Implement local decision delivery and reconcile blocked workplan requirements
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1046e-fcad-7ea3-bf36-361fc8d679e8
This commit is contained in:
parent
257a83e997
commit
3cb1cfaedf
25 changed files with 1258 additions and 50 deletions
|
|
@ -91,3 +91,14 @@ Steps, none run yet:
|
|||
Close-down checklist row 1 (the-custodian) is updated by message, not by edit.
|
||||
|
||||
2026-10-04 CUST-WP-0075 owner routing: `FLEX-WP-ADHOC-2026-10-03-T02` remains a human wait under open decision `877c268b-2089-42f1-a811-d98f549c1cb2`. Exact scoped human act and native receipts remain required; this metadata records no approval or execution.
|
||||
|
||||
2026-10-04 blocked-task review: ops-warden message 26992e49 confirms its
|
||||
fetch/sign separation is implemented at 7d4381e (sync 88c22d4). The evaluator
|
||||
code is already complete; do not repeat that implementation or fall back to
|
||||
the signing URL. Remaining requirements are the exact CI digest/live install,
|
||||
ops-bridge 19091 tunnel, configured policy.fetch_flex_auth_url and native
|
||||
health/positive/wrong-owner/fail-closed receipts under WARDEN-WP-0039-T03.
|
||||
Decision 877c268b-2089-42f1-a811-d98f549c1cb2 was checked and remains open.
|
||||
This task and workplan stay blocked on the approved rollout; no live change was
|
||||
made. Requirements are recorded in
|
||||
`docs/blocked-task-dependencies-2026-10-04.md`.
|
||||
|
|
|
|||
|
|
@ -479,7 +479,8 @@ generic error is treated as proof of rollback.
|
|||
id: FLEX-WP-0020-T11
|
||||
status: wait
|
||||
needs_human: true
|
||||
blocking_reason: "Soak window after T10; destructive cleanup needs separate human approval."
|
||||
blocked_on: message-from:sbom-nexus
|
||||
blocking_reason: "Needs SBOM-IN-0001 catch-up receipt, secrets-engine coordinate correction and railiance-fabric residual disposition, observed soak evidence, and exact checkout cleanup approval under e071b34e-c4d4-49d0-824d-2c58bb0ae496."
|
||||
priority: high
|
||||
state_hub_task_id: "46d8318b-d1fb-52e3-b632-52230ed1438f"
|
||||
decision_id: "e071b34e-c4d4-49d0-824d-2c58bb0ae496"
|
||||
|
|
@ -514,3 +515,12 @@ the historical repo:flex-auth node in the railiance-fabric discovery snapshot. T
|
|||
destructive cleanup of old aliases/redirects needs separate human approval) remains.
|
||||
|
||||
2026-10-04 CUST-WP-0075 owner routing: `FLEX-WP-0020-T11` remains a human wait under open decision `e071b34e-c4d4-49d0-824d-2c58bb0ae496`. Exact scoped human act and native receipts remain required; this metadata records no approval or execution. Completed predecessor edges removed: FLEX-WP-0020-T10; completed source evidence remains in the history and does not satisfy the human gate.
|
||||
|
||||
2026-10-04 blocked-task review: owner source still records SBOM-IN-0001 open,
|
||||
and secrets-engine/docs/exec-owner-binding.md:89 still names ../flex-auth.
|
||||
Neither is closed by the rename's completed journal. The discovery snapshot
|
||||
residual needs railiance-fabric's receiving record and disposition. No soak
|
||||
window or success is invented; no checkout or alias is removed. Exact owner
|
||||
receipts and operator acceptance requirements are in
|
||||
`docs/blocked-task-dependencies-2026-10-04.md`. T11 and this workplan remain
|
||||
blocked until those returns and the still-open cleanup decision permit closure.
