From 4c3c528644a971e3c1189166cd042fa37715fab2 Mon Sep 17 00:00:00 2001 From: repo-manager Date: Sun, 23 Aug 2026 13:21:43 +0200 Subject: [PATCH] chore(registrar): assign State Hub identifiers Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81 --- WORK-RECORDS.md | 10 +++++----- ...FLEX-WP-0017-action-bound-authorization-contract.md | 6 ++++++ workplans/FLEX-WP-0018-inbound-auth-corrections.md | 3 +++ 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4dfc755..f38f7fe 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,7 +8,6 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | ADHOC-2026-08-23 | finished | — | workplans/ADHOC-2026-08-23.md | | workplan | FLEX-WP-0001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | workplan | FLEX-WP-0002 | completed | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md | | workplan | FLEX-WP-0003 | completed | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md | @@ -20,14 +19,13 @@ | workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md | | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md | | workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| workplan | FLEX-WP-0012 | ready | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| workplan | FLEX-WP-0012 | active | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md | | workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md | | workplan | FLEX-WP-0015 | finished | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md | | workplan | FLEX-WP-0016 | finished | — | workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md | | workplan | FLEX-WP-0017 | active | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md | -| task | ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | -| task | ADHOC-2026-08-23-T02 | done | — | workplans/ADHOC-2026-08-23.md | +| workplan | FLEX-WP-0018 | finished | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -83,7 +81,7 @@ | task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | | task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md | -| task | FLEX-WP-0012-T01 | progress | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | +| task | FLEX-WP-0012-T01 | wait | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T02 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T03 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | | task | FLEX-WP-0012-T04 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md | @@ -107,3 +105,5 @@ | task | FLEX-WP-0017-T03 | wait | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md | | task | FLEX-WP-0017-T04 | done | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md | | task | FLEX-WP-0017-T05 | wait | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md | +| task | FLEX-WP-0018-T01 | done | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md | +| task | FLEX-WP-0018-T02 | done | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md | diff --git a/workplans/FLEX-WP-0017-action-bound-authorization-contract.md b/workplans/FLEX-WP-0017-action-bound-authorization-contract.md index d4f8124..1772786 100644 --- a/workplans/FLEX-WP-0017-action-bound-authorization-contract.md +++ b/workplans/FLEX-WP-0017-action-bound-authorization-contract.md @@ -11,6 +11,7 @@ planning_priority: P1 planning_order: 117 created: "2026-08-23" updated: "2026-08-23" +state_hub_workstream_id: "d75b7256-8b3d-5797-911c-96c3199b8baa" --- # FLEX-WP-0017 - Action-bound authorization and durable approval contract @@ -26,6 +27,7 @@ decision object each provide only part of that contract. id: FLEX-WP-0017-T01 status: done priority: high +state_hub_task_id: "e7b47e1d-58e8-503c-be89-e8f2050215b1" ``` Add a structured `binding` to standalone `DecisionEnvelope` responses with the @@ -38,6 +40,7 @@ Add schema and regression coverage. Prose remains diagnostic only. id: FLEX-WP-0017-T02 status: done priority: high +state_hub_task_id: "df7984fb-c31f-5b26-bf42-193e4c3cbb9f" ``` Publish `schemas/action_authorization.schema.json` and @@ -50,6 +53,7 @@ validity, distinct approvals, supersession, and fail-closed outage semantics. id: FLEX-WP-0017-T03 status: wait priority: high +state_hub_task_id: "82d39961-8140-5a7f-9bd8-5164dd1742e5" ``` State Hub must add a structured endpoint/object equivalent to the published @@ -64,6 +68,7 @@ organizational approval lifecycle. id: FLEX-WP-0017-T04 status: done priority: medium +state_hub_task_id: "d85089ee-ad8c-502b-ba1b-be4ad23aec46" ``` Populate the same binding in Topaz, relationship, rule, and Keycloak adapter @@ -75,6 +80,7 @@ success and fail-closed responses using the shared canonical constructor. id: FLEX-WP-0017-T05 status: wait priority: high +state_hub_task_id: "8c3fc0a2-0855-5ac9-afa5-d03b8b1f0bf9" ``` After T03, secrets-engine validates the canonical object before every diff --git a/workplans/FLEX-WP-0018-inbound-auth-corrections.md b/workplans/FLEX-WP-0018-inbound-auth-corrections.md index 500b2fe..6948bde 100644 --- a/workplans/FLEX-WP-0018-inbound-auth-corrections.md +++ b/workplans/FLEX-WP-0018-inbound-auth-corrections.md @@ -11,6 +11,7 @@ planning_priority: P2 planning_order: 118 created: "2026-08-23" updated: "2026-08-23" +state_hub_workstream_id: "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f" --- ## Classify rejected TokenReview credentials as unauthenticated @@ -19,6 +20,7 @@ updated: "2026-08-23" id: FLEX-WP-0018-T01 status: done priority: medium +state_hub_task_id: "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b" ``` Treat a successful TokenReview response that rejects a bearer token as an @@ -32,6 +34,7 @@ and authenticator seam. id: FLEX-WP-0018-T02 status: done priority: low +state_hub_task_id: "5613aeb1-ad09-50e5-9933-ced39593dc54" ``` Document that caller-authenticated pins permit TCP 443 and 6443 without a