coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: reject duplicate keys in execution catalogs
All checks were successful
ci / validate (push) Successful in 2m53s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
This commit is contained in:
tegwick 2026-09-06 09:31:49 +02:00
parent f5eec5b23f
commit 863fab7a3b
5 changed files with 97 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

15
workplans/ADHOC-2026-09-06.md
View file

@ -52,3 +52,18 @@ the fix and passes afterwards.
Validation: full suite 104 passed; profile catalog validation passed with
existing readiness unchanged. Reviewed credential owner update and refreshed
the proposed policy reference in docs/anthropic-workload-key.md.
## Reject ambiguous catalog YAML
```task
id: ADHOC-2026-09-06-T03
status: done
priority: medium
```
Follow-up repository review found that YAML silently overwrote duplicate keys
before profile validation. Both profile and rein descriptor loading now reject
duplicate keys at every mapping depth, including merge collisions. Disjoint
merges remain supported. Four regression cases reproduced silent acceptance
before the change. Full suite: 110 passed; committed catalog validation passes.
No residuals from this bounded fix; GLAS-WP-0012 retains the live-proof work.

15
workplans/GLAS-WP-0012-first-local-profile-production-proof.md
View file

@ -234,3 +234,18 @@ by configuration, per-lane approval and positive/negative verification.
State Hub decisions are not a substitute for the durable authorization object.
SECRETS-WP-0009-T03 and this plan's T02 remain waiting; runtime pinning and
combined real proof remain required. No readiness change or real-key read.
## 2026-09-06 authorization contract and policy publication
Reviewed owner commits `7b4b9e3` and `083bee7` and FLEX-WP-0021. Gate-house
GH-DEC-2026-005 resolved the contract: secrets-engine now validates the
approval-claim and decision envelope separately and removed the incorrect
State Hub authority requirement. Flex-auth published
`secrets-engine.catalog-lane.lifecycle` v1; T01/T02 are done.
Remaining owner gates are real decision/digest verification (FLEX-WP-0021-T03),
consumer service deployment and handoff (T04/T05), approval-engine deployment,
production service identity and verified lane activation. Publication is not
deployment. T02 stays waiting, and runtime pinning and combined acceptance
remain required. No new owner inbox message or activation evidence was found
in this review.