From a3555498ddf08c1758d74358c54937b9d758227d Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 4 Oct 2026 02:32:36 +0200 Subject: [PATCH] Verify offline scaffolds and preserve Forge qualifier receiving Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10391-6355-7b41-b0fa-3e14e874f091 --- WORK-RECORDS.md | 5 +++ .../evidence/2026-10-04-catalog-scaffold.json | 44 +++++++++++++++++++ src/warden/plan.py | 3 +- wiki/CatalogLaneScaffoldContract.md | 19 ++++++++ ...WARDEN-WP-0041-catalog-lane-scaffolding.md | 29 +++++++++--- 5 files changed, 93 insertions(+), 7 deletions(-) create mode 100644 docs/evidence/2026-10-04-catalog-scaffold.json diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 6d7ddee..ac844c7 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -39,6 +39,7 @@ | workplan | WARDEN-WP-0038 | finished | — | workplans/WARDEN-WP-0038-plan-mutation-intent.md | | workplan | WARDEN-WP-0039 | blocked | — | workplans/WARDEN-WP-0039-explicit-policy-refusal.md | | workplan | WARDEN-WP-0040 | blocked | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md | +| workplan | WARDEN-WP-0041 | finished | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md | | task | WARDEN-WP-ADHOC-2026-06-27-T01 | done | — | workplans/ADHOC-2026-06-27.md | | task | WARDEN-WP-ADHOC-2026-06-29-T01 | done | — | workplans/ADHOC-2026-06-29.md | | task | WARDEN-WP-ADHOC-2026-08-11-T01 | done | — | workplans/ADHOC-2026-08-11.md | @@ -165,6 +166,10 @@ | task | WARDEN-WP-0040-T02 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md | | task | WARDEN-WP-0040-T03 | wait | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md | | task | WARDEN-WP-0040-T04 | done | — | workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md | +| task | WARDEN-WP-0041-T01 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md | +| task | WARDEN-WP-0041-T02 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md | +| task | WARDEN-WP-0041-T03 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md | +| task | WARDEN-WP-0041-T04 | done | — | workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md | | intake | WARDEN-IN-0001 | closed | — | intakes/intakes.md | | intake | WARDEN-IN-0002 | closed | — | intakes/intakes.md | | intake | WARDEN-IN-0003 | closed | — | intakes/intakes.md | diff --git a/docs/evidence/2026-10-04-catalog-scaffold.json b/docs/evidence/2026-10-04-catalog-scaffold.json new file mode 100644 index 0000000..1eed223 --- /dev/null +++ b/docs/evidence/2026-10-04-catalog-scaffold.json @@ -0,0 +1,44 @@ +{ + "status": "passed", + "scope": "offline draft cross-owner CLI fixture, no activation or live evidence", + "lane_id": "example-workload-kv", + "ccr_id": "CCR-2099-9001", + "warden_stage": "/tmp/warden-cross-owner-catalog", + "platform_stage": "/tmp/warden-cross-owner-platform", + "fixture_sha256": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32", + "catalog_request_parity": true, + "draft_only": true, + "unknown_workload_preserved": true, + "platform_auth_claims_unconfirmed": true, + "evidence_not_executed": true, + "tests": { + "warden_generator_routing_plan": "139 passed", + "platform_scaffold": "14 passed (platform-owner independently reported)", + "platform_window": "7 passed (platform-owner independently reported)" + }, + "independent_platform_acceptance": { + "status": "passed", + "scope": "actual offline owner CLIs + independently verified deterministic cross-owner fixture; no admission or runtime act", + "platform_stage": "/tmp/p4-cross-platform-tj7_84lv/platform", + "warden_stage": "/tmp/warden-cross-owner-catalog", + "fixture_sha256": "38647d436ccfa8893974c4b88c93d3bd94a9c0a21a2603b54bd84c0195954e32", + "artifact_sha256": { + "README.md": "2f48aa6ef925f62722ca32d38283d746c0c386da751dec3f9a76fba125d24245", + "credential-change-requests/CCR-2099-9001.yaml": "e9db54694b966f186433aaf1f3de6685d8f34be166af9d966950bcca448f151f", + "docs/evidence/example-workload-kv.checklist.json": "7d9a58b160c958d8d46f7029398eef8e70f87f0d9423198fb789bdf8fe3a9f9a", + "manifests/example-workload-kv.draft.yaml": "2d23bee7451735e2a0aa74435c65a0968bd05e35c35625a4087e2f286a2408b5", + "openbao/auth/example-consumer-eso.draft.json": "545a03c95c50b68b0eb127ae5e72d904faf9f68ecfabe26deac27730905b476d", + "openbao/policies/workload-kv-read-example-consumer.hcl": "c2821cd6fe5bb16564366fb12fd37c559048841a41c6f2778ad2dad5901e4df4" + }, + "new_scaffold_tests": 14, + "prior_window_tests": 7, + "unknown_workload_preserved": true, + "prospective_auth_claims_unconfirmed": true, + "frontdoor_pending_unresolvable": true, + "evidence_not_executed": true + }, + "owner_source_commits": { + "ops-warden": "dfe436e4e05610cae96085dadd582e5a63525580", + "railiance-platform": "f5b7ff5118326f66be8ecd8330d4cda9e4d94520" + } +} diff --git a/src/warden/plan.py b/src/warden/plan.py index e709b9a..1b56831 100644 --- a/src/warden/plan.py +++ b/src/warden/plan.py @@ -289,7 +289,8 @@ def _ccr_stub(need: str) -> dict: ], "commands": [ "warden route list --all", - "# after CCR: edit registry/routing/catalog.yaml + playbook", + "warden route scaffold --input --output-dir ", + "# platform drafts: use railiance-platform's documented scaffold-lane command", ], } diff --git a/wiki/CatalogLaneScaffoldContract.md b/wiki/CatalogLaneScaffoldContract.md index da6430a..a0c8a7a 100644 --- a/wiki/CatalogLaneScaffoldContract.md +++ b/wiki/CatalogLaneScaffoldContract.md @@ -93,3 +93,22 @@ no default risk or workload identity is inferred. Outputs are `catalog.yaml`, `playbook.md` and the unchanged semantic request in `request.yaml`. The output catalog is draft with execution disabled and no fetch command. This command does not invoke a platform renderer or replace the owner's admission lifecycle. + + +## Cross-owner offline verification — 2026-10-04 + +Platform owns `scripts/credential-change.py scaffold-lane --input + --catalog-manifest --output-dir +`. Its accepted synthetic paired manifests are at +`railiance-platform/examples/catalog-lane-scaffold/`. The platform schema and +renderer remain authoritative there. Warden emits three staging artifacts; +platform emits six proposed review artifacts, including its CCR, policy/auth +drafts, ESO metadata and unexecuted evidence checklist. + +The exact shared fixture preserves lane, owner, consumer, risk, CCR pointer +and manifest-byte digest across both commands. Warden's unknown workload +identity remains unknown; platform claims remain unconfirmed. Both supported +commands were executed offline, with no credential or production traffic. +The retained receipt is `docs/evidence/2026-10-04-catalog-scaffold.json`. +Routine exact supported lanes may now begin from these draft commands; +novel authority or custody flows retain their separately reviewed work. diff --git a/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md b/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md index 952e799..8a1ca34 100644 --- a/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md +++ b/workplans/WARDEN-WP-0041-catalog-lane-scaffolding.md @@ -4,12 +4,12 @@ type: workplan title: "Draft catalog lane scaffolding with platform-owned credential rendering" domain: infotech repo: ops-warden -status: ready +status: finished flavor: implementation owner: ops-warden topic_slug: netkingdom created: "2026-10-03" -updated: "2026-10-03" +updated: "2026-10-04" depends_on: [] state_hub_workstream_id: "eb42b59c-1e32-5e1b-917d-34625f7a041d" --- @@ -37,7 +37,7 @@ Platform's matching owner task is `RPF-WP-0050-T04`. ```task id: WARDEN-WP-0041-T02 -status: todo +status: done priority: medium state_hub_task_id: "68bf72d8-a798-5e88-bfda-79b8910f7cda" ``` @@ -53,13 +53,11 @@ can progress independently while platform contract review is pending. ```task id: WARDEN-WP-0041-T03 -status: wait +status: done priority: medium depends_on: - WARDEN-WP-0041-T02 - RPF-WP-0050-T04 -blocked_on: message-from:railiance-platform -blocking_reason: "Platform owner must confirm the request schema/invocation and deliver its CCR/policy-role/ESO/evidence scaffold with an offline fixture." state_hub_task_id: "33587361-2b8a-5540-9c4f-d7b4f8ef25e0" ``` @@ -81,3 +79,22 @@ Return the scoped P4 acceptance and this live owner record to the-custodian's original proposal thread. Existing admission, approval, identity confirmation, attended values and deployment evidence gates remain; no secret read or production action was taken. Source/knowledge receipt is in the seam document. + +## Offline delivery acceptance — 2026-10-04 + +T02 and T03 completed the bounded draft-generation scope. Actual-source +generator/routing/plan tests: 139 passed. Both actual owner CLIs staged the +paired synthetic fixture; lane/consumer/owner/risk/CCR pointer and manifest +digest match, unknown workload remains unknown, catalog execution is disabled, +CCR remains proposed with empty review, auth claims unconfirmed, frontdoor +pending/unresolvable and evidence not executed. Independent platform owner +verification remains separately attributed in the receipt. + +Source implementation commits: ops-warden `dfe436e4e05610cae96085dadd582e5a63525580`; +railiance-platform `f5b7ff5118326f66be8ecd8330d4cda9e4d94520`. +Evidence: `docs/evidence/2026-10-04-catalog-scaffold.json`. +`warden plan` now names the supported offline command for unroutable needs. +The workplan finishes its local draft scaffold contract; CCR approval, binding +confirmation, attended values, deployment and actual capability receipts +remain separate lane-activation work, never implied by fixture acceptance. +No unfinished in-scope implementation or residual is parked by this closure.