Verify offline scaffolds and preserve Forge qualifier receiving
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091
This commit is contained in:
parent
dfe436e4e0
commit
a3555498dd
5 changed files with 93 additions and 7 deletions
|
|
@ -39,6 +39,7 @@
|
|||
| workplan | WARDEN-WP-0038 | finished | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md |
|
||||
| workplan | WARDEN-WP-0039 | blocked | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md |
|
||||
| workplan | WARDEN-WP-0040 | blocked | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
|
||||
| workplan | WARDEN-WP-0041 | finished | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
|
||||
| task | WARDEN-WP-ADHOC-2026-06-27-T01 | done | — | workplans/ADHOC-2026-06-27.md |
|
||||
| task | WARDEN-WP-ADHOC-2026-06-29-T01 | done | — | workplans/ADHOC-2026-06-29.md |
|
||||
| task | WARDEN-WP-ADHOC-2026-08-11-T01 | done | — | workplans/ADHOC-2026-08-11.md |
|
||||
|
|
@ -165,6 +166,10 @@
|
|||
| task | WARDEN-WP-0040-T02 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
|
||||
| task | WARDEN-WP-0040-T03 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
|
||||
| task | WARDEN-WP-0040-T04 | done | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md |
|
||||
| task | WARDEN-WP-0041-T01 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
|
||||
| task | WARDEN-WP-0041-T02 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
|
||||
| task | WARDEN-WP-0041-T03 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
|
||||
| task | WARDEN-WP-0041-T04 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md |
|
||||
| intake | WARDEN-IN-0001 | closed | — | intakes/intakes.md |
|
||||
| intake | WARDEN-IN-0002 | closed | — | intakes/intakes.md |
|
||||
| intake | WARDEN-IN-0003 | closed | — | intakes/intakes.md |
|
||||
|
|
|
|||
44
docs/evidence/2026-10-04-catalog-scaffold.json
Normal file
44
docs/evidence/2026-10-04-catalog-scaffold.json
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"status": "passed",
|
||||
"scope": "offline draft cross-owner CLI fixture, no activation or live evidence",
|
||||
"lane_id": "example-workload-kv",
|
||||
"ccr_id": "CCR-2099-9001",
|
||||
"warden_stage": "/tmp/warden-cross-owner-catalog",
|
||||
"platform_stage": "/tmp/warden-cross-owner-platform",
|
||||
"fixture_sha256": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32",
|
||||
"catalog_request_parity": true,
|
||||
"draft_only": true,
|
||||
"unknown_workload_preserved": true,
|
||||
"platform_auth_claims_unconfirmed": true,
|
||||
"evidence_not_executed": true,
|
||||
"tests": {
|
||||
"warden_generator_routing_plan": "139 passed",
|
||||
"platform_scaffold": "14 passed (platform-owner independently reported)",
|
||||
"platform_window": "7 passed (platform-owner independently reported)"
|
||||
},
|
||||
"independent_platform_acceptance": {
|
||||
"status": "passed",
|
||||
"scope": "actual offline owner CLIs + independently verified deterministic cross-owner fixture; no admission or runtime act",
|
||||
"platform_stage": "/tmp/p4-cross-platform-tj7_84lv/platform",
|
||||
"warden_stage": "/tmp/warden-cross-owner-catalog",
|
||||
"fixture_sha256": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32",
|
||||
"artifact_sha256": {
|
||||
"README.md": "2f48aa6ef925f62722ca32d38283d746c0c386da751dec3f9a76fba125d24245",
|
||||
"credential-change-requests/CCR-2099-9001.yaml": "e9db54694b966f186433aaf1f3de6685d8f34be166af9d966950bcca448f151f",
|
||||
"docs/evidence/example-workload-kv.checklist.json": "7d9a58b160c958d8d46f7029398eef8e70f87f0d9423198fb789bdf8fe3a9f9a",
|
||||
"manifests/example-workload-kv.draft.yaml": "2d23bee7451735e2a0aa74435c65a0968bd05e35c35625a4087e2f286a2408b5",
|
||||
"openbao/auth/example-consumer-eso.draft.json": "545a03c95c50b68b0eb127ae5e72d904faf9f68ecfabe26deac27730905b476d",
|
||||
"openbao/policies/workload-kv-read-example-consumer.hcl": "c2821cd6fe5bb16564366fb12fd37c559048841a41c6f2778ad2dad5901e4df4"
|
||||
},
|
||||
"new_scaffold_tests": 14,
|
||||
"prior_window_tests": 7,
|
||||
"unknown_workload_preserved": true,
|
||||
"prospective_auth_claims_unconfirmed": true,
|
||||
"frontdoor_pending_unresolvable": true,
|
||||
"evidence_not_executed": true
|
||||
},
|
||||
"owner_source_commits": {
|
||||
"ops-warden": "dfe436e4e05610cae96085dadd582e5a63525580",
|
||||
"railiance-platform": "f5b7ff5118326f66be8ecd8330d4cda9e4d94520"
|
||||
}
|
||||
}
|
||||
|
|
@ -289,7 +289,8 @@ def _ccr_stub(need: str) -> dict:
|
|||
],
|
||||
"commands": [
|
||||
"warden route list --all",
|
||||
"# after CCR: edit registry/routing/catalog.yaml + playbook",
|
||||
"warden route scaffold --input <warden-request.yaml> --output-dir <new-staging-directory>",
|
||||
"# platform drafts: use railiance-platform's documented scaffold-lane command",
|
||||
],
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -93,3 +93,22 @@ no default risk or workload identity is inferred. Outputs are `catalog.yaml`,
|
|||
`playbook.md` and the unchanged semantic request in `request.yaml`. The output
|
||||
catalog is draft with execution disabled and no fetch command. This command
|
||||
does not invoke a platform renderer or replace the owner's admission lifecycle.
|
||||
|
||||
|
||||
## Cross-owner offline verification — 2026-10-04
|
||||
|
||||
Platform owns `scripts/credential-change.py scaffold-lane --input
|
||||
<platform-request.yaml> --catalog-manifest <warden-request.yaml> --output-dir
|
||||
<new-staging-directory>`. Its accepted synthetic paired manifests are at
|
||||
`railiance-platform/examples/catalog-lane-scaffold/`. The platform schema and
|
||||
renderer remain authoritative there. Warden emits three staging artifacts;
|
||||
platform emits six proposed review artifacts, including its CCR, policy/auth
|
||||
drafts, ESO metadata and unexecuted evidence checklist.
|
||||
|
||||
The exact shared fixture preserves lane, owner, consumer, risk, CCR pointer
|
||||
and manifest-byte digest across both commands. Warden's unknown workload
|
||||
identity remains unknown; platform claims remain unconfirmed. Both supported
|
||||
commands were executed offline, with no credential or production traffic.
|
||||
The retained receipt is `docs/evidence/2026-10-04-catalog-scaffold.json`.
|
||||
Routine exact supported lanes may now begin from these draft commands;
|
||||
novel authority or custody flows retain their separately reviewed work.
|
||||
|
|
|
|||
|
|
@ -4,12 +4,12 @@ type: workplan
|
|||
title: "Draft catalog lane scaffolding with platform-owned credential rendering"
|
||||
domain: infotech
|
||||
repo: ops-warden
|
||||
status: ready
|
||||
status: finished
|
||||
flavor: implementation
|
||||
owner: ops-warden
|
||||
topic_slug: netkingdom
|
||||
created: "2026-10-03"
|
||||
updated: "2026-10-03"
|
||||
updated: "2026-10-04"
|
||||
depends_on: []
|
||||
state_hub_workstream_id: "eb42b59c-1e32-5e1b-917d-34625f7a041d"
|
||||
---
|
||||
|
|
@ -37,7 +37,7 @@ Platform's matching owner task is `RPF-WP-0050-T04`.
|
|||
|
||||
```task
|
||||
id: WARDEN-WP-0041-T02
|
||||
status: todo
|
||||
status: done
|
||||
priority: medium
|
||||
state_hub_task_id: "68bf72d8-a798-5e88-bfda-79b8910f7cda"
|
||||
```
|
||||
|
|
@ -53,13 +53,11 @@ can progress independently while platform contract review is pending.
|
|||
|
||||
```task
|
||||
id: WARDEN-WP-0041-T03
|
||||
status: wait
|
||||
status: done
|
||||
priority: medium
|
||||
depends_on:
|
||||
- WARDEN-WP-0041-T02
|
||||
- RPF-WP-0050-T04
|
||||
blocked_on: message-from:railiance-platform
|
||||
blocking_reason: "Platform owner must confirm the request schema/invocation and deliver its CCR/policy-role/ESO/evidence scaffold with an offline fixture."
|
||||
state_hub_task_id: "33587361-2b8a-5540-9c4f-d7b4f8ef25e0"
|
||||
```
|
||||
|
||||
|
|
@ -81,3 +79,22 @@ Return the scoped P4 acceptance and this live owner record to the-custodian's
|
|||
original proposal thread. Existing admission, approval, identity confirmation,
|
||||
attended values and deployment evidence gates remain; no secret read or
|
||||
production action was taken. Source/knowledge receipt is in the seam document.
|
||||
|
||||
## Offline delivery acceptance — 2026-10-04
|
||||
|
||||
T02 and T03 completed the bounded draft-generation scope. Actual-source
|
||||
generator/routing/plan tests: 139 passed. Both actual owner CLIs staged the
|
||||
paired synthetic fixture; lane/consumer/owner/risk/CCR pointer and manifest
|
||||
digest match, unknown workload remains unknown, catalog execution is disabled,
|
||||
CCR remains proposed with empty review, auth claims unconfirmed, frontdoor
|
||||
pending/unresolvable and evidence not executed. Independent platform owner
|
||||
verification remains separately attributed in the receipt.
|
||||
|
||||
Source implementation commits: ops-warden `dfe436e4e05610cae96085dadd582e5a63525580`;
|
||||
railiance-platform `f5b7ff5118326f66be8ecd8330d4cda9e4d94520`.
|
||||
Evidence: `docs/evidence/2026-10-04-catalog-scaffold.json`.
|
||||
`warden plan` now names the supported offline command for unroutable needs.
|
||||
The workplan finishes its local draft scaffold contract; CCR approval, binding
|
||||
confirmation, attended values, deployment and actual capability receipts
|
||||
remain separate lane-activation work, never implied by fixture acceptance.
|
||||
No unfinished in-scope implementation or residual is parked by this closure.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue