From c130b7d739c71945eb6a4b9de0a0cc6f5b89b2e9 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 21 Oct 2026 00:04:43 +0200 Subject: [PATCH] SCOPE: record FLEX-WP-0037 agt-custodian registry rollout (revision 3) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 605711@bnt-lap001 Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61 --- SCOPE.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/SCOPE.md b/SCOPE.md index 110a67e..80c972c 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -144,6 +144,13 @@ in-cluster ops-warden pin and moved it to `callerAuth.mode: enforce` once ops-warden adopted a calling identity (`WARDEN-WP-0031`): anonymous `/v1/check` is 401, a token bound to another protected system is 403. +`FLEX-WP-0037` (2026-10-20) added the supervised-agent actor `agt-custodian` +to the ops-warden production registry fixture (`9132f9b`, pin `b429dcb`). An +attended `helm upgrade` of `flex-auth-ops-warden` rolled it out as revision 3, +with image `sha256:f7c04991…`; the rollback target is revision 2. The registry is +baked into the image, so adding an actor needs a new image and a helm upgrade, +not just a config change. + Production `policy.enabled` is **deliberately off, and is not coming back as a boolean.** ops-warden's `ADR-0009` (2026-08-22, superseding `ADR-0006`) settles it: `policy.enabled` is one repo-wide flag, and with `fail_closed: true` it makes