railiance-platform/workplans/archived/260905-RPF-WP-0006-rapp-openbao-extraction-boundary.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
RPF-WP-0006	workplan	rapp-openbao extraction boundary	financials	railiance-platform	finished	codex	railiance	2026-07-25	2026-07-26	8d292bab-76dd-5ac3-b39d-6bc460ce27d7

RPF-WP-0006 - rapp-openbao extraction boundary

Goal

Prepare the first rapp-* extraction by separating the OpenBao workload package surface from the broader S3 platform ownership in railiance-platform.

This workplan follows the first-wave rapp-* order defined in /home/worsch/railiance-master/docs/rapp-first-wave-candidates.md.

Boundaries

This workplan may:

• identify which OpenBao assets belong to a future rapp-openbao
• record which OpenBao-related concerns remain platform-owned
• prepare the handoff contract between the future wrapper and S3 platform policy

It must not:

• weaken railiance-platform as the owner of secrets custody and policy
• move shared credential lane or approval machinery into the workload wrapper
• require a repo rename or live deployment change before the package boundary is clear

T01 - Separate package assets from platform-governance assets

id: RPF-WP-0006-T01
status: done
priority: high
state_hub_task_id: "5c0e5411-e47a-5a90-9005-b01762351c0a"

Classify the current OpenBao-related files into:

• workload package assets for rapp-openbao
• shared platform governance and policy that stays in railiance-platform

Done when the distinction is written against real file paths and current usage.

2026-07-25: Added docs/rapp-openbao-boundary.md with file-path classification for OpenBao package assets, split-before-move assets, and retained S3 governance material.

T02 - Define the first rapp-openbao move set

id: RPF-WP-0006-T02
status: done
priority: high
state_hub_task_id: "3e5f8893-d440-5ce5-a436-3f84edad2e7b"

Prepare the first move set for the wrapper, including likely candidates such as:

• Helm values and middleware for the OpenBao workload
• UI overlay wrapper assets
• workload-specific deploy/verify scripts
• workload-health and recovery runbooks

Done when the future wrapper has a concrete first file inventory.

2026-07-25: Recorded the first move set in docs/rapp-openbao-boundary.md, centered on Helm values, UI overlay assets, OpenBao deploy/verify helpers, and the matching Makefile targets.

T03 - Record the retained S3 platform responsibilities

id: RPF-WP-0006-T03
status: done
priority: high
state_hub_task_id: "9a6a2cd9-9306-5721-9652-85f007043c19"

Record what must remain in railiance-platform, including:

• runtime secret custody as a platform capability
• workload lane policy and approval flows
• cross-workload secret delivery conventions
• platform-wide operator guidance that is not OpenBao-package specific

Done when the wrapper cannot be mistaken for the new S3 ownership home.

2026-07-25: Recorded retained S3 responsibilities in docs/rapp-openbao-boundary.md, including platform-admin policy, workload KV lane governance, delegated automation, credential grants, and SSH signing.

T04 - Prepare the repo-creation handoff for rapp-openbao

id: RPF-WP-0006-T04
status: done
priority: medium
state_hub_task_id: "a276f76b-48a7-512c-b0f8-786225d88683"

Blocked on T01-T03 and the creation of the future rapp-openbao repo.

Prepare the minimal handoff needed to create the wrapper repo without breaking current operators or losing source-of-truth clarity inside railiance-platform.

Done when the future package extraction can start from a stable boundary.

2026-07-26: Added docs/rapp-openbao-compatibility-handoff.md to define the current migration-window split: rapp-openbao is now the canonical home for package-owned deploy/overlay/smoke assets, while railiance-platform retains bootstrap, policy, credential-lane governance, and authenticated verification. docs/rapp-openbao-boundary.md, docs/openbao.md, and SCOPE.md now point to that split explicitly, so current operators can keep using temporary platform copies without losing source-of-truth clarity.

Notes

This workplan is repo-local. The framework-level sequencing stays in railiance-master/workplans/RMASTER-WP-0017-rail-rapp-reef-repo-separation.md.