build: adopt staged records and retain reviewed orientation snapshot
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
This commit is contained in:
parent
ca0cb75729
commit
7eb4e22705
6 changed files with 57 additions and 16 deletions
|
|
@ -2,17 +2,23 @@
|
|||
# Custodian Brief — access-engine
|
||||
|
||||
**Domain:** infotech
|
||||
**Last synced:** 2026-10-11 18:38 UTC
|
||||
**Last synced:** 2026-10-16 14:30 UTC
|
||||
**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
|
||||
|
||||
## Active Workstreams
|
||||
|
||||
### Sign the decision envelope: the response channel is unauthenticated
|
||||
Progress: 5/6 done | workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27`
|
||||
|
||||
**Open tasks:**
|
||||
- ► 6. Admit custody, consumer trust, exact packages and native signed decisions `7f785b52`
|
||||
|
||||
### The decision record has a declared emission guarantee and nothing that delivers it
|
||||
Progress: 5/9 done | workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095`
|
||||
|
||||
**Open tasks:**
|
||||
- ! 2. Register flex-auth as an audit-core sender `89661908`
|
||||
*(wait: AUDIT-IN-0006 sender rows and governed token delivery remain pending; gate-house GH-WP-0004-T12 must rule on the load-bearing failure-path exception.)*
|
||||
*(wait: GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.)*
|
||||
- ! 4. Close G2 `423b3090`
|
||||
*(wait: G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.)*
|
||||
- ! 6. Reconciliation, profile check, and storage `bf92a951`
|
||||
|
|
@ -24,12 +30,12 @@ Progress: 5/9 done | workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095`
|
|||
Progress: 0/8 done | workplan_id: `af0f8d77-af04-569b-8e79-6c47eb8f1087`
|
||||
|
||||
**Open tasks:**
|
||||
- ► Decide the target names and supersede the retain table `4f9a796d`
|
||||
- ! Decide the target names and supersede the retain table `4f9a796d`
|
||||
- ! Make the PDP accept both names `487525e5`
|
||||
- ! Rename the source `ff7fd369`
|
||||
- ! Stand up the access-engine namespace next to flex-auth `13b93d7a`
|
||||
- ! Consumers switch over, one at a time `f0470e5c`
|
||||
- ► Inventory every consumer reference and open handoffs `8f597899`
|
||||
- ► Rename the source `ff7fd369`
|
||||
- · Make the PDP accept both names `487525e5`
|
||||
- · Stand up the access-engine namespace next to flex-auth `13b93d7a`
|
||||
- · Consumers switch over, one at a time `f0470e5c`
|
||||
- · Retire the flex-auth runtime `e46c9c8e`
|
||||
- … and 1 more open tasks
|
||||
|
||||
|
|
@ -38,18 +44,18 @@ Progress: 10/11 done | workplan_id: `99a661a8-b36c-5c1c-b78b-1e8930bcd0a9`
|
|||
|
||||
**Open tasks:**
|
||||
- ! 11. Soak, hand off residuals, and clean up the old checkout `46d8318b`
|
||||
*(wait: Needs SBOM-IN-0001 catch-up receipt, secrets-engine coordinate correction and railiance-fabric residual disposition, observed soak evidence, and exact checkout cleanup approval under e071b34e-c4d4-49d0-824d-2c58bb0ae496.)*
|
||||
*(wait: Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.)*
|
||||
|
||||
### 2026-10-03 secret-read evaluator for ops-warden fetch checks
|
||||
Progress: 1/2 done | workplan_id: `60941288-d1f8-58fe-ad38-d508b7d5eac2`
|
||||
|
||||
**Open tasks:**
|
||||
- ! Deploy the pin (founder go required) `aa00b29f`
|
||||
*(wait: Live railiance01 change; founder go needed for CI image digest, helm install and tunnel.)*
