From dd2283412f1a8babf7b0d7d1f12d727adb2a4f3b Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Thu, 30 Jul 2026 00:39:04 +0200 Subject: [PATCH] chore(consistency): sync task status from DB [auto] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated by fix-consistency on 2026-07-30: - USER-WP-0020-T02: progress → done --- ...f-service-and-user-administration-portal.md | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md index 951bbb6..055d354 100644 --- a/workplans/USER-WP-0020-self-service-and-user-administration-portal.md +++ b/workplans/USER-WP-0020-self-service-and-user-administration-portal.md @@ -8,7 +8,7 @@ status: active owner: codex topic_slug: netkingdom created: "2026-07-27" -updated: "2026-07-28" +updated: "2026-07-30" depends_on: - USER-WP-0014 - USER-WP-0015 @@ -54,7 +54,7 @@ metadata for that later stage. ```task id: USER-WP-0020-T02 -status: progress +status: done priority: high state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411" ``` @@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain. ```task id: USER-WP-0020-T05 -status: progress +status: done priority: high state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04" ``` @@ -162,10 +162,14 @@ and rollback/roll-forward no longer depends on containerd retaining local tags. An age-encrypted user-engine Postgres dump was uploaded through the established activity-core offsite lane with plaintext cleanup. -The remaining T05 item is migration of the portal edge marker and provisioner -service token from bootstrap Kubernetes Secrets into an OpenBao-owned, -ExternalSecret-delivered, rotatable lane. This requires the ops-mason -executive approval gate for new secret custody. +2026-07-30 completion: the approved ops-mason plan moved the portal edge +marker and provisioner service token into one exact OpenBao workload path, +delivered through separate bounded AppRoles and namespace-restricted +ExternalSecret stores. A coordinated rotation converged all three derived +Secrets before restarting the portal and provisioner, and both Deployments +returned Ready. Exact-path access succeeds, sibling-path access is denied, +the derived client/server tokens match, and a post-rotation disposable +identity reconciliation passed. No secret value entered recorded evidence. ## T06 - Security, accessibility, and workflow conformance