coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

feat: add ordered sheet execution for admitted case steps
All checks were successful
CI Smoke / host-smoke (push) Successful in 3s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a198e4-7903-75b3-aaf3-c89ddac9437d
This commit is contained in:
tegwick 2026-11-01 22:03:13 +01:00
parent 95d31c3177
commit 12430dec86
3 changed files with 663 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

20
workplans/WARDEN-WP-0044-security-case-follow-through.md
View file

@ -9,7 +9,7 @@ flavor: implementation
owner: claude-code
topic_slug: netkingdom
created: "2026-10-08"
updated: "2026-10-11"
updated: "2026-10-22"
depends_on: []
related_repos:
- net-kingdom
@ -144,7 +144,7 @@ reaches the plan unrendered.
id: WARDEN-WP-0044-T03
status: progress
depends_on: [WARDEN-WP-0044-T02, MASON-WP-0010-T03]
blocking_reason: "Local durable execution kernel and injected failure harness implemented. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, contained session integration, ordered verification and first native run."
blocking_reason: "Ordered admitted-step sheet exists. Native acceptance still requires authenticated owner machine descriptors/adapters, actual Forgejo materialization receipt, a real contained-login session, promoted lanes, the 1.3 pin after founder acknowledgment, and the first native run."
priority: high
state_hub_task_id: "bcbf6c91-2c04-5c16-ae8c-5d6c06fd6b89"
```
@ -408,3 +408,19 @@ warden-safe-unit-integration-r1. This completes the known trusted-unit-entry
accident-prevention follow-through; direct pytest bypass, native/non-open/preopened
file-descriptor limits remain explicit. No OS sandbox, isolated agent assignment,
production grant or native T03 acceptance follows. T03 stays progress.
2026-10-22: `src/warden/case_sheet.py` runs steps already admitted on one
Executor, in order, and stops unless the outcome is verified-success or
verified-no-change. Consecutive attended steps on the same lane share one
injected contained-session call; a session that does not perform the dispatch
refuses, and no later step runs. Verification callbacks run only after every
step has closed. A raised check becomes uncertain and its text is not stored.
`SheetReceipt.closed` means that local sheet finished. It does not set a case
to `live` and it is not native acceptance. Rollback walks the same admitted
order in reverse, skips no-change and failed-before-change, and refuses while
any step is uncertain or failed-after-change. There is no CLI, no shell, and
no use of entry-point prose. Tests: `tests/test_case_sheet.py` (10 passed
under `make test`). Owner machine descriptors, Forgejo materialization,
installed adapters, promoted lanes, the 1.3 parameter pin after founder
acknowledgment, the real contained login, and the first native run remain
open. T03 stays progress.