Revert the npm field, re-measure coverage, and hold the layer divergence
Five inbox items worked, none of which changed a credential value or moved a
secret.
whynot-design-npm-publish: field reverted npm_token -> NPM_AUTH_TOKEN and the
path confirmed, on railiance-platform's attended, read-only, no-value field
enumeration (their docs/evidence/2026-09-10-npm-lane-field-resolution.json).
Exactly one field is present at the governed path. The 2026-09-09 change was
adopted from a coordination message and would have failed at the WP-0037-T03
rotation. The ungoverned second location is recorded as an explicit non-lane,
not deleted and not tidied away.
pep-stance coverage: published figures were stale by eight lanes (unknown
18->20, not_applicable 12->15) while resolved stayed at 3 — the denominator
moved, the classification did not. Caught by the test that asserts the published
block equals what report_coverage.py measures. tests/test_workload_join.py held
the same stale counts; both now measure the same populations.
rapp-qonto-keycape-client: blocker character updated — authority exists and is
unexercised by owner decision ("not yet", offer open), which is not the same as
no authority existing. Reopen triggers are events, never elapsed time.
flex-auth -> access-engine rename (WARDEN-IN-0003): access-engine added to the
policy-check lane's keywords so routing resolves under both names from today.
owner_repo deliberately not flipped — policy.py sends it as resource.system on
every /v1/check, and FLEX-DEC-2026-013 keeps runtime names as flex-auth.
layer declaration: INTENT.md says Staff, layer.yaml says staff, section 11 does
not say which governs. Neither changed; gate-house holds the ruling. Position in
docs/layer-declaration-precedence.md, wait in WARDEN-WP-0034-T06, and a comment
in layer.yaml telling the next session not to "fix" it — the divergence is the
evidence the ruling is made against.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
parent
15a4717dd1
commit
baf53602ca
11 changed files with 422 additions and 32 deletions
|
|
@ -14,7 +14,7 @@ planning_priority: P1
|
|||
depends_on_workplans:
|
||||
- WARDEN-WP-0030
|
||||
created: "2026-08-29"
|
||||
updated: "2026-09-05"
|
||||
updated: "2026-09-21"
|
||||
state_hub_workstream_id: "ae3ff76f-883d-5e2f-b6aa-144d61e8fdef"
|
||||
---
|
||||
|
||||
|
|
@ -231,6 +231,45 @@ cost, and issuance on this lane is too sparse (3 signature records across 79 day
|
|||
T05 stays `wait` on the remaining two: `ops-mason` (no stance map published) and
|
||||
`railiance-infra` (KRL distribution versus TTL expiry). Neither has replied.
|
||||
|
||||
## Await gate-house's §11 precedence and case-sensitivity ruling
|
||||
|
||||
```task
|
||||
id: WARDEN-WP-0034-T06
|
||||
status: wait
|
||||
priority: low
|
||||
```
|
||||
|
||||
ops-warden declares `layer: Staff` in `INTENT.md` frontmatter and `layer: staff`
|
||||
in `layer.yaml`. §11 permits both forms and is silent on which governs when both
|
||||
exist and disagree, so two conformance runs over this repository can disagree
|
||||
while both follow the standard. Nine of nine repositories carrying both forms do
|
||||
the same thing (flex-auth `tools/survey_layer_declarations.go`, receipt
|
||||
`docs/evidence/2026-09-21-layer-declaration-survey.json`).
|
||||
|
||||
**Waiting on gate-house for two rulings**: which form governs, and whether the §3
|
||||
vocabulary is case-sensitive. The custodian's estate-wide sweep adds a third that
|
||||
bears on it — §3's table capitalises and types engines `Engines` while §4's
|
||||
catalog rows type them `Engine`, so the standard disagrees with itself one level
|
||||
below B1.
|
||||
|
||||
**Deliberately not acting.** Aligning the two files now means choosing an answer
|
||||
gate-house owns, and doing it in the one place §11 says another repository may
|
||||
not speak for us. It would also erase the evidence the ruling is being made
|
||||
against: the finding is visible because nine repositories exhibit it, and a
|
||||
repository that quietly normalises itself makes the estate read as more
|
||||
conformant than it is. Position recorded in
|
||||
`docs/layer-declaration-precedence.md`; both files carry a comment saying not to
|
||||
"fix" the divergence.
|
||||
|
||||
**Done when:** gate-house rules, the non-governing file is changed to match in
|
||||
one commit, and a regression test asserts the two declarations agree so the next
|
||||
divergence is caught rather than surveyed.
