fd2f808cd8
Source gate passes; predecessor proofs stale/missing smoke; live diff and store baseline blocked on agent cluster read access after CUST-WP-0073. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 527080@bnt-lap001 Assistant-Session: 5a0e864a-67be-4605-a77a-16635f7dd292
67 lines
3.2 KiB
JSON
67 lines
3.2 KiB
JSON
{
|
|
"schema": "railiance-platform.eso-adoption-prep/v1",
|
|
"task": "RPF-WP-0044-T06",
|
|
"captured_at": "2026-10-21",
|
|
"approval_ref": "89f1058f-33bc-47a8-8a49-0b44d426c67e",
|
|
"readiness_gate": {
|
|
"receipt": "readiness-r1.json",
|
|
"source_ready": true,
|
|
"missing_or_invalid": [
|
|
"RPF-WP-0044-T04",
|
|
"RPF-WP-0044-T05"
|
|
],
|
|
"T04_reason": "docs/evidence/2026-10-20-issue-core-verify-live.json lacks authenticated_ingest_status=201 and authenticated_close_status=200 (verify-live ran without --smoke) and is older than the 300 s freshness window",
|
|
"T05_reason": "gate requires a fresh (<=300 s) argocd-workload-adoption-proof/v1 receipt; the 2026-10-11 receipt is stale. A fresh read-only run (scripts/workload_adoption_proof.py --live) failed because ssh railiance01 (user tegwick) can no longer read /etc/rancher/k3s/k3s.yaml after the CUST-WP-0073 cutover",
|
|
"smoke_not_run": "verify-live --smoke creates and closes a Forgejo issue; not read-only, so not run under the preparation-only boundary"
|
|
},
|
|
"offline_render": {
|
|
"chart": "external-secrets 0.16.1",
|
|
"values_source": "argocd/railiance01/drafts/external-secrets.application.yaml",
|
|
"render_sha256": "55236645afc9f2d9d376c28e73aed70bd31727d0e6f166664b3ebd568d5f136f",
|
|
"objects": 39,
|
|
"kinds": {
|
|
"ServiceAccount": 3,
|
|
"Secret": 1,
|
|
"CustomResourceDefinition": 20,
|
|
"ClusterRole": 5,
|
|
"ClusterRoleBinding": 2,
|
|
"Role": 1,
|
|
"RoleBinding": 1,
|
|
"Service": 1,
|
|
"Deployment": 3,
|
|
"ValidatingWebhookConfiguration": 2
|
|
},
|
|
"crds": 20,
|
|
"crds_prune_delete_protected": 20,
|
|
"store_or_externalsecret_objects_rendered": [],
|
|
"kinds_with_cabundle": [
|
|
"CustomResourceDefinition/clustergenerators.generators.external-secrets.io",
|
|
"CustomResourceDefinition/clustersecretstores.external-secrets.io",
|
|
"CustomResourceDefinition/secretstores.external-secrets.io",
|
|
"CustomResourceDefinition/vaultdynamicsecrets.generators.external-secrets.io",
|
|
"CustomResourceDefinition/webhooks.generators.external-secrets.io"
|
|
],
|
|
"credential_kind_objects_rendered": [
|
|
"external-secrets-webhook"
|
|
],
|
|
"notes": [
|
|
"20/20 CRDs carry argocd.argoproj.io/sync-options Prune=false,Delete=false",
|
|
"no ClusterSecretStore/SecretStore/ExternalSecret objects rendered, so adoption cannot delete or replace any store or ExternalSecret",
|
|
"the one rendered credential-kind object is the empty webhook certificate holder (metadata only, no data key); server-side apply does not take ownership of the cert-controller-injected data",
|
|
"ValidatingWebhookConfigurations declare no caBundle and no CRD declares a conversion webhook (caBundle hits are schema text); no ignoreDifferences added because no diff has shown drift yet"
|
|
]
|
|
},
|
|
"draft_policy": {
|
|
"automated": false,
|
|
"finalizers": false,
|
|
"ServerSideApply": true,
|
|
"Force_or_Replace": false,
|
|
"prune_in_sync_command": false
|
|
},
|
|
"not_done_live": {
|
|
"fresh_native_client_side_diff": "blocked: no agent kube read path on railiance01 (tegwick kubeconfig removed; custodian-agent observer role has no CRD/RBAC/webhook/ESO read)",
|
|
"store_baseline": "blocked: same reason; expected ValidationFailed: openbao-activity-core, openbao-email-connect"
|
|
},
|
|
"native_mutation": false,
|
|
"secret_values_observed_by_agent": false
|
|
}
|