coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

fix(workplans): adopt ADR-007 derived identifiers for unregistered records
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
These workplans exist only in the retired local hub. Their random pre-ADR-007
identifiers are refused by C-06 as stale references, so they cannot be
registered. Deriving from the canonical record id takes no identity from
anything: central does not hold them and the old ids die with the cache.

Records central already holds were deliberately left untouched.

Refs CUST-WP-0068-T06

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
This commit is contained in:
codex 2026-08-25 20:16:12 +02:00
parent 76e545ecf0
commit 186fa99f58
10 changed files with 61 additions and 61 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/WARDEN-WP-0027-credential-governance-lockdown.md
View file

@ -11,7 +11,7 @@ planning_priority: medium
planning_order: 27
created: "2026-07-16"
updated: "2026-08-23"
state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
state_hub_workstream_id: "21528e8d-a049-523d-9ae1-da7a27cb8bbf"
---
# Tamper-resistant credential governance + mass rotation/lockdown (Strand B)
@ -69,7 +69,7 @@ path; ops-warden sequences and verifies it.
id: WARDEN-WP-0027-T01
status: cancel
priority: high
state_hub_task_id: "604aad14-d398-4c02-85e5-7ff37a905a1b"
state_hub_task_id: "b5691939-9d84-5115-9618-0f8839010d14"
```
Turn Strand A's per-lane `rotation:` guidance (WP-0026 T06) into an executable
@ -90,7 +90,7 @@ each verified capabilities-safe, taint cleared only on success.
id: WARDEN-WP-0027-T02
status: progress
priority: medium
state_hub_task_id: "9d004d8f-6215-4178-bd13-5785d24fd152"
state_hub_task_id: "cae498ee-6307-5d32-9f1b-a471cfcc2536"
```
Design and document a graded lockdown: (a) soft — deny agent roles read on all
@ -228,7 +228,7 @@ not execution or reuse of the terminal one.
id: WARDEN-WP-0027-T03
status: cancel
priority: medium
state_hub_task_id: "94d5dcaf-abf0-417c-a6ef-26e8c50905a8"
state_hub_task_id: "7dbedcdc-dd5a-551c-bff1-0702fea0a9cf"
```
Policy-as-code for OpenBao policies/roles with tamper-evidence: a signed/hashed