coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

docs: advance remaining owner gates
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0290b-3241-74c3-b868-6049545af836
This commit is contained in:
tegwick 2026-08-23 11:25:03 +02:00
parent bc1966da82
commit c8fa02adf0
2 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/WARDEN-WP-0027-credential-governance-lockdown.md
View file

@ -10,7 +10,7 @@ topic_slug: custodian
planning_priority: medium
planning_order: 27
created: "2026-07-16"
updated: "2026-08-22"
updated: "2026-08-23"
state_hub_workstream_id: "7d697c52-766a-4562-b2ad-a722880bcdcb"
---
@ -212,6 +212,16 @@ owner receipt is
requires owner acceptance, fresh receipts, a new scenario id, and a new human
decision.
**Containment review status 2026-08-23.** `railiance-infra` independently
accepted the exact implementation revision at its commit `186b030` and State
Hub message `7b2846dd-4b7c-4933-b61f-921e8ccf9ff2`, after rerunning the 42
focused tests and lint. Direct platform review request
`9a5f8973-0e74-4df2-8089-5a5bdc42295b` now carries the exact revision, receipt,
test results, and infra acceptance. T02 remains `progress` until
`railiance-platform` accepts or requests changes. No human GO is relevant while
that owner gate is open; acceptance will permit preparation of a new scenario,
not execution or reuse of the terminal one.
## Task: Tamper-evident policy governance + reconcile
```task

15
workplans/WARDEN-WP-0033-native-lane-handoff.md
View file

@ -11,7 +11,7 @@ planning_priority: P1
depends_on_workplans:
- WARDEN-WP-0030
created: "2026-08-21"
updated: "2026-08-22"
updated: "2026-08-23"
state_hub_workstream_id: "4627d89b-4b00-562a-81e9-76e96f90fa7e"
---
@ -199,6 +199,19 @@ avoid is the 2026-08-17 one recorded in `.claude/rules/finding-routing.md`:
ops-warden answered a question well and never routed it, and another repo ended
up filing it.
**Followed up 2026-08-23 after the immediate enforcement gap closed.**
`RAILIANCE-WP-0022` no longer waits for this ownership decision: the platform
owner deployed a dedicated coding-agent AppRole, proved deny-wins when it is
combined with workload read, and identified an exact-bound KeyCape JWT role as
the migration target. That makes the remaining question narrower and more
important rather than obsolete: who owns issuance of the durable
KeyCape/Keycloak-backed machine identity?
Direct follow-up `d25d4604-5713-42a8-8e3a-1ea31b5a5cc7` asks `key-cape` to
accept that target identity with an authoritative workplan/interface, or refuse
and name the actual owner. T04 remains `wait` until one of those two answers is
recorded; the live AppRole is operational evidence, not an ownership answer.
```task
id: WARDEN-WP-0033-T05
status: done