fix(workplans): adopt ADR-007 derived identifiers for unregistered records
These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
parent
76e545ecf0
commit
186fa99f58
10 changed files with 61 additions and 61 deletions
|
|
@ -9,7 +9,7 @@ owner: claude
|
|||
topic_slug: custodian
|
||||
created: "2026-08-11"
|
||||
updated: "2026-08-15"
|
||||
state_hub_workstream_id: "c8c51e07-f42d-43b1-873f-fec6cda7ed25"
|
||||
state_hub_workstream_id: "bc6dd3e3-ab2b-567a-9574-30d2650f20a2"
|
||||
---
|
||||
|
||||
# Ad Hoc Tasks — 2026-08-11
|
||||
|
|
@ -20,7 +20,7 @@ state_hub_workstream_id: "c8c51e07-f42d-43b1-873f-fec6cda7ed25"
|
|||
id: ADHOC-2026-08-11-T01
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "b0420c81-81bb-4733-9aa0-e9c867503387"
|
||||
state_hub_task_id: "ddd0c95c-1196-5251-a4ca-6ef441c2f377"
|
||||
```
|
||||
|
||||
rapp-postgres (msg `96907986`, residual from RAPP-POSTGRES-WP-0002-T04) reported the
|
||||
|
|
@ -42,7 +42,7 @@ an anchor that does not exist. The intended heading is `## Routing catalog index
|
|||
id: ADHOC-2026-08-11-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "546a4299-314c-448d-b2fb-201ddc50353c"
|
||||
state_hub_task_id: "fda35ad4-f526-5012-a2be-ef6b5dcbc8af"
|
||||
```
|
||||
|
||||
`fix-consistency` flagged 11 unread messages older than 3 days, two of them as possible
|
||||
|
|
@ -76,7 +76,7 @@ read. Inbox is now empty.
|
|||
id: ADHOC-2026-08-11-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "b930df62-b8dd-45ae-b0a5-98298cdfa1b6"
|
||||
state_hub_task_id: "7ef4b6b0-26bf-5456-8429-8cf8458c2ddc"
|
||||
```
|
||||
|
||||
secrets-engine (msg `80456912`, 2026-06-29) is holding a validated non-mutating dry-run
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ owner: claude
|
|||
topic_slug: custodian
|
||||
created: "2026-08-17"
|
||||
updated: "2026-08-17"
|
||||
state_hub_workstream_id: "c8b0e623-4e89-41aa-b561-5dee9c7dad03"
|
||||
state_hub_workstream_id: "8376eb89-36f2-52b0-a59a-2954b2e49349"
|
||||
---
|
||||
|
||||
# Ad Hoc Tasks — 2026-08-17
|
||||
|
|
@ -24,7 +24,7 @@ workload-identity owner.
|
|||
id: ADHOC-2026-08-17-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "c67ccc00-00e5-4fc9-9b51-b3c7d5ab5741"
|
||||
state_hub_task_id: "b980d1f7-2fcc-58dd-97d8-6e9b9ba57bc9"
|
||||
```
|
||||
|
||||
flex-auth (msg `130a148c`, FLEX-WP-0015 T02) reported that `POST /v1/check` and
|
||||
|
|
@ -72,7 +72,7 @@ Their four questions answered in `wiki/NetKingdomSecurityMap.md`
|
|||
id: ADHOC-2026-08-17-T02
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "be453158-ca91-404e-a4dc-01f1ee0884cf"
|
||||
state_hub_task_id: "e76b9b3e-189b-5a4f-8815-4ccf2057507c"
|
||||
```
|
||||
|
||||
user-engine (msg `2af4a124`) answered the open confirm question on
|
||||
|
|
@ -98,7 +98,7 @@ consumes it and has no authority over custody, rotation, or issuance.
|
|||
id: ADHOC-2026-08-17-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "18e6958f-61ad-4e12-a008-79652611feae"
|
||||
state_hub_task_id: "edfb0626-5022-5f49-aaf9-08e0d1002b90"
|
||||
```
|
||||
|
||||
key-cape (msg `099b7cba`) acknowledged the lane staying interim on ops-warden.
