diff --git a/.custodian-brief.md b/.custodian-brief.md index d3d8eba..5e12ebd 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,23 @@ # Custodian Brief — access-engine **Domain:** infotech -**Last synced:** 2026-10-11 18:38 UTC +**Last synced:** 2026-10-16 14:30 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams +### Sign the decision envelope: the response channel is unauthenticated +Progress: 5/6 done | workplan_id: `90577acd-6910-548d-a13e-1dbfdfb8ed27` + +**Open tasks:** +- ► 6. Admit custody, consumer trust, exact packages and native signed decisions `7f785b52` + ### The decision record has a declared emission guarantee and nothing that delivers it Progress: 5/9 done | workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095` **Open tasks:** - ! 2. Register flex-auth as an audit-core sender `89661908` - *(wait: AUDIT-IN-0006 sender rows and governed token delivery remain pending; gate-house GH-WP-0004-T12 must rule on the load-bearing failure-path exception.)* + *(wait: GH-WP-0004-T12 refused the load-bearing failure-path exception (GH-DEC-2026-024). AUDIT-IN-0006 sender rows and governed token delivery remain pending.)* - ! 4. Close G2 `423b3090` *(wait: G2 needs T08 native heartbeat/drain and silence-finding evidence plus T06 reconciliation; local tests cannot close the delivery gap.)* - ! 6. Reconciliation, profile check, and storage `bf92a951` @@ -24,12 +30,12 @@ Progress: 5/9 done | workplan_id: `84f5d9fe-b4c9-584a-b964-efe3e48af095` Progress: 0/8 done | workplan_id: `af0f8d77-af04-569b-8e79-6c47eb8f1087` **Open tasks:** -- ► Decide the target names and supersede the retain table `4f9a796d` +- ! Decide the target names and supersede the retain table `4f9a796d` +- ! Make the PDP accept both names `487525e5` +- ! Rename the source `ff7fd369` +- ! Stand up the access-engine namespace next to flex-auth `13b93d7a` +- ! Consumers switch over, one at a time `f0470e5c` - ► Inventory every consumer reference and open handoffs `8f597899` -- ► Rename the source `ff7fd369` -- · Make the PDP accept both names `487525e5` -- · Stand up the access-engine namespace next to flex-auth `13b93d7a` -- · Consumers switch over, one at a time `f0470e5c` - · Retire the flex-auth runtime `e46c9c8e` - … and 1 more open tasks @@ -38,18 +44,18 @@ Progress: 10/11 done | workplan_id: `99a661a8-b36c-5c1c-b78b-1e8930bcd0a9` **Open tasks:** - ! 11. Soak, hand off residuals, and clean up the old checkout `46d8318b` - *(wait: Needs SBOM-IN-0001 catch-up receipt, secrets-engine coordinate correction and railiance-fabric residual disposition, observed soak evidence, and exact checkout cleanup approval under e071b34e-c4d4-49d0-824d-2c58bb0ae496.)* + *(wait: Cleanup approved conditionally (e071b34e): runs once the listed soak evidence, SBOM-IN-0001 receipt and residual handoffs exist.)* ### 2026-10-03 secret-read evaluator for ops-warden fetch checks Progress: 1/2 done | workplan_id: `60941288-d1f8-58fe-ad38-d508b7d5eac2` **Open tasks:** - ! Deploy the pin (founder go required) `aa00b29f` - *(wait: Live railiance01 change; founder go needed for CI image digest, helm install and tunnel.)* + *(wait: Install accepted retroactively (877c268b); steps 6-7 follow WARDEN-WP-0039-T03 token receipts and fetch URL.)* ## Inbox Hygiene -**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Stale unread:** 5 message(s) older than 3 day(s) — triage at session start. **Missing thread_id:** 2 unread message(s) lack supersession chains. --- diff --git a/.generated-work-records.json b/.generated-work-records.json new file mode 100644 index 0000000..4501ea4 --- /dev/null +++ b/.generated-work-records.json @@ -0,0 +1 @@ +{"version":1,"repo_slug":"access-engine"} diff --git a/.generated-work-records.mk b/.generated-work-records.mk new file mode 100644 index 0000000..aa876e3 --- /dev/null +++ b/.generated-work-records.mk @@ -0,0 +1,8 @@ +# Explicit opt-in recipe; no environment files or external make includes. +CUSTODIAN_SOURCE ?= /home/worsch/the-custodian +GENERATED_REPO_SLUG ?= access-engine +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" +generated-work-records-check: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check diff --git a/Makefile b/Makefile index 8224afd..e48f249 100644 --- a/Makefile +++ b/Makefile @@ -86,3 +86,10 @@ decisionpep-export: decisionpep-check: python3 tools/export_decisionpep_adapter.py --check go test ./pkg/decisionpep + +# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe. +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records +generated-work-records-check: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check diff --git a/SCOPE.md b/SCOPE.md index 38c95be..7230546 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -351,3 +351,20 @@ title: Layer declaration status: current description: Machine-readable Engine/PDP boundary declaration in INTENT.md frontmatter, carrying no standard version by design, with version-stamped conformance state and three declared gaps (G2 a ruled §11 non-conformance) and a per-event-class emission declaration in cadence.yaml, per docs/conformance/security-layer-conformance.md, per Security Layer Model section 11. ``` + + +## Repository maintenance reuse + +The tracked `.generated-work-records.json` adopts the Custodian staged-source +adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing +State Hub renderer through `.generated-work-records.mk`; the shared pre-commit +hook runs this isolated recipe only for opted-in repositories. The corresponding +`make generated-work-records-check` is read-only. Canonical repository identity +is explicit and does not depend on the checkout directory. + +Unstaged source changes are preserved; conflicts and unstaged generated-file +changes stop the commit. For `git commit --only`, generate first and include +WORK-RECORDS.md with the selected source paths. Existing generated-only guards +and exact-scope secret scans remain in place. This is repository maintenance, +not a runtime service, authorization decision, deployment or publication. +Other index generators and hub-derived briefs retain their owner boundaries. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 62ffebf..8066959 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -33,7 +33,7 @@ | workplan | FLEX-WP-0021 | finished | — | workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md | | workplan | FLEX-WP-0022 | finished | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md | | workplan | FLEX-WP-0023 | finished | — | workplans/FLEX-WP-0023-operator-caller-access-path.md | -| workplan | FLEX-WP-0024 | finished | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | +| workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | workplan | FLEX-WP-0025 | finished | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md | | workplan | FLEX-WP-0027 | finished | — | workplans/FLEX-WP-0027-t03-human-review.md | @@ -168,6 +168,8 @@ | task | FLEX-WP-0024-T02 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | task | FLEX-WP-0024-T03 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | task | FLEX-WP-0024-T04 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | +| task | FLEX-WP-0024-T05 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | +| task | FLEX-WP-0024-T06 | progress | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | task | FLEX-WP-0025-T01 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | task | FLEX-WP-0025-T02 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | task | FLEX-WP-0025-T03 | done | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | @@ -214,12 +216,12 @@ | task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | | task | FLEX-WP-0035-T04 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | | task | FLEX-WP-0035-T05 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | -| task | FLEX-WP-0036-T01 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T01 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | task | FLEX-WP-0036-T02 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | -| task | FLEX-WP-0036-T03 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | -| task | FLEX-WP-0036-T04 | progress | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | -| task | FLEX-WP-0036-T05 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | -| task | FLEX-WP-0036-T06 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T03 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T04 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T05 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T06 | wait | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |