From 0bc83070f5ed850fded9d16886ee397479883efd Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 21:18:42 +0200 Subject: [PATCH] GLAS-WP-0016/0017: record operator decisions on publisher, host install and assembly shape Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 269924@bnt-lap001 Assistant-Session: 02bbdd77-e96c-4580-8952-f4dc9d8a8508 --- docs/publish-grant-design.md | 11 ++++++----- workplans/GLAS-WP-0016-fi-research-brief-profile.md | 12 +++++++++--- ...LAS-WP-0017-assembly-checkpoint-governed-route.md | 10 ++++++++-- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/docs/publish-grant-design.md b/docs/publish-grant-design.md index d567796..c29c979 100644 --- a/docs/publish-grant-design.md +++ b/docs/publish-grant-design.md @@ -1,6 +1,7 @@ # Path-scoped publish grants -Status: proposed (GLAS-WP-0016-T05, 2026-10-13). One design for every tenant +Status: accepted 2026-10-13 (operator decision 1c9817ee: Activity Core owns +the publisher). One design for every tenant that publishes a governed run's commit to its own remote. First consumers: freedom-intelligence daily brief (`briefs/**`) and assembly-economics checkpoints (`checkpoints/**`). @@ -48,11 +49,11 @@ capability. Glas profile) hands its commits to the same publisher under the same grant shape. Assembly-checkpoint does not need an agent session for this. -## Open: who owns the publisher +## Publisher owner The publisher is one capability serving both Glas-profiled and blueprint runs. Candidates: Activity Core (it already holds the grant and ops_run), rein-aharness (it runs the worker that imports the bundle), or a separate typed capability. -Recommendation: Activity Core, because it validates and holds the grant, and -both execution paths already pass through it. This is the operator's decision, -tracked as GLAS-WP-0016-T05. +Decided 2026-10-13 (hub decision 1c9817ee): Activity Core, because it +validates and holds the grant, and both execution paths already pass through +it. diff --git a/workplans/GLAS-WP-0016-fi-research-brief-profile.md b/workplans/GLAS-WP-0016-fi-research-brief-profile.md index a7e0cd3..3f9e72c 100644 --- a/workplans/GLAS-WP-0016-fi-research-brief-profile.md +++ b/workplans/GLAS-WP-0016-fi-research-brief-profile.md @@ -89,7 +89,7 @@ id: GLAS-WP-0016-T04 status: wait depends_on: [GLAS-WP-0016-T02, GLAS-WP-0016-T03, GLAS-WP-0016-T05] priority: high -blocking_reason: "Depends on T01-T03 and on the publisher owner (T05)." +blocking_reason: "Depends on T02/T03 (owner handoffs); publisher owner decided (T05)." state_hub_task_id: "6faf1b1c-164d-5d6d-8dad-6cf920a5fd6c" ``` @@ -102,7 +102,7 @@ push from the session. Publish evidence under `docs/evidence/`, then set ```task id: GLAS-WP-0016-T05 -status: wait +status: done needs_human: true decision_id: 1c9817ee-95da-4165-985e-43fa61ec4827 priority: high @@ -114,11 +114,14 @@ state_hub_task_id: "e91fa370-236e-56c8-b88d-3272aec40dc1" assembly-checkpoint. Open: who owns the publisher step and its push credentials. Recommendation: Activity Core. Resolve before T04 publishes. +2026-10-13: resolved by the operator (decision 1c9817ee): Activity Core owns +the publisher and push credentials. activity-core notified (message 25824c97). + ## Operator decision: is a sandboxed pinned agent a host installation? ```task id: GLAS-WP-0016-T06 -status: wait +status: done needs_human: true decision_id: ab16cacd-9739-4080-a55e-b6e8ab8f33e7 priority: high @@ -132,3 +135,6 @@ bwrap sandbox count as a host installation? Glas view: no. The binary is a pinned runtime artifact owned by rein-aharness/sand-boxer, not on the host PATH, not user-installed, carries no host credentials and runs only under deny-default egress. Answer FI explicitly once the operator decides. + +2026-10-13: resolved by the operator (decision ab16cacd): not a host +installation. FI answered explicitly (reply e12edd5b). diff --git a/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md b/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md index 0582e23..8912baf 100644 --- a/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md +++ b/workplans/GLAS-WP-0017-assembly-checkpoint-governed-route.md @@ -24,7 +24,7 @@ route by 2026-12-15, ahead of the 2026-12-31 compatibility flag. ```task id: GLAS-WP-0017-T01 -status: wait +status: done needs_human: true decision_id: 0636c577-46e2-4dca-b68e-0b189c967cae priority: high @@ -40,6 +40,9 @@ Glas profile for both. Glas recommendation: (a), matching rein-aharness assessment becomes an agent loop. Publication uses the shared grant in `docs/publish-grant-design.md` either way. +2026-10-13: resolved by the operator (decision 0636c577): option (a). +assembly-economics answered (reply 2b8b3553). + ## Confirm the grant shape with assembly-economics ```task @@ -47,10 +50,13 @@ id: GLAS-WP-0017-T02 status: wait depends_on: [GLAS-WP-0017-T01, GLAS-WP-0016-T05] priority: medium -blocking_reason: "Depends on T01 and GLAS-WP-0016-T05 (publisher owner)." +blocked_on: message-from:assembly-economics +blocking_reason: "Grant-shape confirmation requested 2026-10-13 (reply 2b8b3553); await assembly-economics." state_hub_task_id: "04c50300-5c7a-556f-81d7-11060c5a22b0" ``` Once the decisions land, confirm with assembly-economics a `repository_grant` v2 block (`allowed_paths: [checkpoints/**]`, fast-forward only, one rebase, never force) in its activity definition, copied from the FI template. + +Requested 2026-10-13 in reply 2b8b3553; publisher owner is Activity Core.