Draft unsigned credential and decision sign-off batches.
INFD-WP-0002 T01–T02: eight one-question memos for net-kingdom-admins, batch contract without approve-all, no live bind (T08 still open). Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
parent
79f081850b
commit
27b8e916cc
24 changed files with 765 additions and 3 deletions
380
tools/prepare_compact_batches.py
Normal file
380
tools/prepare_compact_batches.py
Normal file
|
|
@ -0,0 +1,380 @@
|
|||
"""Draft unsigned compact sign-off batches (INFD-WP-0002-T01).
|
||||
|
||||
One question per memo. No secret values. Does not submit, present, or bind.
|
||||
"""
|
||||
from __future__ import annotations
|
||||
|
||||
import hashlib
|
||||
from pathlib import Path
|
||||
|
||||
from informed_decision.memo import (
|
||||
BindingLevel,
|
||||
BindingSlice,
|
||||
Highlight,
|
||||
Memo,
|
||||
PacketItem,
|
||||
Principal,
|
||||
Scope,
|
||||
StepKind,
|
||||
)
|
||||
from informed_decision.records import dumps, memo_from
|
||||
|
||||
ROOT = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14"
|
||||
REVIEW_GROUP = "net-kingdom-admins"
|
||||
PRINCIPAL = Principal(
|
||||
id="pending-human-session",
|
||||
kind="person",
|
||||
display_name="Named reviewer in net-kingdom-admins",
|
||||
role="reviewer",
|
||||
)
|
||||
|
||||
|
||||
def _sha(text: str) -> str:
|
||||
return "sha256:" + hashlib.sha256(text.encode()).hexdigest()
|
||||
|
||||
|
||||
def _memo(*, memo_id: str, question: str, brief: str, target: Scope, packet_id: str, packet_hash: str, highlight: str, workplan: str, task: str) -> Memo:
|
||||
return Memo(
|
||||
id=memo_id,
|
||||
version=1,
|
||||
question=question,
|
||||
requested_act="approve",
|
||||
binding_level=BindingLevel.ORGANIZATIONAL,
|
||||
brief=brief,
|
||||
binding=BindingSlice(principal=PRINCIPAL, target=target),
|
||||
step_kind=StepKind.APPROVE,
|
||||
packet=(PacketItem(packet_id, packet_id, packet_hash),),
|
||||
highlights=(
|
||||
Highlight(
|
||||
id=f"{memo_id}-h1",
|
||||
item_id=packet_id,
|
||||
note=highlight,
|
||||
required_ack=True,
|
||||
severity="critical",
|
||||
locator={"kind": "work_record", "workplan": workplan, "task": task},
|
||||
),
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
CREDENTIALS = [
|
||||
{
|
||||
"id": "infd-20260914-c01",
|
||||
"workplan": "SECRETS-WP-0010",
|
||||
"task": "Admit and verify real native delivery",
|
||||
"task_id": "2aa6d2d3-0000-0000-0000-000000000000",
|
||||
"hub_task_id": "2aa6d2d3",
|
||||
"question": "Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?",
|
||||
"brief": (
|
||||
"SECRETS-WP-0010 native delivery is waiting on a human admit. "
|
||||
"KeyCape redirects pass. This memo does not display, mint, or rotate a credential. "
|
||||
"It only asks whether the already-reviewed apply/verify/exec packets may proceed to live native delivery."
|
||||
),
|
||||
"highlight": "No secret value is in this packet. Admit is not a mint.",
|
||||
"target": Scope("secret-catalog-lane", "catalog:openrouter-llm-connect", "Existing llm-connect OpenRouter lane", "prod"),
|
||||
"packet": """# SECRETS-WP-0010 — admit native delivery
|
||||
|
||||
Blocking workplan: SECRETS-WP-0010
|
||||
Blocking task: Admit and verify real native delivery (hub prefix 2aa6d2d3)
|
||||
|
||||
## Question
|
||||
Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?
|
||||
|
||||
## One act
|
||||
Authorize the operator in `net-kingdom-admins` to complete the already-prepared
|
||||
apply / verify / exec packets. This is not a new OpenBao path and not a key mint.
|
||||
|
||||
## Must not
|
||||
- Paste or display credential material
|
||||
- Call OpenRouter inference
|
||||
- Treat `ops-warden` as a secret vendor
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-c02",
|
||||
"workplan": "RPF-WP-0035",
|
||||
"task": "RPF-WP-0035-T02",
|
||||
"hub_task_id": "e0c82ea9",
|
||||
"question": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?",
|
||||
"brief": (
|
||||
"RPF-WP-0035-T02 waits on accepting and provisioning secrets-engine service JWT login. "
|
||||
"This memo is the accept question only. Provisioning remains the platform owner's act after bind."
|
||||
),
|
||||
"highlight": "Accept is not permission to invent a client_secret in this memo.",
|
||||
"target": Scope("credential-lane", "rpf-wp-0035-t02", "secrets-engine service JWT login", "prod"),
|
||||
"packet": """# RPF-WP-0035-T02 — accept JWT login lane
|
||||
|
||||
Blocking workplan: RPF-WP-0035
|
||||
Blocking task: RPF-WP-0035-T02 (hub prefix e0c82ea9)
|
||||
|
||||
## Question
|
||||
Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?
|
||||
|
||||
## One act
|
||||
Organizational accept that this lane may be provisioned by its owner. The memo
|
||||
does not contain a JWT, client secret, or OpenBao policy body.
|
||||
|
||||
## Must not
|
||||
- Embed a token
|
||||
- Collapse T02 with T03 Fluid lane or T06 reader admission
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-c03",
|
||||
"workplan": "NK-WP-0032",
|
||||
"task": "NK-WP-0032-T03",
|
||||
"hub_task_id": "73b77110",
|
||||
"question": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?",
|
||||
"brief": (
|
||||
"NK-WP-0032-T03 applies a live OpenBao role addition. This memo asks only whether that apply may proceed. "
|
||||
"The role body stays in the owning repo; it is not copied here."
|
||||
),
|
||||
"highlight": "Apply is one role addition, not a general OpenBao admin grant.",
|
||||
"target": Scope("openbao-role", "nk-wp-0032-t03", "OpenBao role addition for operator-tunneled callback", "prod"),
|
||||
"packet": """# NK-WP-0032-T03 — apply live OpenBao role
|
||||
|
||||
Blocking workplan: NK-WP-0032
|
||||
Blocking task: NK-WP-0032-T03 (hub prefix 73b77110)
|
||||
|
||||
## Question
|
||||
Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?
|
||||
|
||||
## One act
|
||||
Authorize the NetKingdom owner to apply the already-specified role. This memo
|
||||
does not include the policy HCL or any secret id.
|
||||
|
||||
## Must not
|
||||
- Broaden to unattended public OpenBao UI
|
||||
- Treat this as NK-WP-0032-T04 evidence return
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-c04",
|
||||
"workplan": "WARDEN-WP-0027",
|
||||
"task": "WARDEN-WP-0027-T02",
|
||||
"hub_task_id": "cae498ee",
|
||||
"question": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work?",
|
||||
"brief": (
|
||||
"WARDEN-WP-0027-T02 is attended seal work. This memo asks the reviewer to attend that seal sitting. "
|
||||
"ops-warden still issues SSH certificates only; this is not a request for an API key."
|
||||
),
|
||||
"highlight": "ops-warden does not vend API keys. This is an attended seal, not a secret paste.",
|
||||
"target": Scope("trust-root", "warden-wp-0027-t02", "ops-warden graded lockdown / break-glass", "prod"),
|
||||
"packet": """# WARDEN-WP-0027-T02 — attend graded lockdown seal
|
||||
|
||||
Blocking workplan: WARDEN-WP-0027
|
||||
Blocking task: WARDEN-WP-0027-T02 (hub prefix cae498ee)
|
||||
|
||||
## Question
|
||||
Attend the graded lockdown / break-glass seal for ops-warden trust-root work?
|
||||
|
||||
## One act
|
||||
Schedule/complete the attended seal. Credential routing remains: SSH certs from
|
||||
ops-warden; other secrets from OpenBao via `warden route` pointers.
|
||||
|
||||
## Must not
|
||||
- Ask ops-warden for ISSUE_CORE_API_KEY or similar
|
||||
- Record seal material in this packet
|
||||
""",
|
||||
},
|
||||
]
|
||||
|
||||
DECISIONS = [
|
||||
{
|
||||
"id": "infd-20260914-d01",
|
||||
"workplan": "CUST-WP-0038",
|
||||
"task": "CUST-WP-0038-T08",
|
||||
"hub_task_id": "57412aef",
|
||||
"question": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback?",
|
||||
"brief": (
|
||||
"CUST-WP-0038-T08 requires explicit approval after drills. This memo is that approval question. "
|
||||
"It does not assert that the drills have already passed."
