From 0a4f4b9de6cc3cc30c753e9418fa3036ddc768a0 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 27 Jul 2026 02:08:54 +0200 Subject: [PATCH] Start Qonto workload identity gate --- WORK-RECORDS.md | 2 +- .../REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 21606ce..69dfc53 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -21,7 +21,7 @@ | task | REEF-RAILIANCE-WP-0002-T04 | cancel | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T05 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | | task | REEF-RAILIANCE-WP-0002-T06 | done | — | workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md | -| task | REEF-RAILIANCE-WP-0003-T01 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | +| task | REEF-RAILIANCE-WP-0003-T01 | progress | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T02 | todo | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T03 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | | task | REEF-RAILIANCE-WP-0003-T04 | wait | — | workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md | diff --git a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md index be4deb7..3d92dda 100644 --- a/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md +++ b/workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md @@ -18,7 +18,7 @@ state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d" ```task id: REEF-RAILIANCE-WP-0003-T01 -status: todo +status: progress priority: high state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" ``` @@ -26,6 +26,11 @@ state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d" Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane without exposing credential values. +2026-07-27: ops-mason surveyed live OpenBao state and produced reviewed plan +`rapp-qonto-openbao-kubernetes-lane`. It reuses the existing exact-scope Qonto +policy, replaces the draft static-token store with Kubernetes authentication, +and awaits the mandatory structural-access approval before build. + ## T02 - Enforce restricted Qonto egress ```task