122 lines
3.7 KiB
Markdown
122 lines
3.7 KiB
Markdown
---
|
|
id: RAILIANCE-WP-0012
|
|
type: workplan
|
|
title: "rapp-openbao extraction boundary"
|
|
domain: financials
|
|
repo: railiance-platform
|
|
status: active
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-25"
|
|
updated: "2026-07-25"
|
|
state_hub_workstream_id: "6ec5f317-e6c6-48e8-a7d4-850c13541641"
|
|
---
|
|
|
|
# RAILIANCE-WP-0012 - rapp-openbao extraction boundary
|
|
|
|
## Goal
|
|
|
|
Prepare the first `rapp-*` extraction by separating the OpenBao workload package
|
|
surface from the broader S3 platform ownership in `railiance-platform`.
|
|
|
|
This workplan follows the first-wave `rapp-*` order defined in
|
|
`/home/worsch/railiance-master/docs/rapp-first-wave-candidates.md`.
|
|
|
|
## Boundaries
|
|
|
|
This workplan may:
|
|
|
|
- identify which OpenBao assets belong to a future `rapp-openbao`
|
|
- record which OpenBao-related concerns remain platform-owned
|
|
- prepare the handoff contract between the future wrapper and S3 platform policy
|
|
|
|
It must not:
|
|
|
|
- weaken `railiance-platform` as the owner of secrets custody and policy
|
|
- move shared credential lane or approval machinery into the workload wrapper
|
|
- require a repo rename or live deployment change before the package boundary is clear
|
|
|
|
## T01 - Separate package assets from platform-governance assets
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0012-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "498a89e1-67e1-4860-8c73-cc38dd92083c"
|
|
```
|
|
|
|
Classify the current OpenBao-related files into:
|
|
|
|
- workload package assets for `rapp-openbao`
|
|
- shared platform governance and policy that stays in `railiance-platform`
|
|
|
|
Done when the distinction is written against real file paths and current usage.
|
|
|
|
2026-07-25: Added `docs/rapp-openbao-boundary.md` with file-path classification
|
|
for OpenBao package assets, split-before-move assets, and retained S3
|
|
governance material.
|
|
|
|
## T02 - Define the first `rapp-openbao` move set
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0012-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "67526f71-0220-45fb-ab9d-8cef5628257c"
|
|
```
|
|
|
|
Prepare the first move set for the wrapper, including likely candidates such as:
|
|
|
|
- Helm values and middleware for the OpenBao workload
|
|
- UI overlay wrapper assets
|
|
- workload-specific deploy/verify scripts
|
|
- workload-health and recovery runbooks
|
|
|
|
Done when the future wrapper has a concrete first file inventory.
|
|
|
|
2026-07-25: Recorded the first move set in
|
|
`docs/rapp-openbao-boundary.md`, centered on Helm values, UI overlay assets,
|
|
OpenBao deploy/verify helpers, and the matching `Makefile` targets.
|
|
|
|
## T03 - Record the retained S3 platform responsibilities
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0012-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "30036060-85ec-4a24-a428-9f31dd58f853"
|
|
```
|
|
|
|
Record what must remain in `railiance-platform`, including:
|
|
|
|
- runtime secret custody as a platform capability
|
|
- workload lane policy and approval flows
|
|
- cross-workload secret delivery conventions
|
|
- platform-wide operator guidance that is not OpenBao-package specific
|
|
|
|
Done when the wrapper cannot be mistaken for the new S3 ownership home.
|
|
|
|
2026-07-25: Recorded retained S3 responsibilities in
|
|
`docs/rapp-openbao-boundary.md`, including platform-admin policy, workload KV
|
|
lane governance, delegated automation, credential grants, and SSH signing.
|
|
|
|
## T04 - Prepare the repo-creation handoff for `rapp-openbao`
|
|
|
|
```task
|
|
id: RAILIANCE-WP-0012-T04
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "25bf2d11-4a85-4259-9027-79768a23a06c"
|
|
```
|
|
|
|
Blocked on T01-T03 and the creation of the future `rapp-openbao` repo.
|
|
|
|
Prepare the minimal handoff needed to create the wrapper repo without breaking
|
|
current operators or losing source-of-truth clarity inside `railiance-platform`.
|
|
|
|
Done when the future package extraction can start from a stable boundary.
|
|
|
|
## Notes
|
|
|
|
This workplan is repo-local. The framework-level sequencing stays in
|
|
`railiance-master/workplans/RAILIANCE-WP-0017-rail-rapp-reef-repo-separation.md`.
|