From a004d9f4fe51cad6319d918e1aa8d81ed075ead7 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 10:42:35 +0200 Subject: [PATCH] Prepare the 2026-10-05 dependency-root sitting (six memos, unposted). Unsigned drafts only. Five incomplete acts stay excluded. No approval was created and no memo was loaded. Assistant: grok Assistant-Session: 01a10938-ab49-7280-877a-c06f64c06ddd --- .../2026-10-05-dependency-roots/OPERATOR.md | 33 + .../approval-create-intents.json | 115 ++++ .../dependency-roots/index.json | 140 +++++ ...61005-activity-empty-projections.memo.json | 1 + ...61005-activity-empty-projections.packet.md | 28 + .../infd-20261005-hall-signing-key.memo.json | 1 + .../infd-20261005-hall-signing-key.packet.md | 17 + .../infd-20261005-s1-red-controls.memo.json | 1 + .../infd-20261005-s1-red-controls.packet.md | 31 + .../infd-20261005-telegram-bot.memo.json | 1 + .../infd-20261005-telegram-bot.packet.md | 19 + .../infd-20261005-telegram-channels.memo.json | 1 + .../infd-20261005-telegram-channels.packet.md | 18 + ...d-20261005-telegram-user-session.memo.json | 1 + ...d-20261005-telegram-user-session.packet.md | 19 + .../2026-10-05-dependency-roots/sitting.json | 16 + tools/prepare_dependency_root_batch.py | 593 ++++++++++++++++++ 17 files changed, 1035 insertions(+) create mode 100644 docs/batches/2026-10-05-dependency-roots/OPERATOR.md create mode 100644 docs/batches/2026-10-05-dependency-roots/approval-create-intents.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/index.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.memo.json create mode 100644 docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.packet.md create mode 100644 docs/batches/2026-10-05-dependency-roots/sitting.json create mode 100644 tools/prepare_dependency_root_batch.py diff --git a/docs/batches/2026-10-05-dependency-roots/OPERATOR.md b/docs/batches/2026-10-05-dependency-roots/OPERATOR.md new file mode 100644 index 0000000..91c9165 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/OPERATOR.md @@ -0,0 +1,33 @@ +# Dependency-root sitting — operator packet + +Drafted 2026-10-05. Not posted. An agent may not accept, decline, or seal. +Review group: `net-kingdom-admins`. Surface, once a human opens the sitting: +https://decisions.coulomb.social/ +Generator: `tools/prepare_dependency_root_batch.py`. + +This sitting groups separate hub decisions. There is no approve-all. +An answer on one memo does not answer the others. `resolves: never` means +the answer must not be written back as a resolve of the shared hub decision. + +| n | memo_id | task | resolves | question | +| --: | --- | --- | --- | --- | +| 1 | `infd-20261005-s1-red-controls` | RAIL-HO-WP-0011-T05 | on-answer | Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh? | +| 2 | `infd-20261005-activity-empty-projections` | STATE-WP-0095-T04 | never | Approve retirement of only the three named empty Activity projections while preserving their parent projection? | +| 3 | `infd-20261005-hall-signing-key` | FT-WP-0001-T04 | on-answer | Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft? | +| 4 | `infd-20261005-telegram-bot` | FLUID-WP-0008-T02 | never | Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path? | +| 5 | `infd-20261005-telegram-channels` | FLUID-WP-0008-T03 | never | Authorize one attended creation of the private HelixForge test channel and then the public channel? | +| 6 | `infd-20261005-telegram-user-session` | FT-WP-0002-T01 | never | Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git? | + +## Excluded + +- `KEY-WP-0037-T03` (caafe4be-4f68-47b4-9567-316d47b94992): Custody boundary 632a8893 is approved. The live registration still has no exact reviewed revision, image digest, config preservation test, or synthetic issuance and denial record. Resolving caafe4be would be that live go. +- `FT-WP-0001-T07` (8a095daa-35f9-4561-ae50-256558600be7): Ninety-four hall entries have no Telegram-channel agreement. The decision asks which basis to record, including whether a revocable standing agreement belongs in hall-of-helix/ENTRY.md and how earlier contributors are asked. That choice is not yet a single prepared act. +- `RAPPS-WP-0014-T03` (d06307e5-2737-461a-a2f4-a12c3b492a9a): The invited two-user workflow is not ready to run. Create login for the invited tenant-admin was refused because that email already belongs to directory login platform-root. No second login was created. +- `STATE-WP-0079-T06` (2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd): The same hub decision also covers the single-node risk, the core-hub cutover, clock verification, and live-host authorization. Stopping the primary still waits on STATE-WP-0079-T04 route receipts and the legacy-meter week. +- `RPF-WP-0044-T03` (89f1058f-33bc-47a8-8a49-0b44d426c67e): The ArgoCD go-ahead covers issue-core, policy-nexus, activity-core automation, and prune restoration. The policy-nexus Application draft still has unfilled revision and values placeholders. One memo cannot carry those acts. + +## Not done by this draft + +No approval object was created. No memo was loaded into the review store. +No lifecycle review was requested. The founder binds on the review surface +after a human opens the sitting. diff --git a/docs/batches/2026-10-05-dependency-roots/approval-create-intents.json b/docs/batches/2026-10-05-dependency-roots/approval-create-intents.json new file mode 100644 index 0000000..20fb981 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/approval-create-intents.json @@ -0,0 +1,115 @@ +{ + "kind": "informed-decision-approval-create-intents", + "sitting_id": "infd-sitting-2026-10-05-dependency-roots", + "status": "not-posted", + "posted": false, + "requester_client": "informed-decision-sitting-requester", + "human_control": true, + "pdp_path": false, + "required_count": 1, + "note": "Intents only. Digests are computed by approval-engine at create; do not invent them here. Not posted.", + "intents": [ + { + "memo_id": "infd-20261005-s1-red-controls", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "railiance-infra", + "purpose": "Approve remediation of the two red S1 controls from the 2026-10-05 Goss refresh", + "target": { + "id": "rail-ho-wp-0011-t05", + "type": "host-baseline", + "system": "railiance-infra" + } + }, + "hub_decision": "83263d8d-d6ee-4395-ac84-86b71e967648", + "resolves": "on-answer" + }, + { + "memo_id": "infd-20261005-activity-empty-projections", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "state-hub", + "purpose": "Approve the prepared disposition of three empty Activity projections", + "target": { + "id": "activity-history-duplicate-disposition-20261004", + "type": "projection-disposition", + "system": "state-hub" + } + }, + "hub_decision": "91b7c633-a66f-5d43-9f4b-6565aefb9356", + "resolves": "never" + }, + { + "memo_id": "infd-20261005-hall-signing-key", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-telegram", + "purpose": "Authorize a durable Hall of Helix R-1 signing key held outside git", + "target": { + "id": "ft-wp-0001-t04", + "type": "signing-key", + "system": "fluid-telegram" + } + }, + "hub_decision": "d5d8a24d-d77e-4c63-ab52-b878d687e8b9", + "resolves": "on-answer" + }, + { + "memo_id": "infd-20261005-telegram-bot", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-core", + "purpose": "Authorize one attended HelixForge bot registration", + "target": { + "id": "fluid-wp-0008-t02", + "type": "operator-session", + "system": "fluid-core" + } + }, + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never" + }, + { + "memo_id": "infd-20261005-telegram-channels", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-core", + "purpose": "Authorize attended creation of the HelixForge channels", + "target": { + "id": "fluid-wp-0008-t03", + "type": "operator-session", + "system": "fluid-core" + } + }, + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never" + }, + { + "memo_id": "infd-20261005-telegram-user-session", + "create_client": "informed-decision-sitting-requester", + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-telegram", + "purpose": "Authorize the attended FT-WP-0002 account-session bootstrap", + "target": { + "id": "ft-wp-0002-t01", + "type": "operator-session", + "system": "fluid-telegram" + } + }, + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never" + } + ] +} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/index.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/index.json new file mode 100644 index 0000000..a94d5f5 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/index.json @@ -0,0 +1,140 @@ +{ + "kind": "informed-decision-batch", + "id": "infd-batch-2026-10-05-dependency-roots", + "review_group": "net-kingdom-admins", + "status": "draft-unsigned", + "submitted": false, + "one_question_per_memo": true, + "approve_all_forbidden": true, + "agent_disposition_forbidden": true, + "hub_decision": null, + "note": "Several hub decisions. Each ordinal names its own decision and whether an answer may resolve it. There is no batch verdict.", + "ordinal": [ + { + "n": 1, + "memo_id": "infd-20261005-s1-red-controls", + "workplan": "RAIL-HO-WP-0011", + "task": "RAIL-HO-WP-0011-T05", + "hub_task_prefix": "ba526585", + "hub_decision": "83263d8d-d6ee-4395-ac84-86b71e967648", + "resolves": "on-answer", + "question": "Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh?", + "memo": "infd-20261005-s1-red-controls.memo.json", + "packet": "infd-20261005-s1-red-controls.packet.md", + "packet_hash": "sha256:78b392880aed8abeb8207cbc934ce48a575fa20230b64f47db0b44e795b8dac9", + "required_highlight": "infd-20261005-s1-red-controls-h1" + }, + { + "n": 2, + "memo_id": "infd-20261005-activity-empty-projections", + "workplan": "STATE-WP-0095", + "task": "STATE-WP-0095-T04", + "hub_task_prefix": "3bbb311f", + "hub_decision": "91b7c633-a66f-5d43-9f4b-6565aefb9356", + "resolves": "never", + "question": "Approve retirement of only the three named empty Activity projections while preserving their parent projection?", + "memo": "infd-20261005-activity-empty-projections.memo.json", + "packet": "infd-20261005-activity-empty-projections.packet.md", + "packet_hash": "sha256:4d688f61ab083828900eb3aa19923508a838bbe7e4ce67f63cd80e517d03d5cb", + "required_highlight": "infd-20261005-activity-empty-projections-h1" + }, + { + "n": 3, + "memo_id": "infd-20261005-hall-signing-key", + "workplan": "FT-WP-0001", + "task": "FT-WP-0001-T04", + "hub_task_prefix": "13a92a96", + "hub_decision": "d5d8a24d-d77e-4c63-ab52-b878d687e8b9", + "resolves": "on-answer", + "question": "Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft?", + "memo": "infd-20261005-hall-signing-key.memo.json", + "packet": "infd-20261005-hall-signing-key.packet.md", + "packet_hash": "sha256:6bbdbf05df67a0260901aaf5a71d6115184928311dfc0bb1be632f0678850d67", + "required_highlight": "infd-20261005-hall-signing-key-h1" + }, + { + "n": 4, + "memo_id": "infd-20261005-telegram-bot", + "workplan": "FLUID-WP-0008", + "task": "FLUID-WP-0008-T02", + "hub_task_prefix": "9896fee4", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path?", + "memo": "infd-20261005-telegram-bot.memo.json", + "packet": "infd-20261005-telegram-bot.packet.md", + "packet_hash": "sha256:96207c5acbc9c7a40780c7b072a3d917400fcb48309000a71d6c9bb769a14e8c", + "required_highlight": "infd-20261005-telegram-bot-h1" + }, + { + "n": 5, + "memo_id": "infd-20261005-telegram-channels", + "workplan": "FLUID-WP-0008", + "task": "FLUID-WP-0008-T03", + "hub_task_prefix": "bb02bf5b", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended creation of the private HelixForge test channel and then the public channel?", + "memo": "infd-20261005-telegram-channels.memo.json", + "packet": "infd-20261005-telegram-channels.packet.md", + "packet_hash": "sha256:4c9cfa1efaa670f65731982f4b6c7963464eab5d41e39b329f856fb1abb0eaac", + "required_highlight": "infd-20261005-telegram-channels-h1" + }, + { + "n": 6, + "memo_id": "infd-20261005-telegram-user-session", + "workplan": "FT-WP-0002", + "task": "FT-WP-0002-T01", + "hub_task_prefix": "039e5358", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git?", + "memo": "infd-20261005-telegram-user-session.memo.json", + "packet": "infd-20261005-telegram-user-session.packet.md", + "packet_hash": "sha256:1ab0ff7d80de6466cc3e08f8ba847fee88a30d2f7fbf82ce88d25e5b0fb7359d", + "required_highlight": "infd-20261005-telegram-user-session-h1" + } + ], + "excluded": [ + { + "workplan": "KEY-WP-0037", + "task": "KEY-WP-0037-T03", + "owner_repo": "key-cape", + "hub_decision": "caafe4be-4f68-47b4-9567-316d47b94992", + "reason": "Custody boundary 632a8893 is approved. The live registration still has no exact reviewed revision, image digest, config preservation test, or synthetic issuance and denial record. Resolving caafe4be would be that live go.", + "ready_when": "An owner records the exact revision, digest, preservation test, and synthetic issuance and denial, then one memo asks only for the live go." + }, + { + "workplan": "FT-WP-0001", + "task": "FT-WP-0001-T07", + "owner_repo": "fluid-telegram", + "hub_decision": "8a095daa-35f9-4561-ae50-256558600be7", + "reason": "Ninety-four hall entries have no Telegram-channel agreement. The decision asks which basis to record, including whether a revocable standing agreement belongs in hall-of-helix/ENTRY.md and how earlier contributors are asked. That choice is not yet a single prepared act.", + "ready_when": "The hall owner writes the candidate basis as one question with the exact text the founder would be accepting." + }, + { + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "owner_repo": "railiance-apps", + "hub_decision": "d06307e5-2737-461a-a2f4-a12c3b492a9a", + "reason": "The invited two-user workflow is not ready to run. Create login for the invited tenant-admin was refused because that email already belongs to directory login platform-root. No second login was created.", + "ready_when": "The account owner records a usable second person, then one memo asks the founder to run the acceptance with that person." + }, + { + "workplan": "STATE-WP-0079", + "task": "STATE-WP-0079-T06", + "owner_repo": "state-hub", + "hub_decision": "2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd", + "reason": "The same hub decision also covers the single-node risk, the core-hub cutover, clock verification, and live-host authorization. Stopping the primary still waits on STATE-WP-0079-T04 route receipts and the legacy-meter week.", + "ready_when": "Each remaining act has its own reviewed packet. Do not pose the bundle as one memo." + }, + { + "workplan": "RPF-WP-0044", + "task": "RPF-WP-0044-T03", + "owner_repo": "railiance-platform", + "hub_decision": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "reason": "The ArgoCD go-ahead covers issue-core, policy-nexus, activity-core automation, and prune restoration. The policy-nexus Application draft still has unfilled revision and values placeholders. One memo cannot carry those acts.", + "ready_when": "Each adoption has one reviewed command and its own memo." + } + ] +} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.memo.json new file mode 100644 index 0000000..c428083 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"activity-history-duplicate-disposition-20261004","kind":"projection-disposition","label":"Three empty Activity historical projections","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"Normal Activity replay refused three empty historical projections. The prepared set names those three UUIDs and preserves the parent. State Hub source commit 968a811 can require that exact set. Accepting records the disposition. It does not retire a row.","highlights":[{"id":"infd-20261005-activity-empty-projections-h1","item_id":"infd-20261005-activity-empty-projections-packet","locator":{"kind":"work_record","task":"STATE-WP-0095-T04","workplan":"STATE-WP-0095"},"note":"Targets are 683724d9-4249-5e0e-88e0-7baff4330d58 (custodian-wp-0003), 644017c7-c5f2-5a64-81c3-d8ee806f8251 (custodian-wp-0003a) and a5806df9-5b9a-50da-81c1-7e606076bed9 (custodian-wp-0003b). Preserve parent b4eb45a9-69e3-4ab0-b00c-67a53c3117c5. Activity Core still owes its own return. Accepting is not a live retirement, a deletion, or a rollout of 968a811.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-activity-empty-projections","locale":"en","packet":[{"hash":"sha256:4d688f61ab083828900eb3aa19923508a838bbe7e4ce67f63cd80e517d03d5cb","item_id":"infd-20261005-activity-empty-projections-packet","label":"infd-20261005-activity-empty-projections-packet"}],"question":"Approve retirement of only the three named empty Activity projections while preserving their parent projection?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.packet.md new file mode 100644 index 0000000..4591e9c --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-activity-empty-projections.packet.md @@ -0,0 +1,28 @@ +# STATE-WP-0095-T04 — three empty Activity projections + +Blocking workplan: STATE-WP-0095 (state-hub) +Blocking task: STATE-WP-0095-T04 (hub prefix 3bbb311f) +Hub decision: 91b7c633-a66f-5d43-9f4b-6565aefb9356 +Proposal: the-custodian `docs/evidence/2026-10-04-dependency-root-wave/activity-stale-disposition-proposal.json` +Source exact-set: state-hub commit `968a811` (on origin/main). Not a live rollout. + +## Question +Approve retirement of only the three named empty Activity projections while preserving their parent projection? + +## Exact set +- `683724d9-4249-5e0e-88e0-7baff4330d58` slug custodian-wp-0003 +- `644017c7-c5f2-5a64-81c3-d8ee806f8251` slug custodian-wp-0003a +- `a5806df9-5b9a-50da-81c1-7e606076bed9` slug custodian-wp-0003b +- Preserve parent `b4eb45a9-69e3-4ab0-b00c-67a53c3117c5` + +Each target was recorded with zero tasks and zero global dependency edges. + +## One act +Record the founder's disposition of that set. An answer here does not resolve +the hub decision by itself, because Activity Core's separate return and a +reviewed live writer are still required before any retirement runs. + +## Must not +- Blanket-acknowledge every stale projection +- Delete rows, replace UUIDs, move tasks, or rewrite source history +- Treat source commit 968a811 as already deployed diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.memo.json new file mode 100644 index 0000000..ad0d1d4 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"ft-wp-0001-t04","kind":"signing-key","label":"Durable Hall of Helix R-1 signing key outside git","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"FT-WP-0001-T04 cannot publish R-1 with an ephemeral key. The key has to survive restart and stay outside git. Accepting authorizes that key. This draft does not create it and does not publish R-1.","highlights":[{"id":"infd-20261005-hall-signing-key-h1","item_id":"infd-20261005-hall-signing-key-packet","locator":{"kind":"work_record","task":"FT-WP-0001-T04","workplan":"FT-WP-0001"},"note":"No key material is in this packet. Accepting does not create the key, does not choose a generated value, and does not publish revision R-1. A later attended lane has to create the key outside every worktree.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-hall-signing-key","locale":"en","packet":[{"hash":"sha256:6bbdbf05df67a0260901aaf5a71d6115184928311dfc0bb1be632f0678850d67","item_id":"infd-20261005-hall-signing-key-packet","label":"infd-20261005-hall-signing-key-packet"}],"question":"Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.packet.md new file mode 100644 index 0000000..6ec6380 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-hall-signing-key.packet.md @@ -0,0 +1,17 @@ +# FT-WP-0001-T04 — durable signing key + +Blocking workplan: FT-WP-0001 (fluid-telegram) +Blocking task: FT-WP-0001-T04 (hub prefix 13a92a96) +Hub decision: d5d8a24d-d77e-4c63-ab52-b878d687e8b9 + +## Question +Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft? + +## One act +Authorize a later attended creation of one durable signing key for Hall of Helix +revision R-1. The key stays outside git and outside the hall worktree. + +## Must not +- Put key material in this packet, in git, or in a workplan +- Publish R-1 as part of this answer +- Treat an ephemeral process key as satisfying the task diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.memo.json new file mode 100644 index 0000000..7296f89 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"rail-ho-wp-0011-t05","kind":"host-baseline","label":"Two red S1 controls from the 2026-10-05 Goss refresh","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"The attended refresh already installed the source-rendered Goss surface on Railiance01 and CoulombCore. Validation then failed on two controls. Accepting this memo approves a later reviewed remediation of only those controls. This draft does not edit a host.","highlights":[{"id":"infd-20261005-s1-red-controls-h1","item_id":"infd-20261005-s1-red-controls-packet","locator":{"kind":"work_record","task":"RAIL-HO-WP-0011-T05","workplan":"RAIL-HO-WP-0011"},"note":"Railiance01 failed 1 of 48 checks: /etc/ssh/sshd_config.d/10-hardening.conf lacks the line ChallengeResponseAuthentication no. CoulombCore failed 2 of 28 checks: /usr/local/bin/age is not executable, and the same SSH line is absent. Firewall checks passed, including CoulombCore iptables INPUT DROP. Accepting does not enable UFW, rerun the refresh, or change any other SSH line.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-s1-red-controls","locale":"en","packet":[{"hash":"sha256:78b392880aed8abeb8207cbc934ce48a575fa20230b64f47db0b44e795b8dac9","item_id":"infd-20261005-s1-red-controls-packet","label":"infd-20261005-s1-red-controls-packet"}],"question":"Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.packet.md new file mode 100644 index 0000000..63efaff --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-s1-red-controls.packet.md @@ -0,0 +1,31 @@ +# RAIL-HO-WP-0011-T05 — two red S1 controls + +Blocking workplan: RAIL-HO-WP-0011 (railiance-infra) +Blocking task: RAIL-HO-WP-0011-T05 (hub prefix ba526585) +Hub decision: 83263d8d-d6ee-4395-ac84-86b71e967648 + +## Question +Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh? + +## What already ran +`make verify-refresh-host` with the per-host approval tokens ran for Railiance01 +and CoulombCore after the rendered baseline was reviewed. Both hosts now have +the goss binary, `/etc/goss/baseline.yaml`, the wrapper, the service, and the +hourly timer. Validation exited non-zero after that install. + +## The two controls +- Railiance01, 1 of 48: `/etc/ssh/sshd_config.d/10-hardening.conf` lacks + `ChallengeResponseAuthentication no`. +- CoulombCore, 2 of 28: `/usr/local/bin/age` is not executable, and the same + SSH line is absent. +- Firewall checks passed, including CoulombCore `iptables -S INPUT` policy DROP + and Railiance01 tunnel-only 6443. + +## One act +Authorize a later reviewed change that adds only that SSH line on both hosts +and makes `/usr/local/bin/age` executable on CoulombCore. + +## Must not +- Enable or rewrite UFW on CoulombCore +- Rerun the Goss refresh as a substitute for the two controls +- Treat this draft as the host change itself diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.memo.json new file mode 100644 index 0000000..8e63aa5 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"fluid-wp-0008-t02","kind":"operator-session","label":"HelixForge bot registration","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"FLUID-WP-0008-T02 and FT-WP-0001-T01 are the same human step. Accepting authorizes that registration. This draft does not call BotFather and does not store a credential. The shared hub decision also covers channels and the user session, so this answer must not be treated as resolving those other acts.","highlights":[{"id":"infd-20261005-telegram-bot-h1","item_id":"infd-20261005-telegram-bot-packet","locator":{"kind":"work_record","task":"FLUID-WP-0008-T02","workplan":"FLUID-WP-0008"},"note":"The BotFather result stays on the attended OpenBao path and never enters git. Accepting does not register the bot. It does not create channels and it does not bootstrap the FT-WP-0002 account session.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-telegram-bot","locale":"en","packet":[{"hash":"sha256:96207c5acbc9c7a40780c7b072a3d917400fcb48309000a71d6c9bb769a14e8c","item_id":"infd-20261005-telegram-bot-packet","label":"infd-20261005-telegram-bot-packet"}],"question":"Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.packet.md new file mode 100644 index 0000000..616538e --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-bot.packet.md @@ -0,0 +1,19 @@ +# FLUID-WP-0008-T02 — HelixForge bot registration + +Blocking workplan: FLUID-WP-0008 (fluid-core) +Blocking task: FLUID-WP-0008-T02 (hub prefix 9896fee4) +Same act: FT-WP-0001-T01 (fluid-telegram) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +This memo does not resolve that decision. Channels and the user session are separate memos. + +## Question +Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path? + +## One act +Authorize the operator to register the HelixForge bot and store the result only +through the attended OpenBao path. + +## Must not +- Place the credential in git, chat, or this packet +- Create the channels in this same act +- Bootstrap the dedicated account session in this same act diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.memo.json new file mode 100644 index 0000000..ec2d9a1 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"fluid-wp-0008-t03","kind":"operator-session","label":"HelixForge private and public channels","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"FLUID-WP-0008-T03 is one operator step: private test channel, then the public channel. FT-WP-0001-T02 names the same step. Accepting authorizes that step. This draft does not create a channel.","highlights":[{"id":"infd-20261005-telegram-channels-h1","item_id":"infd-20261005-telegram-channels-packet","locator":{"kind":"work_record","task":"FLUID-WP-0008-T03","workplan":"FLUID-WP-0008"},"note":"Accepting does not create either channel and does not register the bot. The shared hub decision stays open because the bot registration and the account session are separate acts.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-telegram-channels","locale":"en","packet":[{"hash":"sha256:4c9cfa1efaa670f65731982f4b6c7963464eab5d41e39b329f856fb1abb0eaac","item_id":"infd-20261005-telegram-channels-packet","label":"infd-20261005-telegram-channels-packet"}],"question":"Authorize one attended creation of the private HelixForge test channel and then the public channel?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.packet.md new file mode 100644 index 0000000..23d2bbe --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-channels.packet.md @@ -0,0 +1,18 @@ +# FLUID-WP-0008-T03 — HelixForge channels + +Blocking workplan: FLUID-WP-0008 (fluid-core) +Blocking task: FLUID-WP-0008-T03 (hub prefix bb02bf5b) +Same act: FT-WP-0001-T02 (fluid-telegram) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +This memo does not resolve that decision. + +## Question +Authorize one attended creation of the private HelixForge test channel and then the public channel? + +## One act +Authorize the operator to create the private test channel and then the public +channel. Order is part of the act. + +## Must not +- Register the bot in this same act +- Bootstrap the dedicated account session in this same act diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.memo.json b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.memo.json new file mode 100644 index 0000000..31a6025 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.memo.json @@ -0,0 +1 @@ +{"approval_binding_digest":null,"approval_id":null,"binding":{"justification":null,"principal":{"display_name":"Named reviewer in net-kingdom-admins","id":"pending-human-session","identifiers":[],"kind":"person","role":"reviewer"},"target":{"environment":"prod","id":"ft-wp-0002-t01","kind":"operator-session","label":"Dedicated Telegram account session bootstrap","requires_new_bind":false},"terms":null},"binding_level":"organizational","brief":"FT-WP-0002-T01 is an operator runbook: a dedicated account, api_id and api_hash, then the guided session bootstrap into OpenBao. The runbook is fluid-telegram docs/seeding-runbook.md. Accepting authorizes that session. This draft does not run it.","highlights":[{"id":"infd-20261005-telegram-user-session-h1","item_id":"infd-20261005-telegram-user-session-packet","locator":{"kind":"work_record","task":"FT-WP-0002-T01","workplan":"FT-WP-0002"},"note":"No account material is in this packet. Accepting does not register an account, obtain api_id or api_hash, or create a session. The bot and channel memos stay separate.","required_ack":true,"severity":"critical"}],"id":"infd-20261005-telegram-user-session","locale":"en","packet":[{"hash":"sha256:1ab0ff7d80de6466cc3e08f8ba847fee88a30d2f7fbf82ce88d25e5b0fb7359d","item_id":"infd-20261005-telegram-user-session-packet","label":"infd-20261005-telegram-user-session-packet"}],"question":"Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git?","requested_act":"approve","sealed":false,"step_kind":"approve","ui_release":"informed-decision@0.2.0","version":1} diff --git a/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.packet.md b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.packet.md new file mode 100644 index 0000000..70711bb --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/dependency-roots/infd-20261005-telegram-user-session.packet.md @@ -0,0 +1,19 @@ +# FT-WP-0002-T01 — dedicated account session + +Blocking workplan: FT-WP-0002 (fluid-telegram) +Blocking task: FT-WP-0002-T01 (hub prefix 039e5358) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +Runbook: fluid-telegram `docs/seeding-runbook.md` +This memo does not resolve that decision. + +## Question +Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git? + +## One act +Authorize the operator to follow the existing seeding runbook for one dedicated +account. Account material stays outside git. + +## Must not +- Use a person's own account +- Put api_id, api_hash, or a session string in this packet or in git +- Register the bot or create the channels in this same act diff --git a/docs/batches/2026-10-05-dependency-roots/sitting.json b/docs/batches/2026-10-05-dependency-roots/sitting.json new file mode 100644 index 0000000..af54a59 --- /dev/null +++ b/docs/batches/2026-10-05-dependency-roots/sitting.json @@ -0,0 +1,16 @@ +{ + "kind": "informed-decision-sitting", + "id": "infd-sitting-2026-10-05-dependency-roots", + "review_group": "net-kingdom-admins", + "principal": "pending-human-session", + "status": "draft-unsigned", + "submitted": false, + "hub_decision": null, + "batches": [ + "infd-batch-2026-10-05-dependency-roots" + ], + "memo_count": 6, + "excluded_count": 5, + "bind_path": "not posted; human bind is still the attended review surface", + "note": "Agent draft only. No approval was created and no memo was loaded." +} diff --git a/tools/prepare_dependency_root_batch.py b/tools/prepare_dependency_root_batch.py new file mode 100644 index 0000000..dea5d8e --- /dev/null +++ b/tools/prepare_dependency_root_batch.py @@ -0,0 +1,593 @@ +"""Draft the unsigned 2026-10-05 dependency-root sitting. + +One question per memo. Lanes whose packet is not a single ready human act are +recorded as excluded. Does not submit, present, create approvals, or bind. +""" +from __future__ import annotations + +import json +import sys +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parent)) + +from prepare_compact_batches import REVIEW_GROUP, _memo, _sha # noqa: E402 + +from informed_decision.intake import check_one_question, scan_secret_markers # noqa: E402 +from informed_decision.memo import Scope # noqa: E402 +from informed_decision.records import dumps, memo_from # noqa: E402 + +SITTING = "2026-10-05-dependency-roots" +ROOT = Path(__file__).resolve().parents[1] / "docs" / "batches" / SITTING +SITTING_ID = "infd-sitting-2026-10-05-dependency-roots" +BATCH = "dependency-roots" + +MEMOS = [ + { + "id": "infd-20261005-s1-red-controls", + "workplan": "RAIL-HO-WP-0011", + "task": "RAIL-HO-WP-0011-T05", + "hub_task_prefix": "ba526585", + "hub_decision": "83263d8d-d6ee-4395-ac84-86b71e967648", + "resolves": "on-answer", + "question": "Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh?", + "brief": ( + "The attended refresh already installed the source-rendered Goss surface on " + "Railiance01 and CoulombCore. Validation then failed on two controls. " + "Accepting this memo approves a later reviewed remediation of only those " + "controls. This draft does not edit a host." + ), + "highlight": ( + "Railiance01 failed 1 of 48 checks: /etc/ssh/sshd_config.d/10-hardening.conf " + "lacks the line ChallengeResponseAuthentication no. CoulombCore failed 2 of 28 " + "checks: /usr/local/bin/age is not executable, and the same SSH line is absent. " + "Firewall checks passed, including CoulombCore iptables INPUT DROP. Accepting " + "does not enable UFW, rerun the refresh, or change any other SSH line." + ), + "target": Scope( + "host-baseline", + "rail-ho-wp-0011-t05", + "Two red S1 controls from the 2026-10-05 Goss refresh", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "railiance-infra", + "purpose": "Approve remediation of the two red S1 controls from the 2026-10-05 Goss refresh", + "target": { + "id": "rail-ho-wp-0011-t05", + "type": "host-baseline", + "system": "railiance-infra", + }, + }, + "packet": """# RAIL-HO-WP-0011-T05 — two red S1 controls + +Blocking workplan: RAIL-HO-WP-0011 (railiance-infra) +Blocking task: RAIL-HO-WP-0011-T05 (hub prefix ba526585) +Hub decision: 83263d8d-d6ee-4395-ac84-86b71e967648 + +## Question +Approve remediation of exactly the two red S1 controls found by the 2026-10-05 Goss refresh? + +## What already ran +`make verify-refresh-host` with the per-host approval tokens ran for Railiance01 +and CoulombCore after the rendered baseline was reviewed. Both hosts now have +the goss binary, `/etc/goss/baseline.yaml`, the wrapper, the service, and the +hourly timer. Validation exited non-zero after that install. + +## The two controls +- Railiance01, 1 of 48: `/etc/ssh/sshd_config.d/10-hardening.conf` lacks + `ChallengeResponseAuthentication no`. +- CoulombCore, 2 of 28: `/usr/local/bin/age` is not executable, and the same + SSH line is absent. +- Firewall checks passed, including CoulombCore `iptables -S INPUT` policy DROP + and Railiance01 tunnel-only 6443. + +## One act +Authorize a later reviewed change that adds only that SSH line on both hosts +and makes `/usr/local/bin/age` executable on CoulombCore. + +## Must not +- Enable or rewrite UFW on CoulombCore +- Rerun the Goss refresh as a substitute for the two controls +- Treat this draft as the host change itself +""", + }, + { + "id": "infd-20261005-activity-empty-projections", + "workplan": "STATE-WP-0095", + "task": "STATE-WP-0095-T04", + "hub_task_prefix": "3bbb311f", + "hub_decision": "91b7c633-a66f-5d43-9f4b-6565aefb9356", + "resolves": "never", + "question": "Approve retirement of only the three named empty Activity projections while preserving their parent projection?", + "brief": ( + "Normal Activity replay refused three empty historical projections. " + "The prepared set names those three UUIDs and preserves the parent. " + "State Hub source commit 968a811 can require that exact set. Accepting " + "records the disposition. It does not retire a row." + ), + "highlight": ( + "Targets are 683724d9-4249-5e0e-88e0-7baff4330d58 (custodian-wp-0003), " + "644017c7-c5f2-5a64-81c3-d8ee806f8251 (custodian-wp-0003a) and " + "a5806df9-5b9a-50da-81c1-7e606076bed9 (custodian-wp-0003b). Preserve parent " + "b4eb45a9-69e3-4ab0-b00c-67a53c3117c5. Activity Core still owes its own " + "return. Accepting is not a live retirement, a deletion, or a rollout of 968a811." + ), + "target": Scope( + "projection-disposition", + "activity-history-duplicate-disposition-20261004", + "Three empty Activity historical projections", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "state-hub", + "purpose": "Approve the prepared disposition of three empty Activity projections", + "target": { + "id": "activity-history-duplicate-disposition-20261004", + "type": "projection-disposition", + "system": "state-hub", + }, + }, + "packet": """# STATE-WP-0095-T04 — three empty Activity projections + +Blocking workplan: STATE-WP-0095 (state-hub) +Blocking task: STATE-WP-0095-T04 (hub prefix 3bbb311f) +Hub decision: 91b7c633-a66f-5d43-9f4b-6565aefb9356 +Proposal: the-custodian `docs/evidence/2026-10-04-dependency-root-wave/activity-stale-disposition-proposal.json` +Source exact-set: state-hub commit `968a811` (on origin/main). Not a live rollout. + +## Question +Approve retirement of only the three named empty Activity projections while preserving their parent projection? + +## Exact set +- `683724d9-4249-5e0e-88e0-7baff4330d58` slug custodian-wp-0003 +- `644017c7-c5f2-5a64-81c3-d8ee806f8251` slug custodian-wp-0003a +- `a5806df9-5b9a-50da-81c1-7e606076bed9` slug custodian-wp-0003b +- Preserve parent `b4eb45a9-69e3-4ab0-b00c-67a53c3117c5` + +Each target was recorded with zero tasks and zero global dependency edges. + +## One act +Record the founder's disposition of that set. An answer here does not resolve +the hub decision by itself, because Activity Core's separate return and a +reviewed live writer are still required before any retirement runs. + +## Must not +- Blanket-acknowledge every stale projection +- Delete rows, replace UUIDs, move tasks, or rewrite source history +- Treat source commit 968a811 as already deployed +""", + }, + { + "id": "infd-20261005-hall-signing-key", + "workplan": "FT-WP-0001", + "task": "FT-WP-0001-T04", + "hub_task_prefix": "13a92a96", + "hub_decision": "d5d8a24d-d77e-4c63-ab52-b878d687e8b9", + "resolves": "on-answer", + "question": "Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft?", + "brief": ( + "FT-WP-0001-T04 cannot publish R-1 with an ephemeral key. The key has " + "to survive restart and stay outside git. Accepting authorizes that " + "key. This draft does not create it and does not publish R-1." + ), + "highlight": ( + "No key material is in this packet. Accepting does not create the key, " + "does not choose a generated value, and does not publish revision R-1. " + "A later attended lane has to create the key outside every worktree." + ), + "target": Scope( + "signing-key", + "ft-wp-0001-t04", + "Durable Hall of Helix R-1 signing key outside git", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-telegram", + "purpose": "Authorize a durable Hall of Helix R-1 signing key held outside git", + "target": { + "id": "ft-wp-0001-t04", + "type": "signing-key", + "system": "fluid-telegram", + }, + }, + "packet": """# FT-WP-0001-T04 — durable signing key + +Blocking workplan: FT-WP-0001 (fluid-telegram) +Blocking task: FT-WP-0001-T04 (hub prefix 13a92a96) +Hub decision: d5d8a24d-d77e-4c63-ab52-b878d687e8b9 + +## Question +Authorize a durable Hall of Helix R-1 signing key held outside git, without creating that key in this draft? + +## One act +Authorize a later attended creation of one durable signing key for Hall of Helix +revision R-1. The key stays outside git and outside the hall worktree. + +## Must not +- Put key material in this packet, in git, or in a workplan +- Publish R-1 as part of this answer +- Treat an ephemeral process key as satisfying the task +""", + }, + { + "id": "infd-20261005-telegram-bot", + "workplan": "FLUID-WP-0008", + "task": "FLUID-WP-0008-T02", + "hub_task_prefix": "9896fee4", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path?", + "brief": ( + "FLUID-WP-0008-T02 and FT-WP-0001-T01 are the same human step. " + "Accepting authorizes that registration. This draft does not call " + "BotFather and does not store a credential. The shared hub decision " + "also covers channels and the user session, so this answer must not " + "be treated as resolving those other acts." + ), + "highlight": ( + "The BotFather result stays on the attended OpenBao path and never " + "enters git. Accepting does not register the bot. It does not create " + "channels and it does not bootstrap the FT-WP-0002 account session." + ), + "target": Scope( + "operator-session", + "fluid-wp-0008-t02", + "HelixForge bot registration", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-core", + "purpose": "Authorize one attended HelixForge bot registration", + "target": { + "id": "fluid-wp-0008-t02", + "type": "operator-session", + "system": "fluid-core", + }, + }, + "packet": """# FLUID-WP-0008-T02 — HelixForge bot registration + +Blocking workplan: FLUID-WP-0008 (fluid-core) +Blocking task: FLUID-WP-0008-T02 (hub prefix 9896fee4) +Same act: FT-WP-0001-T01 (fluid-telegram) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +This memo does not resolve that decision. Channels and the user session are separate memos. + +## Question +Authorize one attended BotFather registration of the HelixForge bot, with the credential stored only through the attended OpenBao path? + +## One act +Authorize the operator to register the HelixForge bot and store the result only +through the attended OpenBao path. + +## Must not +- Place the credential in git, chat, or this packet +- Create the channels in this same act +- Bootstrap the dedicated account session in this same act +""", + }, + { + "id": "infd-20261005-telegram-channels", + "workplan": "FLUID-WP-0008", + "task": "FLUID-WP-0008-T03", + "hub_task_prefix": "bb02bf5b", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended creation of the private HelixForge test channel and then the public channel?", + "brief": ( + "FLUID-WP-0008-T03 is one operator step: private test channel, then " + "the public channel. FT-WP-0001-T02 names the same step. Accepting " + "authorizes that step. This draft does not create a channel." + ), + "highlight": ( + "Accepting does not create either channel and does not register the " + "bot. The shared hub decision stays open because the bot registration " + "and the account session are separate acts." + ), + "target": Scope( + "operator-session", + "fluid-wp-0008-t03", + "HelixForge private and public channels", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-core", + "purpose": "Authorize attended creation of the HelixForge channels", + "target": { + "id": "fluid-wp-0008-t03", + "type": "operator-session", + "system": "fluid-core", + }, + }, + "packet": """# FLUID-WP-0008-T03 — HelixForge channels + +Blocking workplan: FLUID-WP-0008 (fluid-core) +Blocking task: FLUID-WP-0008-T03 (hub prefix bb02bf5b) +Same act: FT-WP-0001-T02 (fluid-telegram) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +This memo does not resolve that decision. + +## Question +Authorize one attended creation of the private HelixForge test channel and then the public channel? + +## One act +Authorize the operator to create the private test channel and then the public +channel. Order is part of the act. + +## Must not +- Register the bot in this same act +- Bootstrap the dedicated account session in this same act +""", + }, + { + "id": "infd-20261005-telegram-user-session", + "workplan": "FT-WP-0002", + "task": "FT-WP-0002-T01", + "hub_task_prefix": "039e5358", + "hub_decision": "7f455718-66c9-4049-9aaf-1143aea39d34", + "resolves": "never", + "question": "Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git?", + "brief": ( + "FT-WP-0002-T01 is an operator runbook: a dedicated account, api_id " + "and api_hash, then the guided session bootstrap into OpenBao. The " + "runbook is fluid-telegram docs/seeding-runbook.md. Accepting " + "authorizes that session. This draft does not run it." + ), + "highlight": ( + "No account material is in this packet. Accepting does not register " + "an account, obtain api_id or api_hash, or create a session. The bot " + "and channel memos stay separate." + ), + "target": Scope( + "operator-session", + "ft-wp-0002-t01", + "Dedicated Telegram account session bootstrap", + "prod", + ), + "binding": { + "action": "accept", + "actor": "informed-decision", + "principal": "fluid-telegram", + "purpose": "Authorize the attended FT-WP-0002 account-session bootstrap", + "target": { + "id": "ft-wp-0002-t01", + "type": "operator-session", + "system": "fluid-telegram", + }, + }, + "packet": """# FT-WP-0002-T01 — dedicated account session + +Blocking workplan: FT-WP-0002 (fluid-telegram) +Blocking task: FT-WP-0002-T01 (hub prefix 039e5358) +Hub decision: 7f455718-66c9-4049-9aaf-1143aea39d34 +Runbook: fluid-telegram `docs/seeding-runbook.md` +This memo does not resolve that decision. + +## Question +Authorize one attended bootstrap of a dedicated Telegram account session for FT-WP-0002, with the account material kept outside git? + +## One act +Authorize the operator to follow the existing seeding runbook for one dedicated +account. Account material stays outside git. + +## Must not +- Use a person's own account +- Put api_id, api_hash, or a session string in this packet or in git +- Register the bot or create the channels in this same act +""", + }, +] + +EXCLUDED = [ + { + "workplan": "KEY-WP-0037", + "task": "KEY-WP-0037-T03", + "owner_repo": "key-cape", + "hub_decision": "caafe4be-4f68-47b4-9567-316d47b94992", + "reason": ( + "Custody boundary 632a8893 is approved. The live registration still has " + "no exact reviewed revision, image digest, config preservation test, or " + "synthetic issuance and denial record. Resolving caafe4be would be that live go." + ), + "ready_when": "An owner records the exact revision, digest, preservation test, and synthetic issuance and denial, then one memo asks only for the live go.", + }, + { + "workplan": "FT-WP-0001", + "task": "FT-WP-0001-T07", + "owner_repo": "fluid-telegram", + "hub_decision": "8a095daa-35f9-4561-ae50-256558600be7", + "reason": ( + "Ninety-four hall entries have no Telegram-channel agreement. The decision " + "asks which basis to record, including whether a revocable standing agreement " + "belongs in hall-of-helix/ENTRY.md and how earlier contributors are asked. " + "That choice is not yet a single prepared act." + ), + "ready_when": "The hall owner writes the candidate basis as one question with the exact text the founder would be accepting.", + }, + { + "workplan": "RAPPS-WP-0014", + "task": "RAPPS-WP-0014-T03", + "owner_repo": "railiance-apps", + "hub_decision": "d06307e5-2737-461a-a2f4-a12c3b492a9a", + "reason": ( + "The invited two-user workflow is not ready to run. Create login for the " + "invited tenant-admin was refused because that email already belongs to " + "directory login platform-root. No second login was created." + ), + "ready_when": "The account owner records a usable second person, then one memo asks the founder to run the acceptance with that person.", + }, + { + "workplan": "STATE-WP-0079", + "task": "STATE-WP-0079-T06", + "owner_repo": "state-hub", + "hub_decision": "2fd5849c-240e-4d0a-bf07-5ebf8dfce3fd", + "reason": ( + "The same hub decision also covers the single-node risk, the core-hub cutover, " + "clock verification, and live-host authorization. Stopping the primary still " + "waits on STATE-WP-0079-T04 route receipts and the legacy-meter week." + ), + "ready_when": "Each remaining act has its own reviewed packet. Do not pose the bundle as one memo.", + }, + { + "workplan": "RPF-WP-0044", + "task": "RPF-WP-0044-T03", + "owner_repo": "railiance-platform", + "hub_decision": "89f1058f-33bc-47a8-8a49-0b44d426c67e", + "reason": ( + "The ArgoCD go-ahead covers issue-core, policy-nexus, activity-core automation, " + "and prune restoration. The policy-nexus Application draft still has unfilled " + "revision and values placeholders. One memo cannot carry those acts." + ), + "ready_when": "Each adoption has one reviewed command and its own memo.", + }, +] + + +def main() -> None: + directory = ROOT / BATCH + directory.mkdir(parents=True, exist_ok=True) + ordinal = [] + intents = [] + for n, spec in enumerate(MEMOS, start=1): + check_one_question(spec["question"]) + packet_path = directory / f"{spec['id']}.packet.md" + packet_path.write_text(spec["packet"], encoding="utf-8") + digest = _sha(spec["packet"]) + memo = _memo( + memo_id=spec["id"], + question=spec["question"], + brief=spec["brief"], + target=spec["target"], + packet_id=spec["id"] + "-packet", + packet_hash=digest, + highlight=spec["highlight"], + workplan=spec["workplan"], + task=spec["task"], + ) + payload = json.loads(dumps(memo)) + if memo_from(payload).question != spec["question"]: + raise RuntimeError(f"round-trip failed for {spec['id']}") + scan_secret_markers(payload) + scan_secret_markers(spec["packet"]) + memo_path = directory / f"{spec['id']}.memo.json" + memo_path.write_text(dumps(memo) + "\n", encoding="utf-8") + ordinal.append( + { + "n": n, + "memo_id": spec["id"], + "workplan": spec["workplan"], + "task": spec["task"], + "hub_task_prefix": spec["hub_task_prefix"], + "hub_decision": spec["hub_decision"], + "resolves": spec["resolves"], + "question": spec["question"], + "memo": memo_path.name, + "packet": packet_path.name, + "packet_hash": digest, + "required_highlight": f"{spec['id']}-h1", + } + ) + intents.append( + { + "memo_id": spec["id"], + "create_client": "informed-decision-sitting-requester", + "binding": spec["binding"], + "hub_decision": spec["hub_decision"], + "resolves": spec["resolves"], + } + ) + index = { + "kind": "informed-decision-batch", + "id": f"infd-batch-{SITTING}", + "review_group": REVIEW_GROUP, + "status": "draft-unsigned", + "submitted": False, + "one_question_per_memo": True, + "approve_all_forbidden": True, + "agent_disposition_forbidden": True, + "hub_decision": None, + "note": "Several hub decisions. Each ordinal names its own decision and whether an answer may resolve it. There is no batch verdict.", + "ordinal": ordinal, + "excluded": EXCLUDED, + } + (directory / "index.json").write_text(json.dumps(index, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") + scan_secret_markers(index) + create = { + "kind": "informed-decision-approval-create-intents", + "sitting_id": SITTING_ID, + "status": "not-posted", + "posted": False, + "requester_client": "informed-decision-sitting-requester", + "human_control": True, + "pdp_path": False, + "required_count": 1, + "note": "Intents only. Digests are computed by approval-engine at create; do not invent them here. Not posted.", + "intents": intents, + } + (ROOT / "approval-create-intents.json").write_text( + json.dumps(create, indent=2, ensure_ascii=False) + "\n", encoding="utf-8" + ) + sitting = { + "kind": "informed-decision-sitting", + "id": SITTING_ID, + "review_group": REVIEW_GROUP, + "principal": "pending-human-session", + "status": "draft-unsigned", + "submitted": False, + "hub_decision": None, + "batches": [index["id"]], + "memo_count": len(ordinal), + "excluded_count": len(EXCLUDED), + "bind_path": "not posted; human bind is still the attended review surface", + "note": "Agent draft only. No approval was created and no memo was loaded.", + } + (ROOT / "sitting.json").write_text(json.dumps(sitting, indent=2, ensure_ascii=False) + "\n", encoding="utf-8") + lines = [ + "# Dependency-root sitting — operator packet", + "", + "Drafted 2026-10-05. Not posted. An agent may not accept, decline, or seal.", + "Review group: `net-kingdom-admins`. Surface, once a human opens the sitting:", + "https://decisions.coulomb.social/", + "Generator: `tools/prepare_dependency_root_batch.py`.", + "", + "This sitting groups separate hub decisions. There is no approve-all.", + "An answer on one memo does not answer the others. `resolves: never` means", + "the answer must not be written back as a resolve of the shared hub decision.", + "", + "| n | memo_id | task | resolves | question |", + "| --: | --- | --- | --- | --- |", + ] + for row in ordinal: + lines.append( + f"| {row['n']} | `{row['memo_id']}` | {row['task']} | {row['resolves']} | {row['question']} |" + ) + lines.extend(["", "## Excluded", ""]) + for item in EXCLUDED: + lines.append(f"- `{item['task']}` ({item['hub_decision']}): {item['reason']}") + lines.extend( + [ + "", + "## Not done by this draft", + "", + "No approval object was created. No memo was loaded into the review store.", + "No lifecycle review was requested. The founder binds on the review surface", + "after a human opens the sitting.", + "", + ] + ) + (ROOT / "OPERATOR.md").write_text("\n".join(lines), encoding="utf-8") + print(f"wrote {len(ordinal)} memos and {len(EXCLUDED)} exclusions under {ROOT}") + + +if __name__ == "__main__": + main()