68 lines
1.8 KiB
Markdown
68 lines
1.8 KiB
Markdown
---
|
|
id: REEF-RAILIANCE-WP-0003
|
|
type: workplan
|
|
title: "Complete rapp-qonto production gates"
|
|
domain: financials
|
|
repo: reef-railiance
|
|
status: active
|
|
owner: codex
|
|
topic_slug: railiance
|
|
created: "2026-07-26"
|
|
updated: "2026-07-26"
|
|
state_hub_workstream_id: "c3f9fbfd-3db1-4387-8b65-7d53ba57138d"
|
|
---
|
|
|
|
# REEF-RAILIANCE-WP-0003 - rapp-qonto production gates
|
|
|
|
## T01 - Verify workload identity and secret delivery
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0003-T01
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "de8a8e05-93f9-4082-bbb0-5b522179421d"
|
|
```
|
|
|
|
Establish the `rapp-qonto` identity and OpenBao-backed ExternalSecret lane
|
|
without exposing credential values.
|
|
|
|
2026-07-27: ops-mason surveyed live OpenBao state and produced reviewed plan
|
|
`rapp-qonto-openbao-kubernetes-lane`. It reuses the existing exact-scope Qonto
|
|
policy, replaces the draft static-token store with Kubernetes authentication,
|
|
and awaits the mandatory structural-access approval before build.
|
|
|
|
## T02 - Enforce restricted Qonto egress
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0003-T02
|
|
status: todo
|
|
priority: high
|
|
state_hub_task_id: "2a6742f1-6fcf-4164-b885-a7a9ea39521d"
|
|
```
|
|
|
|
Implement and verify FQDN-aware policy or a controlled egress proxy. Do not
|
|
substitute unrestricted HTTPS.
|
|
|
|
## T03 - Deploy and verify rapp-qonto
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0003-T03
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "ddf25c7b-23b0-4e67-8881-5d29fa71e9ad"
|
|
```
|
|
|
|
After T01 and T02, verify cold start, audit, revocation, dependency failure,
|
|
idempotency, and previous-revision rollback using machine-readable evidence.
|
|
|
|
## T04 - Reassess production failure-domain risk
|
|
|
|
```task
|
|
id: REEF-RAILIANCE-WP-0003-T04
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "9d0c1f61-0ed8-4d5c-b4c2-2578424ad3b4"
|
|
```
|
|
|
|
Production approval requires mitigation or explicit acceptance of the
|
|
single-node/shared-control-plane risk after all automated workload gates pass.
|