Change foundations without breaking dependencies
Every destructive phase started with rereading the destructive perimeter and its destroy plan.
Rebuilding secrets, CI/CD, and infrastructure as code without breaking what already runs
This internal project rebuilt the secrets, CI/CD, and infrastructure-as-code foundations of LRJI's repositories, with evidence before every risky change.
The constraint was simple: make the foundations safer and more repeatable without interrupting the products that depend on them.
Rebuild without turning security into a wager
Secrets, deployments, and infrastructure affect every product. The rebuild therefore kept an explicit destructive perimeter and verifiable feedback at every phase.
The problem to solve
Explicit boundaries for secrets and delivery
The published choices remain principles: they explain the controls without exposing the platform's operational map.
Declared secrets, stored outside files
OpenTofu creates secrets and stores them in a password vault: no secret lives in a file, CI variable, or laptop.
Keyless workload identity
CI reaches the cloud through workload identity federation, without a static key to distribute or renew.
Separated environments
Production and non-production live in separate cloud projects; images are promoted by digest.
A migration governed by evidence
From September 7 to September 25, 2026, the plan advanced one step at a time. Its four remaining steps are open by design, rather than presented as finished work.
Final exercises
The final exercises exposed a file-processing worker that did not read its event's binary-content mode and a local gate that accepted what the CI image rejected. Both defects were fixed.
The published markers
They measure the rebuild's discipline, not a generic security promise.
- Plan
- 298 planned steps.
- Evidence
- 294 steps proven one by one.
- Perimeter
- Destroy plan reread before every destructive phase.
- Exercises
- Two real defects detected and fixed.
What this study establishes
Platform security relies as much on a reread perimeter and real exercises as on the tools selected.
Publish principles and evidence, never operational identifiers.
This study publishes no vault, item, project, account, or state name, and no network topology.