|
||||
|
|
@ -121,7 +121,7 @@ workplan.
|
|||
id: ADHOC-2026-08-17-T04
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "874f6c76-ef1b-454a-a3f1-bbf74e087acd"
|
||||
state_hub_task_id: "62109af6-f095-5e7b-9258-0fcec29d30e8"
|
||||
```
|
||||
|
||||
- [x] `uv run pytest -q` → 338 passed, 4 deselected (routing anchor + no-double-source
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: high
|
|||
planning_order: 25
|
||||
created: "2026-07-12"
|
||||
updated: "2026-07-13"
|
||||
state_hub_workstream_id: "5bd18d0b-88bf-4791-a940-ff62b836e6d7"
|
||||
state_hub_workstream_id: "70c11222-d8e7-5936-99f7-7d626a4a5deb"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0025 — Forgejo admin PAT OpenBao lane
|
||||
|
|
@ -37,7 +37,7 @@ still using `/tmp/forgejo-tegwick-api-token` or `FORGEJO_ADMIN_TOKEN`.
|
|||
id: WARDEN-WP-0025-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "6faf5138-fbf9-4380-a2d7-3765f02c64ec"
|
||||
state_hub_task_id: "2c288bf0-b39c-5f5b-ad25-eed3da826dc3"
|
||||
```
|
||||
|
||||
- [x] `CCR-2026-0006-forgejo-admin-api-token-lane.yaml` (`status: proposed`)
|
||||
|
|
@ -50,7 +50,7 @@ state_hub_task_id: "6faf5138-fbf9-4380-a2d7-3765f02c64ec"
|
|||
id: WARDEN-WP-0025-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "fdb42d37-2978-4b84-9547-b0046773b3a3"
|
||||
state_hub_task_id: "01b81595-f9e5-5746-b0dd-2075189cb00e"
|
||||
```
|
||||
|
||||
- [x] Catalog entry `forgejo-admin-api-token` (`status: draft`)
|
||||
|
|
@ -62,7 +62,7 @@ state_hub_task_id: "fdb42d37-2978-4b84-9547-b0046773b3a3"
|
|||
id: WARDEN-WP-0025-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
|
||||
state_hub_task_id: "279b74d7-3240-5ca0-897d-b1ddffd23c4e"
|
||||
```
|
||||
|
||||
- [x] CCR approved by platform-operator (bernd.worsch, 2026-07-12)
|
||||
|
|
@ -76,7 +76,7 @@ state_hub_task_id: "65dcbf2f-28e1-42c8-8419-a766e3087502"
|
|||
id: WARDEN-WP-0025-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
|
||||
state_hub_task_id: "4e21232c-62a1-5115-acce-edfbcfa84e48"
|
||||
```
|
||||
|
||||
- [x] Mint PAT as Forgejo user `tegwick` (attended, 2026-07-12)
|
||||
|
|
@ -95,7 +95,7 @@ state_hub_task_id: "bc249196-8692-434a-91b1-4232951246dd"
|
|||
id: WARDEN-WP-0025-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "24a6e98f-759c-43ce-a1dc-230b08b9d85c"
|
||||
state_hub_task_id: "f8c7c70b-b9b6-5980-a25b-7f11033b81a2"
|
||||
```
|
||||
|
||||
- [x] Ack the-custodian with CCR id + catalog id (no secret values) — msg 949e8ed1, 2026-07-13
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: high
|
|||
planning_order: 26
|
||||
created: "2026-07-16"
|
||||
updated: "2026-07-16"
|
||||
state_hub_workstream_id: "1adb34af-d5f8-42c5-89b4-44593995a281"
|
||||
state_hub_workstream_id: "331c7620-bd34-5acd-9135-591985b568e5"
|
||||
---
|
||||
|
||||
# Credential disclosure hygiene + rotation guidance (Strand A)
|
||||
|
|
@ -63,7 +63,7 @@ advisory knowledge held next to the routing catalog, not in OpenBao.
|
|||
id: WARDEN-WP-0026-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "9329e72d-c07c-41ce-88ce-e8602eb72c43"
|
||||
state_hub_task_id: "1cb22a40-b7c6-560a-a805-7766a5786dcc"
|
||||
```
|
||||
|
||||
Done 2026-07-16: canonical capabilities-safe verification pattern added to
|
||||
|
|
@ -90,7 +90,7 @@ it (see T07).
|
|||
id: WARDEN-WP-0026-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3f28c573-8e58-4851-8aa0-925f9367f266"
|
||||
state_hub_task_id: "bcb7da96-0a28-5484-bf3e-06e97acf5873"
|
||||
```
|
||||
|
||||
Done 2026-07-16: sanctioned transports added to `warden access` so a value never
|
||||
|
|
@ -117,7 +117,7 @@ the anti-pattern is documented fleet-wide.
|
|||
id: WARDEN-WP-0026-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "21ab08d5-7782-4567-a08d-980211dd7851"
|
||||
state_hub_task_id: "d90b0628-fa1d-527d-99c3-28a7ed933e52"
|
||||
```
|
||||
|
||||
Done 2026-07-16: `warden/mask.py` (`fingerprint`/`mask_value` — presence, length,
|
||||
|
|
@ -142,7 +142,7 @@ limitation documented.
|
|||
id: WARDEN-WP-0026-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "f95d4381-f995-4c9d-b438-70b4f0ed90c5"
|
||||
state_hub_task_id: "827fa67d-5f69-5fac-bdce-9903b1b909fb"
|
||||
```
|
||||
|
||||
Done 2026-07-16: Catalog `risk: high|standard` (default standard). High-risk:
|
||||
|
|
@ -170,7 +170,7 @@ while still allowing wrapped/proxied access, verified via capabilities checks.
|
|||
id: WARDEN-WP-0026-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "e989f8f0-930e-4d2f-9037-221e04f34199"
|
||||
state_hub_task_id: "09ef8727-31da-59ac-aac7-2d47924569fe"
|
||||
```
|
||||
|
||||
Done 2026-07-16: Convention documented in `wiki/playbooks/exposed-taint.md`
|
||||
|
|
@ -196,7 +196,7 @@ a lane (advisory; no auto-rotation here).
|
|||
id: WARDEN-WP-0026-T06
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b8a43aee-18c7-46cd-9cfe-1f73234746d3"
|
||||
state_hub_task_id: "a2e1544e-e501-57eb-a40e-9a2147cef12a"
|
||||
```
|
||||
|
||||
Done 2026-07-16: `rotation:` block (method rotate|re-establish, ordered steps,
|
||||
|
|
@ -228,7 +228,7 @@ every active lane, and the scorecard fails if any active lane lacks guidance.
|
|||
id: WARDEN-WP-0026-T07
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "9944f46d-3706-43a4-9300-7f63bf87c9ff"
|
||||
state_hub_task_id: "62d8286f-7954-52a8-bce6-6a16072e5246"
|
||||
```
|
||||
|
||||
Done 2026-07-16: Lessons note present. Capabilities-safe live re-verify on
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: medium
|
|||
planning_order: 27
|
||||
created: "2026-07-16"
|
||||
updated: "2026-08-23"
|
||||
state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
|
||||
state_hub_workstream_id: "21528e8d-a049-523d-9ae1-da7a27cb8bbf"
|
||||
---
|
||||
|
||||
# Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
|
||||
|
|
@ -69,7 +69,7 @@ path; ops-warden sequences and verifies it.
|
|||
id: WARDEN-WP-0027-T01
|
||||
status: cancel
|
||||
priority: high
|
||||
state_hub_task_id: "604aad14-d398-4c02-85e5-7ff37a905a1b"
|
||||
state_hub_task_id: "b5691939-9d84-5115-9618-0f8839010d14"
|
||||
```
|
||||
|
||||
Turn Strand A's per-lane `rotation:` guidance (WP-0026 T06) into an executable
|
||||
|
|
@ -90,7 +90,7 @@ each verified capabilities-safe, taint cleared only on success.
|
|||
id: WARDEN-WP-0027-T02
|
||||
status: progress
|
||||
priority: medium
|
||||
state_hub_task_id: "9d004d8f-6215-4178-bd13-5785d24fd152"
|
||||
state_hub_task_id: "cae498ee-6307-5d32-9f1b-a471cfcc2536"
|
||||
```
|
||||
|
||||
Design and document a graded lockdown: (a) soft — deny agent roles read on all
|
||||
|
|
@ -228,7 +228,7 @@ not execution or reuse of the terminal one.
|
|||
id: WARDEN-WP-0027-T03
|
||||
status: cancel
|
||||
priority: medium
|
||||
state_hub_task_id: "94d5dcaf-abf0-417c-a6ef-26e8c50905a8"
|
||||
state_hub_task_id: "7dbedcdc-dd5a-551c-bff1-0702fea0a9cf"
|
||||
```
|
||||
|
||||
Policy-as-code for OpenBao policies/roles with tamper-evidence: a signed/hashed
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: high
|
|||
planning_order: 28
|
||||
created: "2026-07-16"
|
||||
updated: "2026-07-17"
|
||||
state_hub_workstream_id: "85b18255-d6a7-4c5e-bae0-e5b5bbc43757"
|
||||
state_hub_workstream_id: "6b66228a-199a-5b85-b5e2-a7afeaab903b"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0028 — Tenant secret custody (NetKingdom pattern)
|
||||
|
|
@ -228,7 +228,7 @@ while binky is founder-operated only.
|
|||
id: WARDEN-WP-0028-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b78cfae0-6863-4889-8a1c-81dc0b44ff3b"
|
||||
state_hub_task_id: "9982a884-7a50-593e-861e-cc8d2343a0ba"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `wiki/playbooks/tenant-secret-onboarding.md` + CredentialRouting
|
||||
|
|
@ -252,7 +252,7 @@ updated to match (or superseded with link).
|
|||
id: WARDEN-WP-0028-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "030c9e0d-cc25-44ea-93f1-ff575905dec4"
|
||||
state_hub_task_id: "d7d7ee9d-2ecf-5492-8a13-0b747d899456"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `binky-control/integrations/company-email-openbao.md` rewritten
|
||||
|
|
@ -275,7 +275,7 @@ implementation (T01 in BINKY was "prepared only").
|
|||
id: WARDEN-WP-0028-T03
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "7ebc0a27-d2cc-4b71-985b-f793db583d91"
|
||||
state_hub_task_id: "e0b675ef-9c08-5f89-8f13-ef4249ca2364"
|
||||
```
|
||||
|
||||
Done 2026-07-17: `tenants/` KV v2 mount live; CCR applier allowlist extended;
|
||||
|
|
@ -307,7 +307,7 @@ reads for verify).
|
|||
id: WARDEN-WP-0028-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "bcb8b75c-9ed6-4fbd-a2d9-19fe127d6d86"
|
||||
state_hub_task_id: "9405b13d-4045-519b-8e3f-79a891323397"
|
||||
```
|
||||
|
||||
Done 2026-07-17: catalog draft `binky-company-email-imap` (`risk: high`,
|
||||
|
|
@ -329,7 +329,7 @@ expected pointers; after T03+T05, `resolvable: true`.
|
|||
id: WARDEN-WP-0028-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "0f56a6ef-349b-41db-a6df-fe3f3cccdd13"
|
||||
state_hub_task_id: "f17bba95-bc53-5c2a-8b44-7df9e42b2341"
|
||||
```
|
||||
|
||||
Done 2026-07-17: Founder provisioned via OpenBao UI (KV version 2; not
|
||||
|
|
@ -352,7 +352,7 @@ promoted active/resolvable; CCR verification evidence complete.
|
|||
id: WARDEN-WP-0028-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "913389da-72d8-4caf-a670-fdb74c20ee97"
|
||||
state_hub_task_id: "76bd01a0-1d03-5ff9-8f59-a1b44763979d"
|
||||
```
|
||||
|
||||
Done 2026-07-17 with T01: `wiki/playbooks/tenant-secret-onboarding.md` +
|
||||
|
|
@ -373,7 +373,7 @@ session notes for tenant repos.
|
|||
id: WARDEN-WP-0028-T07
|
||||
status: done
|
||||
priority: low
|
||||
state_hub_task_id: "f65eafda-9e31-4b18-aeba-2e7a9d906ac6"
|
||||
state_hub_task_id: "46c8f8a9-3bbe-568f-8a45-07b690874273"
|
||||
```
|
||||
|
||||
Done 2026-07-17: **Decision** — tenant production lanes use `mount: tenants`
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: high
|
|||
planning_order: 29
|
||||
created: "2026-07-18"
|
||||
updated: "2026-07-18"
|
||||
state_hub_workstream_id: "6e396e7e-99c5-43aa-98a0-27f157de12a3"
|
||||
state_hub_workstream_id: "bbb3d9ec-d88d-5088-b4c0-55bfba0a10cf"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0029 — Policy front door + founder interaction surface
|
||||
|
|
@ -75,7 +75,7 @@ T05 is high priority: catalog staleness was the incident root cause.
|
|||
id: WARDEN-WP-0029-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "73ae528c-384d-43dd-a62a-455a32ec1ea5"
|
||||
state_hub_task_id: "6c213024-6601-5116-b52f-d6711dc0587d"
|
||||
```
|
||||
|
||||
Added `organization_posture: build` as axis C in
|
||||
|
|
@ -88,7 +88,7 @@ Surfaced in `warden policy list/show`, scorecard, and `warden plan` output.
|
|||
id: WARDEN-WP-0029-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "2121d102-806a-424a-8b62-bd25d7a9324e"
|
||||
state_hub_task_id: "c82d8745-4af4-5b89-ab49-06d8a902e592"
|
||||
```
|
||||
|
||||
`Catalog.freshness()` reports source (repo/bundled/override), content hash,
|
||||
|
|
@ -103,7 +103,7 @@ require `warden plan` before founder credential steps.
|
|||
id: WARDEN-WP-0029-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "32e4a755-fb74-4979-920f-32d44888df9d"
|
||||
state_hub_task_id: "34db38fa-cb99-5ced-9a12-85176a7f2b44"
|
||||
```
|
||||
|
||||
`warden plan "<need>" [--actor] [--domain] [--json]` composes catalog find +
|
||||
|
|
@ -117,7 +117,7 @@ handoff + org posture + policy gate. Verdicts: `autonomous` /
|
|||
id: WARDEN-WP-0029-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "61d25118-14ec-4846-8d53-3e09d437cac3"
|
||||
state_hub_task_id: "717f57da-fbc4-5a4d-9f8c-c1c3fa75e0ee"
|
||||
```
|
||||
|
||||
`wiki/playbooks/forgejo-admin-api-token.md` rewritten: plan-first, sanctioned
|
||||
|
|
@ -131,7 +131,7 @@ and binky-control docs.
|
|||
id: WARDEN-WP-0029-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "2ea768b7-d756-4c45-ac65-1670e069fafb"
|
||||
state_hub_task_id: "47c781d2-768b-5777-b971-b5227fe41f5c"
|
||||
```
|
||||
|
||||
`warden desk` — loopback `ThreadingHTTPServer`, short-lived token URL, acts
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ planning_priority: high
|
|||
planning_order: 30
|
||||
created: "2026-08-11"
|
||||
updated: "2026-08-15"
|
||||
state_hub_workstream_id: "29f3fcb3-e3c5-4f9d-bdfd-f76254754e21"
|
||||
state_hub_workstream_id: "da3367d5-890c-52c6-aa54-1bdd0f277342"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0030 — Delegation register
|
||||
|
|
@ -89,7 +89,7 @@ to *"who should own this front door, and what is missing?"*
|
|||
id: WARDEN-WP-0030-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3d76f6c2-5007-4ad5-8d6f-360f9303c929"
|
||||
state_hub_task_id: "6f88876e-434c-5718-9c8d-ec6bf64ae4aa"
|
||||
```
|
||||
|
||||
Add a doctrine section to `wiki/AccessRouting.md` stating the boundary: the only
|
||||
|
|
@ -105,7 +105,7 @@ targets. Cross-link INTENT.md §9.
|
|||
id: WARDEN-WP-0030-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "8013020b-d0a5-4e89-8e0b-bc418a761c84"
|
||||
state_hub_task_id: "b02e8da6-57ca-5f9f-9405-9b0624498e3a"
|
||||
```
|
||||
|
||||
Extend the catalog entry schema with:
|
||||
|
|
@ -144,7 +144,7 @@ per-lane.
|
|||
id: WARDEN-WP-0030-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "e7755708-e1bf-4d42-999c-4a60330cf154"
|
||||
state_hub_task_id: "f5e0f5af-45d8-5c82-9de2-d640d7d0a1f7"
|
||||
```
|
||||
|
||||
`warden route gaps [--json]` lists interim lanes with intended owner, blocker, and
|
||||
|
|
@ -159,7 +159,7 @@ entries in the existing drift/stale review cadence.
|
|||
id: WARDEN-WP-0030-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "ddc0268b-1279-4875-b223-0627c97d657a"
|
||||
state_hub_task_id: "b808a749-e1d7-5708-aabf-91732dd76abd"
|
||||
```
|
||||
|
||||
Update `wiki/playbooks/catalog-lane-promotion.md`: draft→active requires a
|
||||
|
|
@ -173,7 +173,7 @@ checklist.
|
|||
id: WARDEN-WP-0030-T05
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "d8796e25-e896-463d-9476-f002e38b6897"
|
||||
state_hub_task_id: "b0188ec4-4860-57c8-8030-45904a132190"
|
||||
```
|
||||
|
||||
Once T02 is reviewed, send the interim register to secrets-engine, tenant-engine,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ related_workplans:
|
|||
- WARDEN-WP-0009
|
||||
created: "2026-08-19"
|
||||
updated: "2026-08-19"
|
||||
state_hub_workstream_id: "7284a398-d529-4fe3-871e-e2505064be5e"
|
||||
state_hub_workstream_id: "739bad25-2345-5f4f-aaa3-cc4cd8c71f6c"
|
||||
---
|
||||
|
||||
# WARDEN-WP-0031 — Calling-side identity for flex-auth
|
||||
|
|
@ -64,7 +64,7 @@ point argument, applied to ops-warden as a caller).
|
|||
id: WARDEN-WP-0031-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "cd65c834-214a-4bbb-92e4-262f124fc79d"
|
||||
state_hub_task_id: "d3b7c701-bcdd-53f9-aa72-6f289bf5909b"
|
||||
```
|
||||
|
||||
**Caller identity on the outbound policy call.** `policy.caller_auth` in
|
||||
|
|
@ -82,7 +82,7 @@ until an operator opts in. Tests in `tests/test_policy.py`.
|
|||
id: WARDEN-WP-0031-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "9abdeb78-bbbb-4ff5-b3d7-5646116cf68b"
|
||||
state_hub_task_id: "b77b3c80-a168-564a-9b7f-3063aefc3c2e"
|
||||
```
|
||||
|
||||
**Readiness gate.** `scripts/check_policy_caller_identity.py` — read-only:
|
||||
|
|
@ -99,7 +99,7 @@ Done 2026-08-19.
|
|||
id: WARDEN-WP-0031-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "d3ff2ae1-2dac-45d0-b229-8b23c27c3972"
|
||||
state_hub_task_id: "4245155e-6c71-5425-b574-11f61e1d4461"
|
||||
```
|
||||
|
||||
**Docs.** `examples/warden.production.example.yaml` gains the `caller_auth`
|
||||
|
|
@ -114,7 +114,7 @@ Done 2026-08-19.
|
|||
id: WARDEN-WP-0031-T04
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "3d9d1a05-adea-4dcb-b71b-bfb2235aa198"
|
||||
state_hub_task_id: "f3834af7-2a08-51dd-bf31-8ce8550de699"
|
||||
```
|
||||
|
||||
**Pick the token source and prove it against the warn pin.** Operator work on
|
||||
|
|
@ -141,7 +141,7 @@ Evidence: `history/2026-08-19-flex-auth-caller-identity-evidence.md`.
|
|||
id: WARDEN-WP-0031-T05
|
||||
status: cancel
|
||||
priority: high
|
||||
state_hub_task_id: "8b8e68c4-587d-490d-a98f-840aaff0fdb8"
|
||||
state_hub_task_id: "3f6dc609-89db-52eb-a6f9-d2fd271be821"
|
||||
```
|
||||
|
||||
**Sequence the flip.** Only after T04: tell flex-auth to set
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ depends_on_workplans:
|
|||
- WARDEN-WP-0031
|
||||
created: "2026-08-19"
|
||||
updated: "2026-08-22"
|
||||
state_hub_workstream_id: "f1b6cdcb-5e16-48ab-a72b-339e909e92f0"
|
||||
state_hub_workstream_id: "38c6a5f3-fb0d-5230-be85-f9e3ffc850f6"
|
||||
quality_dod: DoD-Ok
|
||||
quality_dod_at: "2026-08-22"
|
||||
quality_dod_by: codex
|
||||
|
|
@ -56,7 +56,7 @@ and most of that estate is ops-warden's:
|
|||
id: WARDEN-WP-0032-T01
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "b6dac514-4b05-47b8-8745-6a1c67b6100e"
|
||||
state_hub_task_id: "b03a5caa-0bb5-5cdd-bb99-32c694b0da29"
|
||||
```
|
||||
|
||||
**Hand the estate inputs to `ZONE-WP-0001-T02`.** Not a design proposal — the
|
||||
|
|
@ -104,7 +104,7 @@ this repo's own input rather than out of supplying a new one.
|
|||
id: WARDEN-WP-0032-T02
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "08735f17-fe7e-4a6a-9b71-f350f98c30b1"
|
||||
state_hub_task_id: "b3f41c85-a293-58ad-ac27-9f8110c51266"
|
||||
```
|
||||
|
||||
**Replace `policy.enabled` with a zone-aware control.** Waits on
|
||||
|
|
@ -175,7 +175,7 @@ sign/audit evidence records zone, failure mode, outcome, and decision id.
|
|||
id: WARDEN-WP-0032-T03
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "fd642377-8d64-473c-b684-f8f1a842c223"
|
||||
state_hub_task_id: "d04a737b-ecdf-5747-ba25-20dadd99d3bc"
|
||||
```
|
||||
|
||||
**Declare ops-warden's zones** in the format `ZONE-WP-0001-T05` settles,
|
||||
|
|
@ -221,7 +221,7 @@ passes net-kingdom's current `tenancy-posture_v0.1` validator.
|
|||
id: WARDEN-WP-0032-T04
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "1af3d26e-ce21-46ca-a56c-486d52b76dcb"
|
||||
state_hub_task_id: "c7879127-3dba-55c0-853c-a10775736873"
|
||||
```
|
||||
|
||||
**Amend `ADR-0006`.** Once zones exist and enforcement scoping is owned by
|
||||
|
|
@ -240,7 +240,7 @@ control and do not instruct operators to use a global bypass.
|
|||
id: WARDEN-WP-0032-T05
|
||||
status: done
|
||||
priority: high
|
||||
state_hub_task_id: "4d5d2756-c880-4e90-8fb7-1f03674a4cd9"
|
||||
state_hub_task_id: "1d968627-83f4-59cd-84ca-0f9f35e435ff"
|
||||
```
|
||||
|
||||
**Grade the five exposed lanes now — do not wait for the model.**
|
||||
|
|
@ -284,7 +284,7 @@ policy covers these paths (T06).
|
|||
id: WARDEN-WP-0032-T06
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "8c082416-0ff9-45dc-8cbd-e9ca7913a6ef"
|
||||
state_hub_task_id: "4294084c-bf3f-5aa6-b84d-5173121882ff"
|
||||
```
|
||||
|
||||
**Make absence impossible, once the model says what absence means.** Waits on
|
||||
|
|
@ -398,7 +398,7 @@ The platform deny policy and its live proof above close the direct-OpenBao half.
|
|||
id: WARDEN-WP-0032-T07
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "6b8c8181-978c-4b0a-ac7b-2cc9ad57b3ba"
|
||||
state_hub_task_id: "6b4bbbed-2864-5fe9-82be-22ff9543f6f4"
|
||||
```
|
||||
|
||||
**Adopt Repo Manager's workload-reference owner interface.** Accepted with one
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue