tegwick
d563d516f5
New context_resolvers/state_hub.py query type: pending_decisions, a thin GET /decisions/ passthrough (topic_id/workstream_id/workplan_id/decision_type passed through, status defaults to open). Generic -- not special-cased to any one decision. New activity-definitions/monthly-secrets-elevation-review.md: fires 08:00 Berlin on the 1st of each month, sweeps open State Hub decisions under the infotech/reuse-surface topic, and opens a review task for each. First target: the temporary autoMode.allow/permissions.allow elevation added to ~/.claude/settings.json on 2026-07-07 (decision 11bf5cbf-458d-4275-a870- 77a82b4058b9, deadline 2026-07-31) for ops-warden/kubectl/OpenBao secret reads. Requested by Bernd: no existing scheduling mechanism (session-only cron, cloud routines with no local access) can durably re-check a local security posture a month out -- this closes that gap using activity-core's own durable Temporal-backed trigger instead. Verified: definition_parser.parse_file + scan_and_parse load it cleanly alongside the two existing definitions; new resolver tests pass (20/20 in that file); pending_decisions confirmed against the live local State Hub. Full suite: 241 passed, 2 pre-existing unrelated failures (confirmed via git stash -- present before this change too). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2.4 KiB
| id | name | enabled | owner | governance | status | trigger | context_sources | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| monthly-secrets-elevation-review | Monthly Secrets-Elevation Review | true | custodian-agent | custodian | active |
|
|
Monthly Secrets-Elevation Review
Runs 08:00 Berlin time on the 1st of every month. Checks whether any temporary, broad credential/secrets-access elevations recorded as State Hub decisions (topic: infotech / reuse-surface) are still open past their review deadline, and opens a task to force a human yes/no on each one.
This definition exists because ad-hoc scheduling mechanisms (session-only
cron, cloud routines with no local access) cannot reliably re-check a local
security posture a month later — the check has to live somewhere durable.
pending_decisions (added alongside this definition) is a thin, generic
GET /decisions/ passthrough, not special-cased to this one elevation, so
any future time-boxed decision under this topic gets the same monthly
check for free.
id: flag-overdue-elevation-decisions
for_each: context.decisions
bind_as: decision
condition: 'context.decision.status == "open"'
action:
task_template: 'Review time-boxed decision: {context.decision.title}'
description: 'Deadline {context.decision.deadline}. Rationale: {context.decision.rationale} Either resolve via resolve_decision() (elevation still needed -- extend deadline) or confirm removal (elevation no longer needed -- revert the settings.json entries added for it) and resolve as done.'
target_repo: reuse-surface
priority: medium
labels: ["security", "access-review", "automated"]
pending_decisions returns every open decision under this topic, not just
the secrets-elevation one -- any decision-maker who records a pending
decision with a deadline under this topic gets swept into the same
monthly nudge, which is deliberate rather than a limitation to fix later.
The first target is the temporary autoMode.allow/permissions.allow
elevation added to ~/.claude/settings.json on 2026-07-07 (State Hub
decision 11bf5cbf-458d-4275-a870-77a82b4058b9, deadline 2026-07-31) for
ops-warden/kubectl/OpenBao secret reads, granted to consolidate the
reuse-surface hub write token and audit secrets-management locations.