Close live preflight signing and rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

WORK-RECORDS.md

@@ -59,6 +59,8 @@
 | workplan | STATE-WP-0084 | finished | — | workplans/STATE-WP-0084-forge-read-for-private-repositories.md |
 | workplan | STATE-WP-0085 | finished | — | workplans/STATE-WP-0085-repository-lineage-preserving-rename.md |
 | workplan | STATE-WP-0086 | finished | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md |
+| workplan | STATE-WP-0087 | finished | — | workplans/STATE-WP-0087-bounded-repository-collection-projection.md |
+| workplan | STATE-WP-0088 | finished | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md |
 | task | STATE-WP-ADHOC-2026-06-04-T01 | done | — | workplans/ADHOC-2026-06-04.md |
 | task | STATE-WP-ADHOC-2026-07-01-T01 | done | — | workplans/ADHOC-2026-07-01.md |
 | task | STATE-WP-ADHOC-2026-07-01-T02 | done | — | workplans/ADHOC-2026-07-01.md |
@@ -293,6 +295,9 @@
 | task | STATE-WP-0079-T04 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md |
 | task | STATE-WP-0079-T05 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md |
 | task | STATE-WP-0079-T06 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md |
+| task | STATE-WP-0079-T07 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md |
+| task | STATE-WP-0079-T08 | done | — | workplans/STATE-WP-0079-retirement-strangler.md |
+| task | STATE-WP-0079-T09 | wait | — | workplans/STATE-WP-0079-retirement-strangler.md |
 | task | STATE-WP-0080-T01 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md |
 | task | STATE-WP-0080-T02 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md |
 | task | STATE-WP-0080-T03 | done | — | workplans/STATE-WP-0080-register-project-flavor-awareness.md |
@@ -339,3 +344,6 @@
 | task | STATE-WP-0086-T01 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md |
 | task | STATE-WP-0086-T02 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md |
 | task | STATE-WP-0086-T03 | done | — | workplans/STATE-WP-0086-fast-forge-projection-reconcile.md |
+| task | STATE-WP-0087-T01 | done | — | workplans/STATE-WP-0087-bounded-repository-collection-projection.md |
+| task | STATE-WP-0088-T01 | done | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md |
+| task | STATE-WP-0088-T02 | done | — | workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md |

workplans/STATE-WP-0088-preflight-signing-runtime-acceptance.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Accept the platform preflight signing lane in the State Hub API"
 domain: infotech
 repo: state-hub
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-09-05"
@@ -13,6 +13,8 @@ related:
   - RPF-WP-0035
   - STATE-WP-0085
   - FLEX-WP-0020
+quality_dod: DoD-Ok
+quality_dod_note: "Live API-only signing and fenced CAS rotation accepted; predecessor signature denial and recovered primary health evidenced. No residual implementation work."
 quality_dor: DoR-Ok
 quality_dor_note: "Exact platform design and user-requested task reviewed against live primary; bounded API-only delivery and controlled-outage rotation fence."
 state_hub_workstream_id: "22f2d7dc-5766-5b09-9f18-12abd4b5512b"
@@ -36,7 +38,7 @@ repository-rename API tests pass (13 tests). Platform owns CCR-2026-0015 and ESO
 
 ```task
 id: STATE-WP-0088-T02
-status: progress
+status: done
 priority: high
 state_hub_task_id: "55b32d0d-d30a-50c2-bae0-d6e3a357e6d1"
 ```
@@ -51,3 +53,19 @@ wait ESO, restart and prove predecessor invalidation and forward recovery.
 Runbook: railiance-platform/docs/credential-lane-designs/state-hub-preflight-activation.md.
 No repository rename is in scope. Live completion is pending attended OpenBao
 OIDC/MFA; ambient session returned 403.
+
+
+Completed 2026-09-05 under the user's instruction to lead activation from
+railiance-platform. CCR-2026-0015 is active. Production chart commit `49e3182`
+was fetched from Forge into ephemeral deployment storage; server dry-run changed
+only the API Deployment. Helm revision 59 retained image `main-cdff3b7`.
+One API replica matched the ESO key and signed preflight passed with zero
+blockers. Every API pod then stopped; platform rotated CAS 1 to KV version 2;
+ESO refreshed and one API replica recovered. New preflight passed, predecessor
+failed specifically by signature, and primary health passed. MCP and shared env
+Secret excluded from signing delivery. No repository rename executed.
+
+Evidence is owned by platform:
+`railiance-platform/docs/evidence/RPF-WP-0035-T04-signing-activation-2026-09-05.json`.
+Protected predecessor fixture removed after verification. No residual scope;
+the consuming FLEX-WP-0020 cutover remains separately governed.