|
||||
|
||||
Raised by flex-auth's corrected B1 (message `719b3e9e`, 2026-09-21), which
|
||||
withdrew an earlier claim that the estate disagreed *across* repositories. The
|
||||
withdrawal matters to this task: the original finding would have had ops-warden
|
||||
changing a file to match an estate consensus that did not exist.
|
||||
|
||||
## Related
|
||||
|
||||
Review 2026-09-05: reviewed the pending implementation and fixed the identity
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: planning
|
|||
owner: codex
|
||||
topic_slug: whynot-design-forgejo-npm-lane
|
||||
created: "2026-09-04"
|
||||
updated: "2026-09-04"
|
||||
updated: "2026-09-21"
|
||||
state_hub_workstream_id: "42a097db-1c24-558e-a724-030bb2b4443e"
|
||||
---
|
||||
|
||||
|
|
@ -110,3 +110,54 @@ production authority reports not-ready regardless of which path the catalog name
|
|||
T03 still waits on the human rotation of the dedicated Forgejo package token; the
|
||||
path question does not block that, it determines whether the pointer is correct
|
||||
once it rotates.
|
||||
|
||||
**2026-09-21 — field reverted to `NPM_AUTH_TOKEN`; path confirmed; a second
|
||||
location found.** `railiance-platform`, who holds custody of the path, answered
|
||||
both halves (msgs `c6841bdb`, `79f3e047`) and the answer reverses the 2026-09-09
|
||||
change above.
|
||||
|
||||
An attended founder session enumerated the field names present at
|
||||
`platform/workloads/coulomb/whynot-design/npm-publish`: read-only, no mutation,
|
||||
no value emitted, `attended_identity` true. **Exactly one field is present, and
|
||||
it is `NPM_AUTH_TOKEN`.** Receipt: `railiance-platform
|
||||
docs/evidence/2026-09-10-npm-lane-field-resolution.json`, commit `9d24086`. The
|
||||
both-fields reconciliation offered the day before is ruled out by the same
|
||||
enumeration. `CCR-2026-0001` has carried two dated receipts naming that field
|
||||
since 2026-06-28, one of them an attended founder fetch that exited zero — which
|
||||
is itself proof the field exists.
|
||||
|
||||
So `npm_token` is wrong *for this path*, and the catalog and playbook are
|
||||
reverted to `NPM_AUTH_TOKEN`. Reverting is a correction back to the evidenced
|
||||
value, not a new lane change.
|
||||
|
||||
The lesson is the one this plan already recorded, one level in. On 2026-09-09
|
||||
this file wrote that adopting a correction from `secrets-engine` rather than
|
||||
re-deriving it was the right shape. It was the right *source* and the wrong
|
||||
*standard of evidence*: a correction adopted from a coordination message is
|
||||
still an unverified mutation, even when it is only a field name in a catalog,
|
||||
and this one would have failed at the rotation T03 is waiting for — the moment
|
||||
it is most expensive to discover. railiance-platform's phrasing, kept because it
|
||||
is better than ours: it will break "at the moment you least want it to".
|
||||
|
||||
**The second location, which is not ours to dispose of.**
|
||||
`secret/coulomb/whynot-design/npm/publish` exists — version 1, created
|
||||
2026-07-03T15:00:44Z, never updated, five days *after* the governed lane was
|
||||
verified. It sits outside this lane's exact-path policy and outside any CCR.
|
||||
railiance-platform read metadata only: field names were not enumerated, the
|
||||
value was not read, nothing was deleted, because a location holding real
|
||||
credential material is disposed of deliberately by its owner rather than tidied
|
||||
away by whoever finds it.
|
||||
|
||||
Their unconfirmed hypothesis, recorded because it changes what this lane's
|
||||
acceptance evidence means if true: `secrets-engine`'s lowercase field may belong
|
||||
to *that* path, their catalog may declare that location, and the proven pilot
|
||||
publish may have been reading the duplicate all along. If so, a working
|
||||
production lane has been running ungoverned and this lane's acceptance evidence
|
||||
describes a path its consumer does not use. Tracked as `RPF-WP-0035-T07`;
|
||||
railiance-platform has asked `secrets-engine` which location their publish
|
||||
reads, and ops-warden has asked the same about the native
|
||||
`secrets-engine exec` front door this catalog points at (`exec_owner`).
|
||||
|
||||
Recorded in the catalog and in `wiki/playbooks/whynot-design-npm-publish.md` as
|
||||
an explicit non-lane rather than deleted from the record. Not routed around: the
|
||||
governed path stays the pointer.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue