From 0150c8c37ad0d9a13bf182063d57e5fe34d7d9e6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 29 Sep 2026 21:28:56 +0200 Subject: [PATCH] Runbook packs no longer carry exercise_status; note in the attended-procedure standard Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 295952@bnt-lap001 Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477 --- docs/attended-procedure-standard.md | 4 ++++ runbooks/openbao-operating-path/pack.yaml | 1 - runbooks/protected-system-flex-auth/pack.yaml | 1 - runbooks/security-bootstrap-console/pack.yaml | 1 - runbooks/ssh-certificates/pack.yaml | 1 - 5 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/attended-procedure-standard.md b/docs/attended-procedure-standard.md index f7e90f4..76c2f47 100644 --- a/docs/attended-procedure-standard.md +++ b/docs/attended-procedure-standard.md @@ -43,6 +43,10 @@ Every attended procedure carries this in its runbook, in the header: Exercise status: exercised 2026-08-27 by | unexercised ``` +> **Runbook packs (2026-09-29).** For runbook packs run by the `runbook-tutorials` engine this label is no longer a field in the +> pack: the same idea is *maturity*, derived from clean runs in named environments and bound to the pack revision +> (`runbook-tutorials/docs/maturity-and-projects.md`). Markdown procedures keep the header below. + An unexercised procedure may still be the approved path — sometimes the incident *is* the first run. What it may not do is present itself as routine. Naming the status sets the operator's expectations correctly: run it expecting to debug it, diff --git a/runbooks/openbao-operating-path/pack.yaml b/runbooks/openbao-operating-path/pack.yaml index 310dce0..1a355ce 100644 --- a/runbooks/openbao-operating-path/pack.yaml +++ b/runbooks/openbao-operating-path/pack.yaml @@ -3,7 +3,6 @@ id: nk.openbao-operating-path title: "OpenBao: consume, attend, recover" owner: net-kingdom outcome: You can reach the already-deployed private OpenBao, know which owner serves a credential, know the custody model and the attended recovery path, and have seen the ceremony-record validator refuse a secret marker. -exercise_status: unexercised engine: native parameters: - {id: need, label: The credential you need, type: text, default: read a database password, help: Plain words; used only to look up the owner.} diff --git a/runbooks/protected-system-flex-auth/pack.yaml b/runbooks/protected-system-flex-auth/pack.yaml index 2a01439..ef293d7 100644 --- a/runbooks/protected-system-flex-auth/pack.yaml +++ b/runbooks/protected-system-flex-auth/pack.yaml @@ -3,7 +3,6 @@ id: nk.protected-system-flex-auth title: Add a protected system to flex-auth owner: net-kingdom outcome: You have seen a protected system's manifests and policy evaluated offline, and a live flex-auth pin refuse callers with no credential, the wrong ServiceAccount, and the wrong audience. Expired-token refusal (negative N4) is not exercised here because it needs a ten-minute wait. -exercise_status: unexercised engine: native parameters: - {id: flexauth_home, label: flex-auth checkout, type: path, default: ~/flex-auth} diff --git a/runbooks/security-bootstrap-console/pack.yaml b/runbooks/security-bootstrap-console/pack.yaml index fba5cdf..b155367 100644 --- a/runbooks/security-bootstrap-console/pack.yaml +++ b/runbooks/security-bootstrap-console/pack.yaml @@ -3,7 +3,6 @@ id: nk.security-bootstrap-console title: NetKingdom guided security bootstrap (existing console) owner: net-kingdom outcome: The platform-root custody, OpenBao ceremony evidence, and identity bootstrap gates are walked through in the existing guided console. -exercise_status: unexercised engine: legacy-command legacy: command: [make, security-bootstrap-ui] diff --git a/runbooks/ssh-certificates/pack.yaml b/runbooks/ssh-certificates/pack.yaml index 27285ff..98c720c 100644 --- a/runbooks/ssh-certificates/pack.yaml +++ b/runbooks/ssh-certificates/pack.yaml @@ -3,7 +3,6 @@ id: nk.ssh-certificates title: Short-lived SSH credentials for admins, agents and automations owner: net-kingdom outcome: An actor obtains a short-lived CA-signed SSH certificate and uses it through an ops-bridge tunnel, with no static key doing the work. -exercise_status: unexercised engine: native parameters: - {id: actor, label: Actor name, type: string, default: agt-claude-railiance01, pattern: "(adm|agt|atm)-[a-z0-9-]+", help: "Actor type prefix decides the maximum TTL: adm 48h, agt 24h, atm 8h."}