coulomb/the-custodian
4
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions 2

Advance supervised agent records and close verified Secret annotation guard
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Python Tests / pytest (push) Successful in 25s
Details

Browse source
This commit is contained in:
codex 2026-09-28 18:15:27 +02:00
parent b2f6713721
commit db91818e84
44 changed files with 6868 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

319
docs/evidence/2026-09-28-eso-metadata-changes.json Normal file
View file

@ -0,0 +1,319 @@
[
{
"id": "activity-core/actcore-backup-offsite",
"source": "/home/worsch/activity-core/k8s/railiance/15-externalsecret-backup-offsite.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "activity-core",
"app.kubernetes.io/part-of": "activity-core"
},
"annotations": {
"argocd.argoproj.io/sync-wave": "0"
}
}
}
},
{
"id": "activity-core/actcore-forgejo-admin",
"source": "/home/worsch/activity-core/k8s/railiance/15-externalsecret-forgejo-admin.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "activity-core",
"app.kubernetes.io/part-of": "activity-core"
},
"annotations": {
"argocd.argoproj.io/sync-wave": "0"
}
}
}
},
{
"id": "activity-core/actcore-issue-core-runtime",
"source": "/home/worsch/activity-core/k8s/railiance/15-externalsecret-issue-core.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "activity-core",
"app.kubernetes.io/part-of": "activity-core"
},
"annotations": {
"argocd.argoproj.io/sync-wave": "0"
}
}
}
},
{
"id": "activity-core/actcore-ops-run-worker-tokens",
"source": "/home/worsch/activity-core/k8s/railiance/15-externalsecret-worker-tokens.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "activity-core",
"app.kubernetes.io/part-of": "activity-core"
}
}
}
},
{
"id": "audit-core/audit-core-senders",
"source": "/home/worsch/audit-core/deploy/externalsecret-senders.yaml",
"template": {
"metadata": {}
}
},
{
"id": "email-connect/email-connect-runtime",
"source": "/home/worsch/email-connect/deploy/k8s/railiance/externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "email-connect",
"app.kubernetes.io/part-of": "email-connect"
},
"annotations": {
"argocd.argoproj.io/sync-wave": "0"
}
}
}
},
{
"id": "activity-core/llm-connect-provider-secrets",
"source": "/home/worsch/llm-connect/deploy/k8s/activity-core-llm-connect/externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "llm-connect",
"app.kubernetes.io/part-of": "railiance-gitops"
}
}
}
},
{
"id": "forgejo/forgejo-mailer",
"source": "/home/worsch/railiance-apps/manifests/forgejo-mailer-externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "forgejo",
"app.kubernetes.io/part-of": "railiance-apps"
}
}
}
},
{
"id": "reuse/reuse-surface-runtime",
"source": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "reuse-surface",
"app.kubernetes.io/part-of": "railiance-apps"
}
}
}
},
{
"id": "core-hub/core-hub-api-token",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "core-hub/core-hub-runtime-database",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "core-hub/core-hub-migration-database",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "core-hub/hub-core-runtime-database",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "core-hub/hub-core-migration-database",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "sso/keycape-secrets-engine-approval-client",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "sso/keycape-approval-engine-operator-client",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml",
"template": {
"metadata": {}
}
},
{
"id": "sso/keycape-informed-decision-sitting-requester-client",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml",
"template": {
"metadata": {}
}
},
{
"id": "sso/keycape-secrets-engine-requester-client",
"source": "/home/worsch/railiance-platform/argocd/platform-addons/openbao-secretstore/t03-requester.yaml",
"template": {
"metadata": {}
}
},
{
"id": "approval-engine/approval-engine-audit",
"source": "/home/worsch/railiance-platform/manifests/factory-audit-senders.yaml",
"template": {
"metadata": {
"annotations": {
"railiance.io/credential-change": "CCR-2026-0021",
"railiance.io/admission": "approved"
}
}
}
},
{
"id": "informed-decision/informed-decision-audit",
"source": "/home/worsch/railiance-platform/manifests/factory-audit-senders.yaml",
"template": {
"metadata": {
"annotations": {
"railiance.io/credential-change": "CCR-2026-0022",
"railiance.io/admission": "approved"
}
}
}
},
{
"id": "sso/keycape-factor-read",
"source": "/home/worsch/railiance-platform/manifests/keycape-factor-custody.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/part-of": "net-kingdom-sso-mfa"
}
}
}
},
{
"id": "state-hub/state-hub-rename-preflight",
"source": "/home/worsch/railiance-platform/openbao/state-hub-preflight/delivery.yaml",
"template": {
"metadata": {}
}
},
{
"id": "issue-core/issue-core-runtime",
"source": "/home/worsch/rapp-issue-core/manifests/20-secret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "issue-core",
"app.kubernetes.io/part-of": "issue-core"
}
}
}
},
{
"id": "databases/platform-pg-backup-s3",
"source": "/home/worsch/rapp-postgres/helm/platform-pg-backup-s3.externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "platform-pg",
"app.kubernetes.io/part-of": "railiance-gitops",
"railiance.io/layer": "s3-platform"
}
}
}
},
{
"id": "rapp-qonto/rapp-qonto",
"source": "/home/worsch/rapp-qonto/runtime/knative/externalsecret.yaml",
"template": {
"metadata": {}
}
},
{
"id": "telemetry/telemetry-alert-smtp",
"source": "/home/worsch/rapp-telemetry/acknowledgment/smtp-custody.yaml",
"template": {
"metadata": {}
}
},
{
"id": "telemetry/telemetry-grafana-admin",
"source": "/home/worsch/rapp-telemetry/manifests/custody.yaml",
"template": {
"metadata": {}
}
},
{
"id": "user-engine/user-engine-runtime",
"source": "/home/worsch/rapp-user-engine/manifests/openbao-runtime.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "user-engine",
"app.kubernetes.io/part-of": "user-engine"
}
}
}
},
{
"id": "user-engine/identity-provisioner-client",
"source": "/home/worsch/rapp-user-engine/manifests/openbao-runtime.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "user-engine",
"app.kubernetes.io/part-of": "user-engine"
}
}
}
},
{
"id": "sso/identity-provisioner-token",
"source": "/home/worsch/rapp-user-engine/manifests/openbao-runtime.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "identity-provisioner",
"app.kubernetes.io/part-of": "net-kingdom-sso-mfa"
}
}
}
},
{
"id": "target-revenue/target-revenue-runtime",
"source": "/home/worsch/target-revenue/k8s/railiance/externalsecret.yaml",
"template": {
"metadata": {
"labels": {
"app.kubernetes.io/name": "target-revenue",
"app.kubernetes.io/part-of": "target-revenue"
},
"annotations": {
"argocd.argoproj.io/sync-wave": "0"
}
}
}
}
]