169 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
codex	1d90aac30f	fix(workplans): adopt ADR-007 derived identifiers for unregistered records ... These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 20:10:35 +02:00
codex	75c587d932	docs(agents): repoint remote State Hub URL to the in-cluster address ... The remote row pointed at 127.0.0.1:18000, a reverse tunnel back to the workstation. On railiance01 the State Hub runs in the cluster on that same machine, so the request left the box and came back to reach a local service. Refs CUST-WP-0067-T07 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 00:21:00 +02:00
tegwick	d4024083f8	fix(contract): pin action authorization digest ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:24:24 +02:00
tegwick	0eb46d61b5	docs(workplan): clarify denial verification ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:21:33 +02:00
tegwick	225fc5b73e	docs(workplan): close credential grant integration ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:19:53 +02:00
custodian-sync	e59106e06e	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-23: - update .custodian-brief.md for flex-auth Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:17:58 +02:00
tegwick	979db00a85	chore(consistency): refresh work record index ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:01:05 +02:00
custodian-sync	c29abb0854	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-23: - update .custodian-brief.md for flex-auth Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 14:00:36 +02:00
tegwick	acbaa4a7c9	feat(policy): add credential grant authorization package ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:59:03 +02:00
tegwick	df54c1b8f5	fix(schema): require durable decision binding ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:22:25 +02:00
repo-manager	4c3c528644	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:21:43 +02:00
custodian-sync	46ba7a340c	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-23: - update .custodian-brief.md for flex-auth Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:21:42 +02:00
tegwick	cde2cabc79	chore(workplan): wait on credential wire decision ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:20:43 +02:00
tegwick	350ffcea41	chore(workplan): use canonical id for auth corrections ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:18:57 +02:00
tegwick	c473f1971d	feat(authz): bind decisions to exact actions ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:18:26 +02:00
custodian-sync	7323dd1a60	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-23: - update .custodian-brief.md for flex-auth Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:17:52 +02:00
custodian-sync	05af9d16d7	chore(consistency): renormalize lifecycle state [auto] ... Updated by fix-consistency on 2026-08-23: - workplan status: ready → active Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81	2026-08-23 13:16:34 +02:00
tegwick	00a7bc4609	fix(posture): remove redundant implemented level ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1	2026-08-22 15:22:33 +02:00
tegwick	e521e7b715	feat(policy): adopt security zone stances ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1	2026-08-22 15:17:13 +02:00
tegwick	fbef547cfa	chore: register FLEX-WP-0016 in state hub [auto] ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:01:30 +02:00
tegwick	a9e98da7e2	FLEX-WP-0016: record disposition; SCOPE reflects ADR-0006 and the zone review ... FLEX-WP-0016 was titled 'so policy.enabled can flip' and the flip is not coming. ops-warden's ADR-0006 defers it permanently in favour of zone-scoped enforcement, so this closes rather than stalls: every task it owned is delivered and enforce is independently verified by both sides. The pin stays enforce and is not reverted to warn. SCOPE's account of policy.enabled was stale - it read as a build-stage timing choice. Replaced with the actual reason and with flex-auth's boundary as the reviewing PDP: membership compiles to the registry, stance stays in the policy package, fail-open is not expressible by a PDP. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-19 22:00:57 +02:00
tegwick	ee6d66c005	Record zone-engine compilation invariant; drop uncommitted policy leftovers ... flex-auth stays the only PDP. Zone membership reaches /v1/check as compiled registry data, never a synchronous lookup. Uncommitted tenant-engine read/role/grouping policy was discarded, not mixed into this pin.	2026-08-19 21:36:22 +02:00
tegwick	8605695397	chore(consistency): record FLEX-WP-0016 finished	2026-08-19 20:11:18 +02:00
tegwick	249ee146ba	Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03) ... ops-warden WARDEN-WP-0031 T04 minted audience-flex-auth tokens as system:serviceaccount:ops-warden:ops-warden and held the warn-log count. Helm rev 2 is enforce. Live probe 200/401/403. policy.enabled is theirs.	2026-08-19 20:10:31 +02:00
tegwick	f51f50ae8d	chore(consistency): index FLEX-WP-0016	2026-08-19 14:52:18 +02:00
tegwick	259f8a20a6	Add isolated ops-warden warn pin (FLEX-WP-0016); FLEX-WP-0007 stays finished ... policy.enabled cannot flip against the user-engine or tenant-engine bindings. Helm release flex-auth-ops-warden rev 1 serves the production registry in warn. Workstation warden sends no caller token; enforce and the yaml flip stay ops-warden's.	2026-08-19 14:50:04 +02:00
tegwick	c48c696387	chore(consistency): record FLEX-WP-0015 finished	2026-08-19 14:36:22 +02:00