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@ type: workplan
|
|||
title: "Admit scoped human review for the three T03 actions"
|
||||
domain: infotech
|
||||
repo: flex-auth
|
||||
status: blocked
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: codex
|
||||
topic_slug: netkingdom
|
||||
|
|
@ -44,9 +44,8 @@ checks pass with synthetic identities; evidence is retained in docs/evidence.
|
|||
|
||||
```task
|
||||
id: FLEX-WP-0027-T03
|
||||
status: wait
|
||||
needs_human: true
|
||||
blocking_reason: "Needs the operator's exact signed-in account and actual human acknowledgements; synthetic policy checks are not acceptance."
|
||||
status: done
|
||||
needs_human: false
|
||||
priority: high
|
||||
state_hub_task_id: "9417d64a-308c-566f-af29-217c5c45d294"
|
||||
decision_id: "e1868a8d-cad7-48c6-84d1-78a5a566d4a4"
|
||||
|
|
@ -62,3 +61,16 @@ account exercising the review), so the workplan is marked `blocked` rather
|
|||
than `active` until that happens.
|
||||
|
||||
2026-10-04 CUST-WP-0075 owner routing: `FLEX-WP-0027-T03` remains a human wait under open decision `e1868a8d-cad7-48c6-84d1-78a5a566d4a4`. Exact scoped human act and native receipts remain required; this metadata records no approval or execution.
|
||||
|
||||
2026-10-04 owner-evidence review: the historical wait above is superseded.
|
||||
`SECRETS-WP-0010-T03` is done; its 2026-09-16 completion record explicitly
|
||||
records real human acceptance of all three renewed version-2 memos. The native
|
||||
receipt retains actor `worsch`, approved human-controlled CAS consumption and
|
||||
decision/request bindings for apply, verify and exec; all three approvals are
|
||||
consumed. Reviewed receipt hash and action references are retained in
|
||||
`docs/evidence/2026-10-04-t03-owner-completion-review.json`. This closes the
|
||||
original scoped review task and finishes this workplan without new execution.
|
||||
The version-3 records now in `examples/informed-decision-t03/records.json`
|
||||
serve the next `IR-WP-0005-T02` cycle; they do not reopen this original task or
|
||||
permit reuse of the consumed approvals. The old decision link is retained as
|
||||
history, not a claim that the later human decision has been answered.
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ related_workplans:
|
|||
- FLEX-WP-0030
|
||||
- FLEX-WP-0019
|
||||
created: "2026-09-21"
|
||||
updated: "2026-09-27"
|
||||
updated: "2026-10-04"
|
||||
state_hub_workstream_id: "84f5d9fe-b4c9-584a-b964-efe3e48af095"
|
||||
---
|
||||
|
||||
|
|
@ -63,7 +63,8 @@ and the node disk is at 84 %.
|
|||
id: FLEX-WP-0031-T02
|
||||
status: wait
|
||||
blocked_on: message-from:audit-core
|
||||
blocking_reason: "audit-core intake: sender registration, evidence_kind and heartbeat classes as cadence.yaml publishes them; gate is a registered sender."
|
||||
depends_on: [GH-WP-0004-T12]
|
||||
blocking_reason: "AUDIT-IN-0006 sender rows and governed token delivery remain pending; gate-house GH-WP-0004-T12 must rule on the load-bearing failure-path exception."
|
||||
priority: high
|
||||
state_hub_task_id: "89661908-ca9a-5e4a-a0a5-62d1a9e02568"
|
||||
```
|
||||
|
|
@ -135,33 +136,36 @@ Done 2026-09-23:
|
|||
- `make test` (race) passes, and a local serve smoke test committed and counted
|
||||
one deny and one allow. Nothing is deployed and no chart changed.
|
||||
|
||||
## 5. Heartbeat and drain to audit-core
|
||||
## 5. Implement heartbeat and drain to audit-core
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0031-T05
|
||||
status: wait
|
||||
depends_on: [FLEX-WP-0031-T02]
|
||||
blocking_reason: "Per-class heartbeat sender and drain need the registered sender from T02."
