Files

tegwick 93e465525f Normalize agent instructions and workplan frontmatter (STATE-WP-0067)

- Align agent files with on-disk workplan prefixes (infer from workplan ids)
- Set workplan domain to registered domain_slug; add topic_slug where applicable
- Repair frontmatter delimiter formatting; migrate legacy task status literals
- Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates

2026-06-22 23:16:27 +02:00

2.9 KiB

Raw Blame History

id, type, title, domain, repo, status, owner, topic_slug, created, updated, state_hub_workstream_id

id	type	title	domain	repo	status	owner	topic_slug	created	updated	state_hub_workstream_id
NET-WP-0020	workplan	OpenBao Unseal Custody Models and SSH Automation Path	infotech	net-kingdom	active	codex	net-kingdom	2026-06-17	2026-06-18	d6338ac9-797d-4009-8203-4b8dd39010af

NET-WP-0020 — OpenBao Unseal Custody Models and SSH Automation Path

Scope: Framework for three OpenBao init/unseal custody models; automation-first development path; console decision points; downstream hooks for SSH engine and host CA automation on greenfield 3-node bootstrap.

Strategy: Start with sops-held-automation for fast unattended test cycles; add attended-ceremony and auto-unseal-transit with blocking gates as production trust increases.

Tasks

T1 — Custody model canon and console gates

id: NET-WP-0020-T01
status: done
priority: high
state_hub_task_id: "7040f347-d54a-42ba-a14f-5b0a7e691786"

docs/openbao-unseal-custody-models.md
Console: list + select commands; gates block planned models
smooth-bootstrap-guide.md Step 5 update
Makefile targets

T2 — SOPS-held init/unseal automation hooks

id: NET-WP-0020-T02
status: todo
priority: high
state_hub_task_id: "65407eb1-9d89-4158-aed5-4987badd83fc"

Extend creds-bootstrap-agent.sh for OpenBao init/unseal when sealed
Non-secret evidence flags: openbao_initialized, openbao_post_unseal_verified
Integrate with make openbao-configure-initial post-unseal

T3 — Attended ceremony automation profile

id: NET-WP-0020-T03
status: wait
priority: medium
state_hub_task_id: "34f3d979-a040-49ca-bfcb-35cf17473a06"

Implement attended-ceremony selection path (runbooks + evidence validators)
Production profile blocks sops-held-automation default

Blocked until: T2 automation path proven on greenfield rebuild.

T4 — Auto-unseal transit profile

id: NET-WP-0020-T04
status: wait
priority: medium
state_hub_task_id: "54ab6505-c13b-4f63-8c94-07dd202de90a"

railiance-platform Helm seal stanza for transit/KMS
Console gate + evidence for auto-unseal-transit

T5 — SSH engine + host CA automation (cross-repo)

id: NET-WP-0020-T05
status: done
priority: high
state_hub_task_id: "399e82ca-6551-4020-8db5-c78076e75cfc"

railiance-platform: openbao-configure-ssh declarative script + Makefile targets
railiance-infra: bootstrap-ssh-ca role + ssh_principals.yaml inventory
Live apply: OpenBao SSH engine + roles + warden-sign on Railiance (2026-06-18)
Live apply: bootstrap-ssh-ca on CoulombCore + Railiance01
Close ops-warden WP-0008 T2 verification gate

2.9 KiB Raw Blame History