|
||||
*(wait: Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.)*
|
||||
|
||||
## Inbox Hygiene
|
||||
|
||||
**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
|
||||
**Stale unread:** 5 message(s) older than 3 day(s) — triage at session start.
|
||||
**Missing thread_id:** 2 unread message(s) lack supersession chains.
|
||||
|
||||
---
|
||||
|
|
|
|||
1
.generated-work-records.json
Normal file
1
.generated-work-records.json
Normal file
|
|
@ -0,0 +1 @@
|
|||
{"version":1,"repo_slug":"access-engine"}
|
||||
8
.generated-work-records.mk
Normal file
8
.generated-work-records.mk
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
# Explicit opt-in recipe; no environment files or external make includes.
|
||||
CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
|
||||
GENERATED_REPO_SLUG ?= access-engine
|
||||
.PHONY: generated-work-records generated-work-records-check
|
||||
generated-work-records:
|
||||
python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
|
||||
generated-work-records-check:
|
||||
python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check
|
||||
7
Makefile
7
Makefile
|
|
@ -86,3 +86,10 @@ decisionpep-export:
|
|||
decisionpep-check:
|
||||
python3 tools/export_decisionpep_adapter.py --check
|
||||
go test ./pkg/decisionpep
|
||||
|
||||
# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe.
|
||||
.PHONY: generated-work-records generated-work-records-check
|
||||
generated-work-records:
|
||||
$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records
|
||||
generated-work-records-check:
|
||||
$(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check
|
||||
|
|
|
|||
17
SCOPE.md
17
SCOPE.md
|
|
@ -351,3 +351,20 @@ title: Layer declaration
|
|||
status: current
|
||||
description: Machine-readable Engine/PDP boundary declaration in INTENT.md frontmatter, carrying no standard version by design, with version-stamped conformance state and three declared gaps (G2 a ruled §11 non-conformance) and a per-event-class emission declaration in cadence.yaml, per docs/conformance/security-layer-conformance.md, per Security Layer Model section 11.
|
||||
```
|
||||
|
||||
|
||||
## Repository maintenance reuse
|
||||
|
||||
The tracked `.generated-work-records.json` adopts the Custodian staged-source
|
||||
adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing
|
||||
State Hub renderer through `.generated-work-records.mk`; the shared pre-commit
|
||||
hook runs this isolated recipe only for opted-in repositories. The corresponding
|
||||
`make generated-work-records-check` is read-only. Canonical repository identity
|
||||
is explicit and does not depend on the checkout directory.
|
||||
|
||||
Unstaged source changes are preserved; conflicts and unstaged generated-file
|
||||
changes stop the commit. For `git commit --only`, generate first and include
|
||||
WORK-RECORDS.md with the selected source paths. Existing generated-only guards
|
||||
and exact-scope secret scans remain in place. This is repository maintenance,
|
||||
not a runtime service, authorization decision, deployment or publication.
|
||||
Other index generators and hub-derived briefs retain their owner boundaries.
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@
|
|||
| workplan | FLEX-WP-0021 | finished | — | workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md |
|
||||
| workplan | FLEX-WP-0022 | finished | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
|
||||
| workplan | FLEX-WP-0023 | finished | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
|
||||
| workplan | FLEX-WP-0024 | finished | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md |
|
||||
| workplan | FLEX-WP-0027 | finished | — | workplans/FLEX-WP-0027-t03-human-review.md |
|
||||
|
|
@ -168,6 +168,8 @@
|
|||
| task | FLEX-WP-0024-T02 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| task | FLEX-WP-0024-T03 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| task | FLEX-WP-0024-T04 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| task | FLEX-WP-0024-T05 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| task | FLEX-WP-0024-T06 | progress | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
|
||||
| task | FLEX-WP-0025-T01 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| task | FLEX-WP-0025-T02 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
| task | FLEX-WP-0025-T03 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
|
||||
|
|
@ -214,12 +216,12 @@
|
|||
| task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
|
||||
| task | FLEX-WP-0035-T04 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
|
||||
| task | FLEX-WP-0035-T05 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md |
|
||||
| task | FLEX-WP-0036-T01 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T01 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T02 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T03 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T04 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T05 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T06 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T03 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T04 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T05 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T06 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md |
|
||||
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue