From 1ad3e02e2db137ddafd1c907c0fbcc4dcdba9ffc Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 3 Oct 2026 03:45:54 +0200 Subject: [PATCH] WARDEN-WP-0037-T03: encode the founder hold as blocking_reason, depends_on SECRETS-WP-0006-T06 and decision D3 (CUST-WP-0075) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3 --- workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md index 2bf8391..17e6c0f 100644 --- a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md +++ b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md @@ -9,7 +9,7 @@ flavor: planning owner: codex topic_slug: whynot-design-forgejo-npm-lane created: "2026-09-04" -updated: "2026-09-28" +updated: "2026-10-03" state_hub_workstream_id: "42a097db-1c24-558e-a724-030bb2b4443e" --- @@ -61,6 +61,9 @@ id: WARDEN-WP-0037-T03 status: wait priority: high needs_human: true +decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa +depends_on: [SECRETS-WP-0006-T06] +blocking_reason: "Founder HOLD 2026-09-21: no rotation until SECRETS-WP-0006-T06 moves the publish lane off the legacy whynot-design npm path; then rotate and prove a fresh publish." intervention_note: "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane." state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817" ``` @@ -183,3 +186,5 @@ founder's no-rotation hold remains binding until SECRETS-WP-0006-T06 supplies native governed-consumer migration evidence; a dedicated token rotation and a fresh package publish/exact-version lookup then remain. No credential fetch, rotation or publication was attempted. + +2026-10-03 (CUST-WP-0075): the gate was only in intervention_note. Encoded as blocking_reason, depends_on SECRETS-WP-0006-T06, and hub decision 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa (D3: trust root and secret custody), which also carries the matching RPF-WP-0035-T07 hold.