From dd664355efc8940988a91c6ea5eab9b962a7f6f1 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 00:00:20 +0200 Subject: [PATCH] NK-WP-0048-T05: record ops-warden's review and the open r2 answer at close Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 330051@bnt-lap001 Assistant-Session: b98d4912-95a3-4619-b7fb-57aa1db7407b --- workplans/NK-WP-0048-security-case-types.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/workplans/NK-WP-0048-security-case-types.md b/workplans/NK-WP-0048-security-case-types.md index 028ef75..12dd6a2 100644 --- a/workplans/NK-WP-0048-security-case-types.md +++ b/workplans/NK-WP-0048-security-case-types.md @@ -239,7 +239,24 @@ decision against r2. Close it with `return` (a reviewer verb that requests a new revision and does not resolve the hub decision; only accept and decline do), commenting that r2 supersedes it, then answer r2. `withdraw` exists in the vocabulary but is not offered to reviewers, and lifecycle `revise` only -applies to lifecycle-registered memos, not intake-delivered ones. key-cape and railiance-apps were told about Forgejo's new custody +applies to lifecycle-registered memos, not intake-delivered ones. + +2026-10-09: the founder reports r2 enqueued and the first memo returned. At +close, hub decision `e418263e` still showed `open` (not verified whether r2 +was answered or the answer is still in transit; the dispatcher ledger was not +read). ops-warden's review (WARDEN-WP-0044-T01, ops-warden +`history/2026-10-08-oidc-rp-follow-through-review.md`, d470f2e) arrived at +21:25, before r2 was built, and is not in r2. Required before WARDEN-WP-0044-T02: +R1 a per-step `lane` (missing: identity-provisioner caller credential, +railiance-platform broker grant), R2 canon meaning of `warden_executes: true` +(caller proxy, caller identity, no standing ops-warden token; ADR-0002), R3 a +per-step `value_handling`. Refinements R4 (one type-level catalog lane instead +of a per-case entry, which conflicts with ops-mason's item 5), R5 (ESO Ready gate +before bind-env), R6 (exact accepted memberships), R7 (mfa-pinned and +secret-delivered checks). Next: if r2 was accepted, fold R1-R3 and R5-R7 in as +a follow-up and settle R4 between ops-warden and ops-mason before T06; if not, +hold r2, fold them in and build r3. + key-cape and railiance-apps were told about Forgejo's new custody path. ```task