coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(consistency): sync task status from DB [auto]

Browse source 
Updated by fix-consistency on 2026-07-30:
  - USER-WP-0020-T02: progress → done
This commit is contained in:
custodian-sync 2026-07-30 00:39:04 +02:00
parent f35e9c6236
commit dd2283412f
1 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
workplans/USER-WP-0020-self-service-and-user-administration-portal.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex owner: codex
topic_slug: netkingdom topic_slug: netkingdom
created: "2026-07-27" created: "2026-07-27"
updated: "2026-07-28" updated: "2026-07-30"
depends_on: depends_on:
- USER-WP-0014 - USER-WP-0014
- USER-WP-0015 - USER-WP-0015
@ -54,7 +54,7 @@ metadata for that later stage.
```task ```task
id: USER-WP-0020-T02 id: USER-WP-0020-T02
status: progress status: done
priority: high priority: high
state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411" state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
``` ```
@ -134,7 +134,7 @@ removal, and full cross-tenant conformance remain.
```task ```task
id: USER-WP-0020-T05 id: USER-WP-0020-T05
status: progress status: done
priority: high priority: high
state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04" state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
``` ```
@ -162,10 +162,14 @@ and rollback/roll-forward no longer depends on containerd retaining local
tags. An age-encrypted user-engine Postgres dump was uploaded through the tags. An age-encrypted user-engine Postgres dump was uploaded through the
established activity-core offsite lane with plaintext cleanup. established activity-core offsite lane with plaintext cleanup.
The remaining T05 item is migration of the portal edge marker and provisioner 2026-07-30 completion: the approved ops-mason plan moved the portal edge
service token from bootstrap Kubernetes Secrets into an OpenBao-owned, marker and provisioner service token into one exact OpenBao workload path,
ExternalSecret-delivered, rotatable lane. This requires the ops-mason delivered through separate bounded AppRoles and namespace-restricted
executive approval gate for new secret custody. ExternalSecret stores. A coordinated rotation converged all three derived
Secrets before restarting the portal and provisioner, and both Deployments
returned Ready. Exact-path access succeeds, sibling-path access is denied,
the derived client/server tokens match, and a post-rotation disposable
identity reconciliation passed. No secret value entered recorded evidence.
## T06 - Security, accessibility, and workflow conformance ## T06 - Security, accessibility, and workflow conformance