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "14bd6648-11da-53d7-a512-027005bd4772"
|
||||
```
|
||||
|
||||
2026-09-27: `cadence.yaml`'s heartbeat declaration corrected — it now names one
|
||||
class per rare load-bearing event (`deny`, `redact`, `not_applicable`,
|
||||
`audit_only`) instead of a single combined `flex-auth.decision.heartbeat`
|
||||
class. `go build`/`go test ./...` pass unchanged. The remaining scope — the
|
||||
actual per-class heartbeat sender and the drain to `POST /v1/events` — is
|
||||
correctly blocked on T02's sender registration with `audit-core`; the task
|
||||
stays `wait` rather than in progress here.
|
||||
2026-10-04: split implementation from native delivery acceptance (new T08).
|
||||
`internal/emission/delivery.go` implements daily per-class `audit-core.heartbeat`
|
||||
events with independent correlation IDs and offset timestamps, persisted in
|
||||
our durable outbox. Restart rebuilds each class's last heartbeat from the log.
|
||||
Heartbeats expose committed and released-uncommitted counts; a known failure
|
||||
changes the assertion to `released-uncommitted-finding`.
|
||||
|
||||
- Emit a daily `audit-core.heartbeat` event per rare class, with `data.class`
|
||||
set to the class, following audit-core's `stream_findings` shape.
|
||||
- Correct `cadence.yaml`, which still names a single
|
||||
`flex-auth.decision.heartbeat` class.
|
||||
- Drain committed events to `POST /v1/events` with `Idempotency-Key` set to the
|
||||
event id, keep a drain cursor, and expose outbox depth and age against the
|
||||
`lag_bound`.
|
||||
- The drain stays disabled until T02 admits the senders.
|
||||
The asynchronous drain sends the eight-field envelope with event-ID
|
||||
idempotency, reads a mounted token file per event for rotation, refuses
|
||||
redirects, and advances a fsynced/renamed cursor only on 200 or 202. Every other
|
||||
response, transport failure or cursor-write failure retains the event. A
|
||||
bounded drain runs each minute, without holding the decision lock during HTTP.
|
||||
`GET /v1/emission` exposes pending depth, oldest pending timestamp and lag-bound
|
||||
exceedance (100 events / 1h). No response body or token is logged.
|
||||
|
||||
`serve --audit-url <explicit /v1/events endpoint> --audit-token-file <mount>`
|
||||
enables the worker only with an outbox. Both default empty, and no pin enables
|
||||
it. Local tests cover per-class cadence, restart, rejection, stable replay,
|
||||
ambiguous acceptance, token rotation and cursor durability. The current outbox
|
||||
retains acknowledged log entries; retention/compaction is not implemented, so
|
||||
capacity planning must include cumulative log growth.
|
||||
|
||||
## 6. Reconciliation, profile check, and storage
|
||||
|
||||
|
|
@ -169,7 +173,8 @@ stays `wait` rather than in progress here.
|
|||
id: FLEX-WP-0031-T06
|
||||
status: wait
|
||||
depends_on: [FLEX-WP-0031-T02]
|
||||
blocking_reason: "Reconciliation compare needs audit-core GET /v1/reconciliation, which exists only once T02's sender is registered."
|
||||
blocked_on: message-from:audit-core
|
||||
blocking_reason: "Receiver counts use accepted_at, while local counts use commit time; audit-core must supply compatible window semantics or durable acceptance timestamps before a valid comparator can be implemented."
|
||||
priority: high
|
||||
state_hub_task_id: "bf92a951-3b69-59dd-8907-f6748c91a264"
|
||||
```
|
||||
|
|
@ -193,13 +198,22 @@ undone. Stays `wait`.
|
|||
(84 % on 2026-09-23). Rolling it out to any pin is a production change and
|
||||
needs the founder's go-ahead.
|
||||
|
||||
2026-10-04: storage/profile preparation is now complete as T07. The remaining
|
||||
comparator is independently blocked by receiver time semantics, not just a
|
||||
missing registration: audit-core counts accepted_at in half-open windows,
|
||||
while our log timestamps local commits. Ingest returns status/reference only.
|
||||
A receiver-approved matching basis or stable acceptance-time receipts (also
|
||||
on duplicates) is required before implementing a comparison. Do not widen
|
||||
may_read to fetch archive payloads as a workaround. T02 and T08 still gate
|
||||
native custody/rollout evidence; see the dependency record for exact returns.
