tegwick
13d1255c86
api and worker on sha256:08966e8d via Argo 8884b12, Synced Healthy.
ADHOC-2026-10-19-T02 done; T03 residual for the /release/health probe
contract. ACTIVITY-WP-0046-T03 still waits on assembly-economics v2.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 244572@bnt-lap001
Assistant-Session: 3b235e1a-ae45-4d0f-ae70-17a9bd78ece8
3.2 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | flavor | related | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ACTIVITY-WP-0046 | workplan | Repository grant v2: publish scope for governed pushes (REINAH-WP-0003-T04) | infotech | activity-core | active | claude-activity-core | activity-core | 2026-10-13 | 2026-10-19 | implementation |
|
b6b5d39e-cd56-5a91-a67e-dcdf7b8d147c |
Origin: rein-aharness (message 3eb4fa11, 2026-10-13) needs the repository grant
that Activity Core carries on each ops_run to scope publication, so that
assembly-checkpoint can leave legacy substring routing before
AGENT_HARNESS_LEGACY_APPROACHES_UNTIL (2026-12-31). Founder chose option 1a
on 2026-10-13: Activity Core adds the scope; no temporary tenant-declared grant.
Grant v1 stays local-only and its grant ids do not change. v2 adds
publish_scope (remote, branch, path prefixes inside allowed_paths,
fast-forward only). Activity Core admits and carries the grant; rein-aharness
enforces it and refuses any push without it.
Admission and carriage
id: ACTIVITY-WP-0046-T01
status: done
priority: high
state_hub_task_id: "ec8f32f2-db9d-5e41-bc14-7cd97e46816e"
Extend repository_grant.py with PublishScope and version "2"; include the
scope in the canonical grant id; reject inconsistent v1/v2 combinations and
prefixes outside allowed_paths; accept publish evidence keys in
glas_evidence. Document the contract in docs/ops-run-queue.md. Tests in
tests/test_repository_grant.py.
rein-aharness contract confirmation
id: ACTIVITY-WP-0046-T02
status: done
priority: high
state_hub_task_id: "78c39857-70cf-576a-b8f3-143bfb2c1e82"
rein-aharness confirms it computes the same v2 grant id and enforces the scope (REINAH-WP-0003-T04). Wait: reply sent 2026-10-13.
2026-10-19: done. rein-aharness confirmed id parity (4695649, message
481ce3f0) and scope enforcement (5c36d80, message 74ee374e). It imports the one
commit locally, refuses changed paths outside publish_scope.path_prefixes,
never pushes, and reports published: false. Cross-check: activity-core
3b25aea and rein-aharness b800961 compute the same grant id and
acceptance_policy_id for three inputs. The inputs are the docs example
(e0a395aa3ae8f810849d02e277b11828), a v2 grant with two unsorted allowed
paths and prefixes (0abbbc8cab5117874d00232b58b67e64), and a v1 grant
(9e689a2aea95728c5938a5ef5a37d285). The push is rein-aharness's publisher
under decision c6f23433, not this task.
assembly-checkpoint definitions adopt v2
id: ACTIVITY-WP-0046-T03
status: wait
priority: medium
state_hub_task_id: "0c3c628b-3456-5817-bcdd-0fa785a184b3"
assembly-economics declares a v2 grant on its checkpoint definitions and the production image carrying this change is rolled out before 2026-12-15. Wait: T02, then an image release through the normal GitOps path.
Image released 2026-10-19: api and worker run
git-9a46350bb3e1192b76aab859218f95312e17fdf4
(sha256:08966e8dd976d2e6f50711f33b2ab0abaa650aed998b28d743483999729e7d66),
Argo revision 8884b12 (evidence
docs/evidence/2026-10-19-grant-v2-lease-expiry-release.json). Still waiting:
assembly-economics must declare a v2 grant on its checkpoint definitions.