From c8fa02adf0ab9ef699508141f099bc71c38e76f3 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 11:25:03 +0200 Subject: [PATCH] docs: advance remaining owner gates Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836 --- ...RDEN-WP-0027-credential-governance-lockdown.md | 12 +++++++++++- workplans/WARDEN-WP-0033-native-lane-handoff.md | 15 ++++++++++++++- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md index 5a2a55d..f6657f2 100644 --- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md +++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md @@ -10,7 +10,7 @@ topic_slug: custodian planning_priority: medium planning_order: 27 created: "2026-07-16" -updated: "2026-08-22" +updated: "2026-08-23" state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb" --- @@ -212,6 +212,16 @@ owner receipt is requires owner acceptance, fresh receipts, a new scenario id, and a new human decision. +**Containment review status 2026-08-23.** `railiance-infra` independently +accepted the exact implementation revision at its commit `186b030` and State +Hub message `7b2846dd-4b7c-4933-b61f-921e8ccf9ff2`, after rerunning the 42 +focused tests and lint. Direct platform review request +`9a5f8973-0e74-4df2-8089-5a5bdc42295b` now carries the exact revision, receipt, +test results, and infra acceptance. T02 remains `progress` until +`railiance-platform` accepts or requests changes. No human GO is relevant while +that owner gate is open; acceptance will permit preparation of a new scenario, +not execution or reuse of the terminal one. + ## Task: Tamper-evident policy governance + reconcile ```task diff --git a/workplans/WARDEN-WP-0033-native-lane-handoff.md b/workplans/WARDEN-WP-0033-native-lane-handoff.md index 2ab69a0..1e20015 100644 --- a/workplans/WARDEN-WP-0033-native-lane-handoff.md +++ b/workplans/WARDEN-WP-0033-native-lane-handoff.md @@ -11,7 +11,7 @@ planning_priority: P1 depends_on_workplans: - WARDEN-WP-0030 created: "2026-08-21" -updated: "2026-08-22" +updated: "2026-08-23" state_hub_workstream_id: "4627d89b-4b00-562a-81e9-76e96f90fa7e" --- @@ -199,6 +199,19 @@ avoid is the 2026-08-17 one recorded in `.claude/rules/finding-routing.md`: ops-warden answered a question well and never routed it, and another repo ended up filing it. +**Followed up 2026-08-23 after the immediate enforcement gap closed.** +`RAILIANCE-WP-0022` no longer waits for this ownership decision: the platform +owner deployed a dedicated coding-agent AppRole, proved deny-wins when it is +combined with workload read, and identified an exact-bound KeyCape JWT role as +the migration target. That makes the remaining question narrower and more +important rather than obsolete: who owns issuance of the durable +KeyCape/Keycloak-backed machine identity? + +Direct follow-up `d25d4604-5713-42a8-8e3a-1ea31b5a5cc7` asks `key-cape` to +accept that target identity with an authoritative workplan/interface, or refuse +and name the actual owner. T04 remains `wait` until one of those two answers is +recorded; the live AppRole is operational evidence, not an ownership answer. + ```task id: WARDEN-WP-0033-T05 status: done