diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 122267b..29744be 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -44,6 +44,7 @@ | workplan | FLEX-WP-0033 | finished | — | workplans/FLEX-WP-0033-informed-decision-lifecycle.md | | workplan | FLEX-WP-0034 | finished | — | workplans/FLEX-WP-0034-informed-decision-review-discovery.md | | workplan | FLEX-WP-0035 | active | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | +| workplan | FLEX-WP-0036 | proposed | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | task | FLEX-WP-ADHOC-2026-10-03-T01 | done | — | workplans/ADHOC-2026-10-03.md | | task | FLEX-WP-ADHOC-2026-10-03-T02 | wait | — | workplans/ADHOC-2026-10-03.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -204,8 +205,16 @@ | task | FLEX-WP-0035-T01 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | | task | FLEX-WP-0035-T02 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | | task | FLEX-WP-0035-T03 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | -| task | FLEX-WP-0035-T04 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | -| task | FLEX-WP-0035-T05 | wait | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | +| task | FLEX-WP-0035-T04 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | +| task | FLEX-WP-0035-T05 | done | — | workplans/FLEX-WP-0035-per-identity-application-readback.md | +| task | FLEX-WP-0036-T01 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T02 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T03 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T04 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T05 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T06 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T07 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | +| task | FLEX-WP-0036-T08 | todo | — | workplans/FLEX-WP-0036-runtime-rename-access-engine.md | | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md | | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md | | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md | diff --git a/workplans/ADHOC-2026-10-03.md b/workplans/ADHOC-2026-10-03.md index 368cfb0..d7ccff7 100644 --- a/workplans/ADHOC-2026-10-03.md +++ b/workplans/ADHOC-2026-10-03.md @@ -56,7 +56,8 @@ id: FLEX-WP-ADHOC-2026-10-03-T02 status: wait priority: high needs_human: true -blocking_reason: "Live railiance01 change; founder go needed for CI image digest, helm install and tunnel." +blocked_on: message-from:ops-warden +blocking_reason: "Pin is live (steps 1-5). Remaining: ops-warden token receipts and fetch URL (steps 6-7, WARDEN-WP-0039-T03); founder to resolve decision 877c268b for the install that already ran." state_hub_task_id: "aa00b29f-fc1a-51e2-a373-0e3c72c1d6f4" decision_id: "877c268b-2089-42f1-a811-d98f549c1cb2" ``` @@ -102,3 +103,16 @@ Decision 877c268b-2089-42f1-a811-d98f549c1cb2 was checked and remains open. This task and workplan stay blocked on the approved rollout; no live change was made. Requirements are recorded in `docs/blocked-task-dependencies-2026-10-04.md`. + +2026-10-10 review: the earlier notes are stale. Steps 1-5 were done on +2026-10-03 at 07:17 (`helm history`: `flex-auth-ops-warden-fetch` revision 1), +yet the 2026-10-04 notes still say "no live change was made". Live image +`sha256:419bc374…` matches `values/ops-warden-fetch.yaml`. The Service has +ClusterIP `10.43.151.3`. Tunnel `flex-auth-ops-warden-fetch-railiance01` is +connected on 19091. From the workstation, `/healthz` returns 200 and an +anonymous `/v1/check` returns 401. Nothing in this repo records who approved +the install, and decision `877c268b` is still open, so the founder must resolve +it. Steps 6-7 belong to ops-warden: positive, wrong-owner and fail-closed +receipts with its own token, and `policy.fetch_flex_auth_url`. Its example +config already names the in-cluster URL. The pin log has no decisions in 7 +days, so ops-warden has not yet called it. diff --git a/workplans/FLEX-WP-0036-runtime-rename-access-engine.md b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md index 0a1400d..db2d2b1 100644 --- a/workplans/FLEX-WP-0036-runtime-rename-access-engine.md +++ b/workplans/FLEX-WP-0036-runtime-rename-access-engine.md @@ -12,6 +12,7 @@ updated: "2026-10-10" origin: demand origin_ref: founder 2026-10-10 ("the relicts are too disorienting") related: [FLEX-WP-0020] +state_hub_workstream_id: "af0f8d77-af04-569b-8e79-6c47eb8f1087" --- `FLEX-WP-0020` renamed the repository only. `FLEX-DEC-2026-013` kept every @@ -66,6 +67,7 @@ written. id: FLEX-WP-0036-T01 status: todo priority: high +state_hub_task_id: "4f9a796d-832f-5936-8a34-eb980f6e1b57" ``` Record `FLEX-DEC-2026-020`: runtime names move to `access-engine`, following @@ -83,6 +85,7 @@ id: FLEX-WP-0036-T02 status: todo priority: high depends_on: [FLEX-WP-0036-T01] +state_hub_task_id: "8f597899-677e-544b-ad58-26aab2614312" ``` For each consumer, list every place that names the runtime: URL, audience, @@ -105,6 +108,7 @@ id: FLEX-WP-0036-T03 status: todo priority: high depends_on: [FLEX-WP-0036-T01] +state_hub_task_id: "487525e5-c89e-586e-8e9b-54ac6da0804e" ``` Caller auth accepts `access-engine` and `flex-auth` audiences, and packages @@ -122,6 +126,7 @@ id: FLEX-WP-0036-T04 status: todo priority: medium depends_on: [FLEX-WP-0036-T01] +state_hub_task_id: "ff7fd369-326f-5044-aaa4-96c5f45c80e9" ``` Go module, `cmd/access-engine`, binary, `ACCESS_ENGINE_*` env vars (read the @@ -139,6 +144,7 @@ id: FLEX-WP-0036-T05 status: todo priority: medium depends_on: [FLEX-WP-0036-T03, FLEX-WP-0036-T04] +state_hub_task_id: "13b93d7a-8341-5c76-9ae8-0f36b45b10fc" ``` Create the `access-engine` namespace, then one `access-engine-` pin @@ -158,6 +164,7 @@ id: FLEX-WP-0036-T06 status: todo priority: medium depends_on: [FLEX-WP-0036-T02, FLEX-WP-0036-T05] +state_hub_task_id: "f0470e5c-3ea7-506c-b8bb-3ade0b57ff88" ``` Each consumer changes its URL, its egress policy (add the new namespace before @@ -175,6 +182,7 @@ id: FLEX-WP-0036-T07 status: todo priority: medium depends_on: [FLEX-WP-0036-T06] +state_hub_task_id: "e46c9c8e-a114-5c49-b035-22fdbd6a435b" ``` After a soak with no traffic on the old pins: uninstall each `flex-auth-*` @@ -193,6 +201,7 @@ id: FLEX-WP-0036-T08 status: todo priority: low depends_on: [FLEX-WP-0036-T06] +state_hub_task_id: "be5440aa-4584-5e4f-9459-242ecf5c7199" ``` SCOPE, INTENT and its layer declaration, the conformance doc, the stance