tegwick
d563d516f5
New context_resolvers/state_hub.py query type: pending_decisions, a thin GET /decisions/ passthrough (topic_id/workstream_id/workplan_id/decision_type passed through, status defaults to open). Generic -- not special-cased to any one decision. New activity-definitions/monthly-secrets-elevation-review.md: fires 08:00 Berlin on the 1st of each month, sweeps open State Hub decisions under the infotech/reuse-surface topic, and opens a review task for each. First target: the temporary autoMode.allow/permissions.allow elevation added to ~/.claude/settings.json on 2026-07-07 (decision 11bf5cbf-458d-4275-a870- 77a82b4058b9, deadline 2026-07-31) for ops-warden/kubectl/OpenBao secret reads. Requested by Bernd: no existing scheduling mechanism (session-only cron, cloud routines with no local access) can durably re-check a local security posture a month out -- this closes that gap using activity-core's own durable Temporal-backed trigger instead. Verified: definition_parser.parse_file + scan_and_parse load it cleanly alongside the two existing definitions; new resolver tests pass (20/20 in that file); pending_decisions confirmed against the live local State Hub. Full suite: 241 passed, 2 pre-existing unrelated failures (confirmed via git stash -- present before this change too). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
59 lines
2.4 KiB
Markdown
59 lines
2.4 KiB
Markdown
---
|
|
id: monthly-secrets-elevation-review
|
|
name: Monthly Secrets-Elevation Review
|
|
enabled: true
|
|
owner: custodian-agent
|
|
governance: custodian
|
|
status: active
|
|
trigger:
|
|
type: cron
|
|
cron_expression: "0 8 1 * *"
|
|
timezone: Europe/Berlin
|
|
misfire_policy: skip
|
|
context_sources:
|
|
- type: state-hub
|
|
query: pending_decisions
|
|
params:
|
|
topic_id: f39fa2a3-c491-414c-a91b-b4c5fcc6139c
|
|
status: open
|
|
bind_to: context.decisions
|
|
---
|
|
|
|
# Monthly Secrets-Elevation Review
|
|
|
|
Runs 08:00 Berlin time on the 1st of every month. Checks whether any
|
|
temporary, broad credential/secrets-access elevations recorded as State Hub
|
|
decisions (topic: infotech / reuse-surface) are still open past their
|
|
review deadline, and opens a task to force a human yes/no on each one.
|
|
|
|
This definition exists because ad-hoc scheduling mechanisms (session-only
|
|
cron, cloud routines with no local access) cannot reliably re-check a local
|
|
security posture a month later — the check has to live somewhere durable.
|
|
`pending_decisions` (added alongside this definition) is a thin, generic
|
|
`GET /decisions/` passthrough, not special-cased to this one elevation, so
|
|
any future time-boxed decision under this topic gets the same monthly
|
|
check for free.
|
|
|
|
```rule
|
|
id: flag-overdue-elevation-decisions
|
|
for_each: context.decisions
|
|
bind_as: decision
|
|
condition: 'context.decision.status == "open"'
|
|
action:
|
|
task_template: 'Review time-boxed decision: {context.decision.title}'
|
|
description: 'Deadline {context.decision.deadline}. Rationale: {context.decision.rationale} Either resolve via resolve_decision() (elevation still needed -- extend deadline) or confirm removal (elevation no longer needed -- revert the settings.json entries added for it) and resolve as done.'
|
|
target_repo: reuse-surface
|
|
priority: medium
|
|
labels: ["security", "access-review", "automated"]
|
|
```
|
|
|
|
`pending_decisions` returns every open decision under this topic, not just
|
|
the secrets-elevation one -- any decision-maker who records a pending
|
|
decision with a `deadline` under this topic gets swept into the same
|
|
monthly nudge, which is deliberate rather than a limitation to fix later.
|
|
|
|
The first target is the temporary `autoMode.allow`/`permissions.allow`
|
|
elevation added to `~/.claude/settings.json` on 2026-07-07 (State Hub
|
|
decision `11bf5cbf-458d-4275-a870-77a82b4058b9`, deadline 2026-07-31) for
|
|
ops-warden/kubectl/OpenBao secret reads, granted to consolidate the
|
|
reuse-surface hub write token and audit secrets-management locations.
|