coulomb/reef-railiance
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish Knative reef admission workplan

Browse source
This commit is contained in:
codex 2026-07-26 23:17:08 +02:00
parent 55de6c936a
commit 7751e5f043
8 changed files with 178 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

19
workplans/REEF-RAILIANCE-WP-0002-knative-and-qonto-production-admission.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Admit rail-knative and rapp-qonto with production evidence"
domain: financials
repo: reef-railiance
status: active
status: finished
owner: codex
topic_slug: railiance
created: "2026-07-26"
@ -79,7 +79,7 @@ and previous-revision rollback passed. Public exposure remains disabled.
```task
id: REEF-RAILIANCE-WP-0002-T04
status: progress
status: cancel
priority: high
state_hub_task_id: "485e757b-6519-4f2e-a678-d66ef14206f5"
```
@ -92,11 +92,15 @@ failure evidence.
`rapp-qonto`. Baseline evidence keeps unmeasured runtime checks `unknown`; no
installed, verified, or production-approved state is claimed.
2026-07-26: The declared binding is retained without false promotion. Live
Qonto verification moved to `REEF-RAILIANCE-WP-0003` because identity,
restricted egress, and workload evidence are not yet established.
## T05 - Decide production residual risk
```task
id: REEF-RAILIANCE-WP-0002-T05
status: wait
status: done
priority: high
state_hub_task_id: "f1ac627d-1ec8-445b-acd9-a65eeb068d3c"
```
@ -105,14 +109,21 @@ Reserve human interaction for explicit acceptance or mitigation of the
single-server/shared-control-plane failure domain. Automated evidence must be
complete first.
Decision: do not accept the current failure domain for production. The
verified rail may operate privately for non-production verification. Reassess
only after workload gates pass or the failure domain is mitigated.
## T06 - Automate evidence freshness and drift
```task
id: REEF-RAILIANCE-WP-0002-T06
status: todo
status: done
priority: medium
state_hub_task_id: "82685f27-575e-4956-8c46-433a2ab2b9ea"
```
Make probes idempotent and suitable for scheduled reconciliation. Expired or
failed evidence must prevent false production-ready state.
2026-07-26: Added a deterministic freshness gate that fails stale evidence and
rejects production approval with any non-passing check or open residual risk.

63
workplans/REEF-RAILIANCE-WP-0003-rapp-qonto-production-gates.md Normal file
View file

@ -0,0 +1,63 @@
---
id: REEF-RAILIANCE-WP-0003
type: workplan
title: "Complete rapp-qonto production gates"
domain: financials
repo: reef-railiance
status: active
owner: codex
topic_slug: railiance
created: "2026-07-26"
updated: "2026-07-26"
state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
---
# REEF-RAILIANCE-WP-0003 - rapp-qonto production gates
## T01 - Verify workload identity and secret delivery
```task
id: REEF-RAILIANCE-WP-0003-T01
status: todo
priority: high
state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d"
```
Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane
without exposing credential values.
## T02 - Enforce restricted Qonto egress
```task
id: REEF-RAILIANCE-WP-0003-T02
status: todo
priority: high
state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
```
Implement and verify FQDN-aware policy or a controlled egress proxy. Do not
substitute unrestricted HTTPS.
## T03 - Deploy and verify rapp-qonto
```task
id: REEF-RAILIANCE-WP-0003-T03
status: wait
priority: high
state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad"
```
After T01 and T02, verify cold start, audit, revocation, dependency failure,
idempotency, and previous-revision rollback using machine-readable evidence.
## T04 - Reassess production failure-domain risk
```task
id: REEF-RAILIANCE-WP-0003-T04
status: wait
priority: high
state_hub_task_id: "9d0c1f61-0ed8-4d5c-b4c2-2578424ad3b4"
```
Production approval requires mitigation or explicit acceptance of the
single-node/shared-control-plane risk after all automated workload gates pass.