9 (wait: Agent work, not a human gate: claim refusals (KEY-WP-0039-T02 probe) and capabilities-self deny, then ops-mason MASON-WP-0009-T05.)
  • ! Implement the platform operator-write CCR contract and Fluid lane f47e5bc5 (wait: Founder session done 2026-10-09; waits on ops-mason verification (MASON-WP-0005-T05) and the FT-WP-0002 owner salt CAS probe.)
  • ! Dispose of the ungoverned whynot-design npm duplicate 0dd7c9a5 (wait: Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish.)
  • ! Admit the two factory audit-sender custody lanes 0ef52c26 (wait: Approved conditionally (ab85ae8a, standing change rule): executes once independent archive readback and the interim bearer revocation receipt exist; owner work with audit-core.)
  • ! Retire the approval-engine-operator client delivery and custody (CCR-2026-0018) af2d4dba (wait: Blue lane under the standing change rule (removing access, with reviewed order, rollback and receipts): executes once approval-engine confirms there is no presenter. No founder window needed.)
  • ► Implement and prove the separately approved task execution entitlement 914bf383

Coordinate KeyCape live Secret exposure recovery

Progress: 4/6 done | workplan_id: 038bc3c0-4492-5b91-95eb-ae515ca205df

Open tasks:

  • ! T03 — Collect exact owner acknowledgements e019c166 (wait: Canonical RPF-WP-0027-T03: complete platform custody acknowledgements remain missing.)
  • ! T06 — Publish the Railiance/OpenBao custody handoff 69326850 (wait: Canonical RPF-WP-0027-T06: complete field/auth/expiry/handoff contract absent; September 15 operator block remains in force.)

Coordinate audit-core temporary custody and recovery exercises

Progress: 2/4 done | workplan_id: 88c4ef7f-0af8-580e-90dc-a2bae2675a4d

Open tasks:

  • ! T02 — Define the runtime database lease recovery exercise caba7fcd (wait: Canonical RPF-WP-0015-T02: approved sender identity, fresh bounded attended window, named abort operator and live recovery receipt required.)
  • ! T03 — Define the coordinated railiance01 reboot exercise 09cf4065 (wait: Canonical RPF-WP-0015-T03: fresh outage approval, off-host snapshot, quorum/access evidence and owner execution required.)

Retract public OpenBao listener behind operator-only access

Progress: 2/3 done | workplan_id: 6f8a6cbc-c076-5f0a-ade2-281a7ec71360

Open tasks:

  • ! T03 — Complete the attended operator cutover 99f8b41f

Inbox Hygiene

Stale unread: 14 message(s) older than 3 day(s) — triage at session start. Missing thread_id: 15 unread message(s) lack supersession chains.

MCP Orientation (when available)

If the state-hub MCP server is reachable, call: get_domain_summary("financials") This provides richer cross-domain context. If the MCP call fails, use this file as your orientation source.