custodian-sync	13090d6707	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-19: - update .custodian-brief.md for flex-auth	2026-08-19 14:36:14 +02:00
tegwick	6d85f95c8b	Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred ... flex-auth-tenant-engine Helm rev 2 is enforce on sha256:138aa347 after tenant-engine 2063470 started sending a projected caller token (sha256:7dc9d7bf). Probe 200/401/403. tenancy.current.A is 2. T04 cancelled: AuthZEN waits for a PEP we do not control.	2026-08-19 14:35:27 +02:00
tegwick	9514522b77	chore(consistency): record FLEX-WP-0015-T02 progress	2026-08-19 14:02:41 +02:00
custodian-sync	c5d6fbe088	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-19: - update .custodian-brief.md for flex-auth	2026-08-19 14:02:27 +02:00
tegwick	b2431e3cad	Enforce caller-auth on flex-auth-user-engine and record the live A2 probe ... Helm-adopted the kubectl-managed user-engine pin, promoted sha256:138aa347 warn then enforce. Reviewer volume needs fsGroup 65532; reviewer tokens must use the API default audiences or TokenReview 401s on this k3s. Live probe from user-engine-8569d7cb87-fp7px: 200 / 401 / 403. tenant-engine is unchanged. tenancy.current.A stays 0 until that pin moves.	2026-08-19 14:00:53 +02:00
tegwick	ebde4ecba6	Record user-engine ack that USER-WP-0023-T03 will not probe warn	2026-08-19 13:31:08 +02:00
tegwick	4dcfb9a6de	chore(consistency): record FLEX-WP-0015-T02 wait	2026-08-19 12:33:42 +02:00
tegwick	fa278674c1	Pin caller-auth digest in warn on independently rollable overlay pins ... The sanctioned Helm chart could not promote ADR 0004 at all, and the emergency manifests selected enforce. That made a FLEX-WP-0011 apply either a no-op or a global 401. First production pin is now warn, per consumer, on CI digest sha256:138aa347… . Enforce stays a later per-consumer flip so USER-WP-0023-T03 can close without waiting on tenant-engine.	2026-08-19 12:31:08 +02:00
tegwick	3de72fe6f5	Record the warn-first promotion sequence and operator gate on T02 ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 15:24:16 +02:00
tegwick	1e1e077b27	Implement inbound caller authentication (ADR 0004); close T03 and T05 ... TokenReview-based caller identity with audience-scoped tokens and exact resource.system to ServiceAccount bindings, per ops-warden's recommendation. Deletes the unwired tenant-engine live-roles adapter (T03) and adds make verify-posture (T05). Source implements A2; running digest is still A0 until promotion, so tenancy.current.A stays 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 15:22:52 +02:00
custodian-sync	6d82ef7f14	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-18: - update .custodian-brief.md for flex-auth	2026-08-18 07:28:46 +02:00
custodian-sync	ff87f32ef4	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-18: - FLEX-WP-0015-T02: progress → wait	2026-08-18 07:28:38 +02:00
custodian-sync	3f62e59a8d	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-17: - update .custodian-brief.md for flex-auth	2026-08-17 22:04:42 +02:00
tegwick	ac02445206	Ask ops-warden how /v1/check should authenticate callers; T02 waits ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 22:04:04 +02:00
custodian-sync	1719900249	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-17: - update .custodian-brief.md for flex-auth	2026-08-17 21:47:03 +02:00
tegwick	f2b3eeefd8	Review NetKingdom Tenancy Posture v0.1 and declare flex-auth posture ... Publishes tenancy.yaml (I1 A0 E2 P n/a R n/a, enables A3), the review answering rapp-postgres's three asks, and FLEX-WP-0015 to close the gaps. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 18:09:59 +02:00
tegwick	c84f34cf5f	Record tenant-engine guardrail pin and handoff caveats ... Operator applied their committed TEN-WP-0007 digest. Notes they asked us to keep: commit≠image, no plan-layer feed, one-way rollback for overrides.	2026-08-16 10:07:31 +02:00
tegwick	79582870c0	Pin flex-auth-tenant-engine to the nine-action policy image ... CI digest sha256:1bf060e6 (main-f304688) is live. Seven pre-existing actions still allow; guardrail.read/set match the FLEX-WP-0014 split. user-engine pin unchanged. Rollback target is sha256:9320df39.	2026-08-16 09:57:07 +02:00
tegwick	0da6d3dee2	chore(consistency): record FLEX-WP-0011 finished	2026-08-16 09:46:41 +02:00
custodian-sync	a97997821c	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-08-16: - update .custodian-brief.md for flex-auth	2026-08-16 09:46:31 +02:00
tegwick	4a4eab524b	Finish FLEX-WP-0011 after drain-plan row 23 correction ... T03 is done: the-custodian placement register now lists flex-auth on railiance01 as on target (c377f0d). T01/T02 were already complete.	2026-08-16 09:45:59 +02:00
tegwick	a98b5fc063	chore(consistency): record FLEX-WP-0014 hub IDs ... C-06 registered the guardrail workplan and wrote state_hub_workstream_id plus the four task ids back into the file.	2026-08-16 02:47:13 +02:00
tegwick	f304688d72	Authorize tenant-engine guardrail read and set actions ... FLEX-WP-0014. Package tenant-engine.write-api.mutate v1 now carries nine actions: tenant.guardrail.read and tenant.guardrail.set on resource type guardrail, verbatim from tenant-engine's mapping. The read/write split is used now: flex-auth may read ceilings and is denied action_not_granted on set; tenant-engine may do both. 17/17 Rego tests and 23/23 fixtures pass. Live e2e against a real tenant-engine FlexAuthWriteAuthorizer matches. In source only; production still serves the seven-action 9320df39 pin.	2026-08-16 02:46:25 +02:00