|
||||
),
|
||||
"highlight": "Approve only if you accept that WSL2 leaves both normal and fallback operating models.",
|
||||
"target": Scope("operating-model", "cust-wp-0038-t08", "Retire WSL2 State Hub fallback", "prod"),
|
||||
"packet": """# CUST-WP-0038-T08 — retire WSL2 fallback
|
||||
|
||||
Blocking workplan: CUST-WP-0038
|
||||
Blocking task: CUST-WP-0038-T08 (hub prefix 57412aef, needs_human)
|
||||
|
||||
## Question
|
||||
After HA failover and restore drills pass, retire WSL2 as a State Hub fallback?
|
||||
|
||||
## One act
|
||||
Founder/operator approval of the retirement once T05/T06 drills have passed.
|
||||
This memo does not skip the drills.
|
||||
|
||||
## Must not
|
||||
- Treat this accept as proof that drills already passed
|
||||
- Keep WSL2 as an undeclared fallback after accept
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-d02",
|
||||
"workplan": "HFACT-WP-0001",
|
||||
"task": "HFACT-WP-0001-T03",
|
||||
"hub_task_id": "67c80db1",
|
||||
"question": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path?",
|
||||
"brief": (
|
||||
"HFACT-WP-0001-T03 waits on NetKingdom/KeyCape confirmation of the exact existing operator-group claim. "
|
||||
"This memo is that confirmation question. It does not mint a new group."
|
||||
),
|
||||
"highlight": "Confirm the existing claim. Do not invent a new group or CCR.",
|
||||
"target": Scope("ccr", "ccr-2026-0019", "Existing operator-group claim for factory path", "prod"),
|
||||
"packet": """# HFACT-WP-0001-T03 — confirm CCR-2026-0019 operator-group
|
||||
|
||||
Blocking workplan: HFACT-WP-0001
|
||||
Blocking task: HFACT-WP-0001-T03 (hub prefix 67c80db1, needs_human)
|
||||
|
||||
## Question
|
||||
Confirm the existing operator-group claim for CCR-2026-0019 as required by the
|
||||
factory identity, audit and approval path?
|
||||
|
||||
## One act
|
||||
Confirm the already-named operator-group claim. Required-owner review and
|
||||
attended apply remain separate acts.
|
||||
|
||||
## Must not
|
||||
- Create a new CCR in this memo
|
||||
- Collapse T03 with T05 live worker proof
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-d03",
|
||||
"workplan": "MASON-WP-0005",
|
||||
"task": "Review the plan and obtain the decision",
|
||||
"hub_task_id": "48a2b4ec",
|
||||
"question": "Accept the fluid-telegram operator credential lane plan so construction may proceed?",
|
||||
"brief": (
|
||||
"MASON-WP-0005 has a review/decision task before building the operator lane. "
|
||||
"This memo is that plan accept. Path/OIDC binding (another task) is a separate memo if needed later."
|
||||
),
|
||||
"highlight": "Accepting the plan is not confirming the OIDC binding and is not a BotFather login.",
|
||||
"target": Scope("workplan", "mason-wp-0005", "fluid-telegram operator credential lane plan", "prod"),
|
||||
"packet": """# MASON-WP-0005 — accept operator lane plan
|
||||
|
||||
Blocking workplan: MASON-WP-0005
|
||||
Blocking task: Review the plan and obtain the decision (hub prefix 48a2b4ec)
|
||||
|
||||
## Question
|
||||
Accept the fluid-telegram operator credential lane plan so construction may proceed?
|
||||
|
||||
## One act
|
||||
Organizational accept of the written plan. BotFather login, DNS, and OIDC
|
||||
binding remain other tasks.
|
||||
|
||||
## Must not
|
||||
- Perform BotFather login in this sitting
|
||||
- Record a telegram token
|
||||
""",
|
||||
},
|
||||
{
|
||||
"id": "infd-20260914-d04",
|
||||
"workplan": "RCLK-WP-0002",
|
||||
"task": "RCLK-WP-0002-T01",
|
||||
"hub_task_id": "437734bd",
|
||||
"question": "Confirm ecosystem ownership and the security role for Railiance Clock as specified?",
|
||||
"brief": (
|
||||
"RCLK-WP-0002-T01 is the owner/security-role confirmation. This memo is that confirmation. "
|
||||
"It does not change OS clocks or admit railiance01 as production time authority by itself."
|
||||
),
|
||||
"highlight": "Confirmation is ownership/role, not a clock change on any host.",
|
||||
"target": Scope("workplan", "rclk-wp-0002-t01", "Railiance Clock ownership and security role", "prod"),
|
||||
"packet": """# RCLK-WP-0002-T01 — confirm clock ownership
|
||||
|
||||
Blocking workplan: RCLK-WP-0002
|
||||
Blocking task: RCLK-WP-0002-T01 (hub prefix 437734bd)
|
||||
|
||||
## Question
|
||||
Confirm ecosystem ownership and the security role for Railiance Clock as specified?
|
||||
|
||||
## One act
|
||||
Owner confirmation of the documented role split (railiance-infra for host UTC,
|
||||
clock repo for specs). No NTP or OS change is authorized by this memo.
|
||||
|
||||
## Must not
|
||||
- Change ntp.ubuntu.com or systemd-timesyncd from this sitting
|
||||
- Treat this as RCLK-WP-0004 pilot admission
|
||||
""",
|
||||
},
|
||||
]
|
||||
|
||||
|
||||
def write_batch(name: str, items: list[dict]) -> dict:
|
||||
directory = ROOT / name
|
||||
directory.mkdir(parents=True, exist_ok=True)
|
||||
index = {
|
||||
"kind": "informed-decision-batch",
|
||||
"id": f"infd-batch-2026-09-14-{name}",
|
||||
"review_group": REVIEW_GROUP,
|
||||
"status": "draft-unsigned",
|
||||
"submitted": False,
|
||||
"one_question_per_memo": True,
|
||||
"approve_all_forbidden": True,
|
||||
"agent_disposition_forbidden": True,
|
||||
"ordinal": [],
|
||||
}
|
||||
for i, item in enumerate(items, start=1):
|
||||
packet_path = directory / f"{item['id']}.packet.md"
|
||||
packet_path.write_text(item["packet"], encoding="utf-8")
|
||||
digest = _sha(item["packet"])
|
||||
memo = _memo(
|
||||
memo_id=item["id"],
|
||||
question=item["question"],
|
||||
brief=item["brief"],
|
||||
target=item["target"],
|
||||
packet_id=item["id"] + "-packet",
|
||||
packet_hash=digest,
|
||||
highlight=item["highlight"],
|
||||
workplan=item["workplan"],
|
||||
task=item["task"],
|
||||
)
|
||||
loaded = memo_from(__import__("json").loads(dumps(memo)))
|
||||
if loaded.question != item["question"]:
|
||||
raise RuntimeError("round-trip failed")
|
||||
memo_path = directory / f"{item['id']}.memo.json"
|
||||
memo_path.write_text(dumps(memo) + "\n", encoding="utf-8")
|
||||
index["ordinal"].append(
|
||||
{
|
||||
"n": i,
|
||||
"memo_id": item["id"],
|
||||
"workplan": item["workplan"],
|
||||
"task": item["task"],
|
||||
"hub_task_prefix": item["hub_task_id"],
|
||||
"question": item["question"],
|
||||
"memo": memo_path.name,
|
||||
"packet": packet_path.name,
|
||||
"packet_hash": digest,
|
||||
"required_highlight": f"{item['id']}-h1",
|
||||
}
|
||||
)
|
||||
(directory / "index.json").write_text(
|
||||
__import__("json").dumps(index, indent=2, ensure_ascii=False) + "\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
return index
|
||||
|
||||
|
||||
def main() -> None:
|
||||
ROOT.mkdir(parents=True, exist_ok=True)
|
||||
cred = write_batch("credentials", CREDENTIALS)
|
||||
dec = write_batch("decisions", DECISIONS)
|
||||
sitting = {
|
||||
"kind": "informed-decision-sitting",
|
||||
"id": "infd-sitting-2026-09-14",
|
||||
"review_group": REVIEW_GROUP,
|
||||
"status": "draft-unsigned",
|
||||
"batches": [cred["id"], dec["id"]],
|
||||
"memo_count": len(cred["ordinal"]) + len(dec["ordinal"]),
|
||||
"bind_path": "INFD-WP-0001-T08 (not yet complete)",
|
||||
"note": "Unsigned drafts. Do not submit until CompactSignoffBatches.md is accepted. Live bind substitutes pending-human-session with the authenticated key-cape subject.",
|
||||
}
|
||||
(ROOT / "sitting.json").write_text(
|
||||
__import__("json").dumps(sitting, indent=2, ensure_ascii=False) + "\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
print(f"Wrote {sitting['memo_count']} unsigned memos under {ROOT}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Loading…
Add table
Add a link
Reference in a new issue