3 commits

Author	SHA1	Message	Date
codex	1d90aac30f	fix(workplans): adopt ADR-007 derived identifiers for unregistered records ... These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 20:10:35 +02:00
tegwick	8563c17a9f	chore(consistency): record FLEX-WP-0013 hub IDs ... C-06 registered the restore workplan and wrote state_hub_workstream_id plus the three task ids back into the file.	2026-08-16 02:37:48 +02:00
tegwick	87f114f036	Restore flex-auth-tenant-engine to the seven-action policy image ... FLEX-WP-0013. Production had been rolled back to sha256:c25fc34a (four actions), so tenant.update / tenant.retire / tenant.reactivate denied unknown_action. Re-pin and apply the previously-live sha256:9320df39 image (e9911eb). Live probe after restore: all seven actions allow; misspelled action and unknown subject still deny. user-engine pin unchanged. TEN-WP-0006 guardrail actions not added.	2026-08-16 02:36:56 +02:00