coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

WARDEN-WP-0037-T03: encode the founder hold as blocking_reason, depends_on SECRETS-WP-0006-T06 and decision D3 (CUST-WP-0075)
Some checks are pending
CI Smoke / host-smoke (push) Waiting to run
Details
CI Smoke / container-smoke (push) Waiting to run
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 3775@bnt-lap001
Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
This commit is contained in:
tegwick 2026-10-03 03:45:54 +02:00
parent 3bf5917955
commit 1ad3e02e2d
1 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
View file

@ -9,7 +9,7 @@ flavor: planning
owner: codex
topic_slug: whynot-design-forgejo-npm-lane
created: "2026-09-04"
updated: "2026-09-28"
updated: "2026-10-03"
state_hub_workstream_id: "42a097db-1c24-558e-a724-030bb2b4443e"
---
@ -61,6 +61,9 @@ id: WARDEN-WP-0037-T03
status: wait
priority: high
needs_human: true
decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
depends_on: [SECRETS-WP-0006-T06]
blocking_reason: "Founder HOLD 2026-09-21: no rotation until SECRETS-WP-0006-T06 moves the publish lane off the legacy whynot-design npm path; then rotate and prove a fresh publish."
intervention_note: "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane."
state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
```
@ -183,3 +186,5 @@ founder's no-rotation hold remains binding until SECRETS-WP-0006-T06 supplies
native governed-consumer migration evidence; a dedicated token rotation and a
fresh package publish/exact-version lookup then remain. No credential fetch,
rotation or publication was attempted.
2026-10-03 (CUST-WP-0075): the gate was only in intervention_note. Encoded as blocking_reason, depends_on SECRETS-WP-0006-T06, and hub decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa (D3: trust root and secret custody), which also carries the matching RPF-WP-0035-T07 hold.