coulomb/ops-warden
5
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Requalify tasks after founder decisions D1/D2/D3 (2026-10-11)
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
See the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1370019@bnt-lap001
Assistant-Session: d462dd63-16de-4189-ae70-b9cd6566bf87
This commit is contained in:
tegwick 2026-10-11 20:31:57 +02:00
parent 888d4f424c
commit 237891fc9b
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/WARDEN-WP-0027-credential-governance-lockdown.md
View file

@ -89,14 +89,14 @@ each verified capabilities-safe, taint cleared only on success.
```task
id: WARDEN-WP-0027-T02
status: wait
needs_human: true
status: todo
decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
blocking_reason: "Trust-root design is a founder decision: who holds unseal shares and recovery keys, quorum, break-glass invocation; executable seal steps are attended."
priority: medium
state_hub_task_id: "cae498ee-6307-5d32-9f1b-a471cfcc2536"
```
2026-10-11: requalified after founder decision D3 (trust root, build-mode default) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
Design and document a graded lockdown: (a) soft — deny agent roles read on all
high-risk lanes; (b) hard — seal + re-key with a pre-designed trust-root and quorum.
Define the trust-root (who holds unseal shares, recovery keys), the break-glass

5
workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
View file

@ -60,14 +60,15 @@ from returning.
id: WARDEN-WP-0037-T03
status: wait
priority: high
needs_human: true
decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
depends_on: [SECRETS-WP-0006-T06]
blocking_reason: "Founder HOLD 2026-09-21: no rotation until SECRETS-WP-0006-T06 moves the publish lane off the legacy whynot-design npm path; then rotate and prove a fresh publish."
blocking_reason: "Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish."
intervention_note: "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane."
state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
```
2026-10-11: requalified after founder decision D3 (trust root, build-mode default) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
Pass catalog and routing tests, verify the checkout route, and record the exact
Forgejo package release proven through the lane.