From 29428bb304a142551a684c4cc795197228f5930a Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 5 Sep 2026 18:11:41 +0200 Subject: [PATCH] Close live preflight signing and rotation acceptance Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883 --- WORK-RECORDS.md | 8 +++++++ ...88-preflight-signing-runtime-acceptance.md | 22 +++++++++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 0d6f990..0f47ff1 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -59,6 +59,8 @@ | workplan | STATE-WP-0084 | finished | — | workplans/STATE-WP-0084-forge-read-for-private-repositories.md | | workplan | STATE-WP-0085 | finished | — | workplans/STATE-WP-0085-repository-lineage-preserving-rename.md | | workplan | STATE-WP-0086 | finished | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md | +| workplan | STATE-WP-0087 | finished | — | workplans/STATE-WP-0087-bounded-repository-collection-projection.md | +| workplan | STATE-WP-0088 | finished | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md | | task | STATE-WP-ADHOC-2026-06-04-T01 | done | — | workplans/ADHOC-2026-06-04.md | | task | STATE-WP-ADHOC-2026-07-01-T01 | done | — | workplans/ADHOC-2026-07-01.md | | task | STATE-WP-ADHOC-2026-07-01-T02 | done | — | workplans/ADHOC-2026-07-01.md | @@ -293,6 +295,9 @@ | task | STATE-WP-0079-T04 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md | | task | STATE-WP-0079-T05 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md | | task | STATE-WP-0079-T06 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md | +| task | STATE-WP-0079-T07 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md | +| task | STATE-WP-0079-T08 | done | — | workplans/STATE-WP-0079-retirement-strangler.md | +| task | STATE-WP-0079-T09 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md | | task | STATE-WP-0080-T01 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md | | task | STATE-WP-0080-T02 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md | | task | STATE-WP-0080-T03 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md | @@ -339,3 +344,6 @@ | task | STATE-WP-0086-T01 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md | | task | STATE-WP-0086-T02 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md | | task | STATE-WP-0086-T03 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md | +| task | STATE-WP-0087-T01 | done | — | workplans/STATE-WP-0087-bounded-repository-collection-projection.md | +| task | STATE-WP-0088-T01 | done | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md | +| task | STATE-WP-0088-T02 | done | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md | diff --git a/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md b/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md index 4d602da..5f587e8 100644 --- a/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md +++ b/workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md @@ -4,7 +4,7 @@ type: workplan title: "Accept the platform preflight signing lane in the State Hub API" domain: infotech repo: state-hub -status: active +status: finished owner: codex topic_slug: infotech created: "2026-09-05" @@ -13,6 +13,8 @@ related: - RPF-WP-0035 - STATE-WP-0085 - FLEX-WP-0020 +quality_dod: DoD-Ok +quality_dod_note: "Live API-only signing and fenced CAS rotation accepted; predecessor signature denial and recovered primary health evidenced. No residual implementation work." quality_dor: DoR-Ok quality_dor_note: "Exact platform design and user-requested task reviewed against live primary; bounded API-only delivery and controlled-outage rotation fence." state_hub_workstream_id: "22f2d7dc-5766-5b09-9f18-12abd4b5512b" @@ -36,7 +38,7 @@ repository-rename API tests pass (13 tests). Platform owns CCR-2026-0015 and ESO ```task id: STATE-WP-0088-T02 -status: progress +status: done priority: high state_hub_task_id: "55b32d0d-d30a-50c2-bae0-d6e3a357e6d1" ``` @@ -51,3 +53,19 @@ wait ESO, restart and prove predecessor invalidation and forward recovery. Runbook: railiance-platform/docs/credential-lane-designs/state-hub-preflight-activation.md. No repository rename is in scope. Live completion is pending attended OpenBao OIDC/MFA; ambient session returned 403. + + +Completed 2026-09-05 under the user's instruction to lead activation from +railiance-platform. CCR-2026-0015 is active. Production chart commit `49e3182` +was fetched from Forge into ephemeral deployment storage; server dry-run changed +only the API Deployment. Helm revision 59 retained image `main-cdff3b7`. +One API replica matched the ESO key and signed preflight passed with zero +blockers. Every API pod then stopped; platform rotated CAS 1 to KV version 2; +ESO refreshed and one API replica recovered. New preflight passed, predecessor +failed specifically by signature, and primary health passed. MCP and shared env +Secret excluded from signing delivery. No repository rename executed. + +Evidence is owned by platform: +`railiance-platform/docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`. +Protected predecessor fixture removed after verification. No residual scope; +the consuming FLEX-WP-0020 cutover remains separately governed.