|
||||
|
||||
## 4. Close G2
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0031-T04
|
||||
status: wait
|
||||
depends_on: [FLEX-WP-0031-T05, FLEX-WP-0031-T06]
|
||||
blocking_reason: "Closing G2 needs the silence-finding gate, which needs T05's sender and T06's reconciliation."
|
||||
depends_on: [FLEX-WP-0031-T08, FLEX-WP-0031-T06]
|
||||
blocking_reason: "G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap."
|
||||
priority: medium
|
||||
state_hub_task_id: "423b3090-1b72-58fd-9353-5c907c7683bb"
|
||||
```
|
||||
|
|
@ -212,3 +226,57 @@ Change `cadence.yaml` `state` to emitting, move G2 out of the gap table with the
|
|||
evidence, and tell `gate-house`, `audit-core` and `kings-guard`. Gate: a silence
|
||||
finding is observed on a deliberately withheld heartbeat in a non-production
|
||||
run.
|
||||
|
||||
## 7. Prepare persistent storage and validate the cadence contract
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0031-T07
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "151fe609-ba68-506b-9c2c-9fdb0b149eef"
|
||||
```
|
||||
|
||||
Split from T06 on 2026-10-04; its historical schema/storage blockers above are
|
||||
superseded by this implementation. `charts/flex-auth` has optional outbox PVC,
|
||||
mount, source and flags, defaults disabled, a one-replica constraint and
|
||||
Recreate strategy to avoid two writers during rollout. It supports an existing
|
||||
claim. Rendering is tested with caller auth enabled and disabled. No values pin
|
||||
or live deployment is changed; 1Gi is a configurable preparation value, not an
|
||||
assertion of available node space.
|
||||
|
||||
Published `docs/contracts/decision-emission-cadence.json` against the actual
|
||||
InfoTechCanon wire schema and NetKingdom profile. All five decision classes
|
||||
are explicitly supplied; contract/profile assessment passes. The generic
|
||||
expected-rate schema forbids reconciliation on that entry and the profile
|
||||
forbids duplicate classes, so allow's additional reconciliation guarantee is
|
||||
in the `extensions.flex-auth` namespace. Receiver acceptance of that mapping
|
||||
remains part of T02; a profile pass does not establish observer delivery.
|
||||
|
||||
## 8. Admit and exercise native heartbeat/drain delivery
|
||||
|
||||
```task
|
||||
id: FLEX-WP-0031-T08
|
||||
status: wait
|
||||
priority: high
|
||||
depends_on: [FLEX-WP-0031-T02]
|
||||
needs_human: true
|
||||
blocking_reason: "Needs admitted sender/token mounts, founder approval of exact image/PVC/network rollout, and audit-core observer evidence; no production delivery is enabled."
|
||||
state_hub_task_id: "b3b52b30-c73d-5a90-9935-d98afe5a9eaf"
|
||||
```
|
||||
|
||||
Remaining acceptance split from T05: audit-core's owner must return admitted
|
||||
exact per-pin sources, scope, heartbeat classes and cadence mapping under
|
||||
AUDIT-IN-0006. Platform must provide governed attended token custody and
|
||||
mount references, never values. The founder must approve exact immutable image,
|
||||
PVC capacity and rollout; network owners must admit the decision pins to the
|
||||
receiver. Record native 202 and idempotent 200 delivery, restart cursor/lag
|
||||
behaviour, and an audit-core silence finding from a separately authorized
|
||||
non-production withheld-heartbeat exercise. No test engagement/window is
|
||||
created by this workplan. T06 still owns the compatible-time reconciliation
|
||||
implementation and its native acceptance. See
|
||||
`docs/blocked-task-dependencies-2026-10-04.md` for the concrete dependency gates.
|
||||
|
||||
2026-10-04 review: workplan stays blocked. Local heartbeat/drain and storage
|
||||
preparation no longer wait on another repository, but admission, statutory
|
||||
ruling, valid reconciliation time basis and approved native acceptance do.
|
||||
`cadence.yaml` remains `declared-not-yet-emitting` and G2 remains open.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue