coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
railiance-platform/intakes/intakes.md
codex e7eb9db57e
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Has been cancelled
Details
CUST-WP-0075: tenant-engine sender seed helper; re-qualify RPF-WP-0035-T02/T08 
- scripts/tenant_engine_audit_core_sender_seed.py: silent attended row-7 seed
  for MASON-WP-0007-T05 (wrap-migrate technique, CAS 0, never overwrites,
  metadata-only --dry-run, documented exit codes), with offline fake-bao tests.
- Lane review doc with the exact founder sequence and the read-only ESO
  token-create can-i check for MASON-WP-0007-T06.
- RPF-WP-0035-T02: SECRETS-WP-0007-T04 is done; real blocker is live KeyCape
  registration and client custody of secrets-engine-openbao (blocked_on
  key-cape). Design stays proposed.
- RPF-WP-0035-T08: receiver rollout with evidence_kind already accepted
  2026-09-11; moved the misplaced D1 correction note here from T02.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
2026-10-03 08:28:32 +02:00

3.5 KiB
Raw Blame History

Intake records

RPF-IN-0001 — flex-auth → access-engine repository rename: confirm no live repository URL/path

id: RPF-IN-0001
kind: intake
title: "flex-auth → access-engine repository rename: confirm no live repository URL/path"
status: closed
origin: cross-repo
origin_ref: FLEX-WP-0020
priority: low
owner: railiance-platform
requested_by: flex-auth
description: >-
  flex-auth is renaming its repository coordinates to access-engine (old slug
  flex-auth, new slug access-engine; repository UUID
  fda8ad85-a7d7-4055-8f21-902a533e59df and Forge ID 42 unchanged; runtime and
  product names stay flex-auth per FLEX-DEC-2026-013). Required change here:
  confirm no live repository URL or path to flex-auth remains in this repo, and
  repoint any that does after flex-auth announces that access-engine resolves;
  retain product/runtime terminology. The live rename (FLEX-WP-0020-T06) has not
  happened. Record completion evidence here. Request message: b55a40cb-eb03-4972-a9bc-aac6e131a63e.
closed: '2026-09-30'
resolution: >-
  Repointed the one live coordinate (scripts/create-t03-approval-requests.py, /home/worsch/flex-auth/examples -> /home/worsch/access-engine/examples), commit d32baa9; file verified present. Runtime/product vocabulary retained.
state_hub_intake_id: "01a0f26d-0c87-791e-8cc6-8d09cd794160"

RPF-IN-0002 — tenant-engine audit-core sender token: ESO Kubernetes-auth policy and role

id: RPF-IN-0002
kind: intake
title: "tenant-engine audit-core sender token: ESO Kubernetes-auth policy and role"
status: open
origin: cross-repo
origin_ref: TEN-IN-0005
priority: medium
owner: railiance-platform
requested_by: tenant-engine
description: >-
  Declared 2026-10-03 (founder-approved ops-mason plan
  tenant-engine-audit-core-sender-projection, rows 2-3):
  openbao/policies/workload-kv-read-tenant-engine-audit-core-sender-eso.hcl and
  the attended apply script scripts/openbao-tenant-engine-audit-core-sender-eso-attended.sh
  (policy + role tenant-engine-audit-core-sender-eso; SA tenant-engine/tenant-engine-eso,
  audience openbao, 15m ttl/max/explicit max, no default policy). Not applied.
  Open: attended apply, then the founder-attended KV seed (plan row 7).
  No RBAC change needed here (see message).
  2026-10-03 (CUST-WP-0075): row-7 seed helper scripts/tenant_engine_audit_core_sender_seed.py
  (silent, CAS 0, never overwrites, metadata-only --dry-run) and lane review
  docs/credential-lane-designs/tenant-engine-audit-core-sender-seed.md added; not run.
state_hub_intake_id: "01a0fedd-7af5-7126-a263-647d438b068d"

RPF-IN-0003 — npm publish lane for @coulomb/testdrive-jsui (coulomb Forgejo registry)

id: RPF-IN-0003
kind: intake
title: "npm publish lane for @coulomb/testdrive-jsui (coulomb Forgejo registry)"
status: open
origin: cross-repo
origin_ref: MARKITECT-WP-0002-T07
priority: medium
owner: railiance-platform
requested_by: markitect-main
description: >-
  Request for a governed publish-token lane (catalog entry, OpenBao path, read
  policy) for @coulomb/testdrive-jsui on the coulomb Forgejo npm registry, scoped
  to the coulomb tenant, plus an optional separate read/install token id. Model:
  whynot-design-npm-publish (CCR-2026-0001), which is bound to @whynot/design and
  cannot be reused. Publishing stays operator-approved and manual; no secret value
  requested. Request message: e5ac57f9-850a-4a8f-bbae-6c2fdac4b58e.
  Open: CCR draft and approval, then catalog id reply. Overlaps the governed npm
  migration gate in RPF-WP-0035.
state_hub_intake_id: "01a0fedd-7d19-76de-8857-59409393b2b0"