pdurlej/platform

Fork 0

chore(m04): define Vault sunset entry criteria after DR and secrets gates #539

New issue

Closed

opened 2026-05-28 01:21:53 +02:00 by codex · 1 comment

codex commented

2026-05-28 01:21:53 +02:00

Collaborator

Scope

Turn Milestone 04 from a sad 0% bucket into an explicit gate checklist.

The output should define what must be true before #64 starts, and whether #64 should be split into smaller issues.

Spec sources

state/roadmap/current-platform-roadmap.md § 04 - Vault sunset
Issue #64
M02/M03 milestone descriptions after 2026-05-28 cleanup

Acceptance criteria

A concise checklist exists for starting Vault sunset safely.
#64 is classified as keep-as-is / split / defer.
Dependencies on M02 and M03 are explicit.
No Vault runtime mutation.

Out of scope

Removing Vault.
Editing secrets.
Creating migration scripts.

Agent notes

Recommended executor: Gemini 3.5 Flash local.

Rules:

Keep the PR small and boring.
Prefer closing/splitting stale work over adding new architecture docs.
Do not mutate production runtime.
Do not close issues live unless the issue explicitly requests it and evidence is clear.
PR body must include Spec sources read.

## Scope Turn Milestone 04 from a sad 0% bucket into an explicit gate checklist. The output should define what must be true before #64 starts, and whether #64 should be split into smaller issues. ## Spec sources - `state/roadmap/current-platform-roadmap.md` § 04 - Vault sunset - Issue #64 - M02/M03 milestone descriptions after 2026-05-28 cleanup ## Acceptance criteria - A concise checklist exists for starting Vault sunset safely. - #64 is classified as keep-as-is / split / defer. - Dependencies on M02 and M03 are explicit. - No Vault runtime mutation. ## Out of scope - Removing Vault. - Editing secrets. - Creating migration scripts. ## Agent notes Recommended executor: Gemini 3.5 Flash local. Rules: - Keep the PR small and boring. - Prefer closing/splitting stale work over adding new architecture docs. - Do not mutate production runtime. - Do not close issues live unless the issue explicitly requests it and evidence is clear. - PR body must include `Spec sources read`.

codex added this to the 04 - Vault sunset milestone

2026-05-28 01:21:53 +02:00

codex added the

labels

2026-05-28 01:21:53 +02:00

codex referenced this issue

2026-05-29 16:49:41 +02:00

chore(m03): triage secrets/access backlog into active, deferred, superseded #538

codex referenced this issue

2026-05-29 16:51:33 +02:00

chore(m04): run Vault Phase 1 read-only inventory packet #607

codex commented

2026-05-29 16:51:33 +02:00

Author

Collaborator

Role: executor
Intent: lane-outcome
Needs owner: no

M04 Vault Sunset entry gate packet. No Vault runtime mutation, no secret reads, no Infisical writes.

Spec sources read:

state/roadmap/current-platform-roadmap.md § 04 - Vault sunset
Issue #64
migrations/vault-to-infisical.md
modules/vault/module.yaml
modules/infisical/module.yaml
docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md
M02/M03 current Forgejo state after closeout

Entry checklist before any Vault sunset execution:

M02 restore confidence closed after post-M01 DR evidence.
M03 secrets/access closeout closed; current backend decision is Infisical-primary via ADR-0024.
Direct secret-source ambiguity reduced by docs/infisical/key-map.md, docs/agents/agent-sos.md, and runbooks/secrets-pipeline.md.
Vault Phase 1 read-only inventory exists and contains only metadata: engines, paths, key names/counts, no values.
Inventory confirms whether any live modules still reference Vault paths.
Any VPS1000/Iskra/OpenClaw cross-host secret dependency found during inventory is split out and not silently migrated in M04.
Phase 2 mirror plan is idempotent and rollbackable before any Infisical writes.
Phase 3 cutover is split per module/service family with rollback and smoke evidence.
Phase 5 stop/sunset remains operator-gated and is not authorized by this checklist.

#64 classification: split.

Reason: #64 bundles read-only inventory, Infisical writes, per-module runtime cutover, 24h soak, and Vault shutdown. That is too broad for one issue and would hide the point where risk changes from read-only to write/runtime.

Action taken:

Created #607: chore(m04): run Vault Phase 1 read-only inventory packet.
Keep #64 open as parent/umbrella for Vault sunset.
Do not create Phase 2+ issues until Phase 1 inventory tells us what actually exists.

Recommended next:

Run #607 only as metadata-only inventory.
After inventory, decide whether Phase 2 mirror can be split into one safe PR or needs per-path batches.
Runtime Vault sunset still requires a future explicit operator gate.

Next: close #539; continue with non-destructive M06/M07/M08 triage only.

**Role:** executor **Intent:** lane-outcome **Needs owner:** no M04 Vault Sunset entry gate packet. No Vault runtime mutation, no secret reads, no Infisical writes. Spec sources read: - `state/roadmap/current-platform-roadmap.md` § 04 - Vault sunset - Issue #64 - `migrations/vault-to-infisical.md` - `modules/vault/module.yaml` - `modules/infisical/module.yaml` - `docs/specs/vault-to-infisical-migration-v0/03-notes-and-readme.md` - M02/M03 current Forgejo state after closeout Entry checklist before any Vault sunset execution: - [x] M02 restore confidence closed after post-M01 DR evidence. - [x] M03 secrets/access closeout closed; current backend decision is Infisical-primary via ADR-0024. - [x] Direct secret-source ambiguity reduced by `docs/infisical/key-map.md`, `docs/agents/agent-sos.md`, and `runbooks/secrets-pipeline.md`. - [ ] Vault Phase 1 read-only inventory exists and contains only metadata: engines, paths, key names/counts, no values. - [ ] Inventory confirms whether any live modules still reference Vault paths. - [ ] Any VPS1000/Iskra/OpenClaw cross-host secret dependency found during inventory is split out and not silently migrated in M04. - [ ] Phase 2 mirror plan is idempotent and rollbackable before any Infisical writes. - [ ] Phase 3 cutover is split per module/service family with rollback and smoke evidence. - [ ] Phase 5 stop/sunset remains operator-gated and is not authorized by this checklist. #64 classification: **split**. Reason: #64 bundles read-only inventory, Infisical writes, per-module runtime cutover, 24h soak, and Vault shutdown. That is too broad for one issue and would hide the point where risk changes from read-only to write/runtime. Action taken: - Created #607: `chore(m04): run Vault Phase 1 read-only inventory packet`. - Keep #64 open as parent/umbrella for Vault sunset. - Do not create Phase 2+ issues until Phase 1 inventory tells us what actually exists. Recommended next: 1. Run #607 only as metadata-only inventory. 2. After inventory, decide whether Phase 2 mirror can be split into one safe PR or needs per-path batches. 3. Runtime Vault sunset still requires a future explicit operator gate. **Next:** close #539; continue with non-destructive M06/M07/M08 triage only.

codex referenced this issue

2026-05-29 16:51:33 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64

codex closed this issue

2026-05-29 16:51:34 +02:00