From e24d2d5bd084e2166269e8e6e11438d856a46c9d Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 22 Aug 2026 15:50:42 +0200 Subject: [PATCH] docs: record live zone config migration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1 --- .../security-zone-admission-2026-08-22.md | 5 ++++- scripts/check_policy_caller_identity.py | 6 +++--- workplans/WARDEN-WP-0032-security-zones.md | 15 ++++----------- 3 files changed, 11 insertions(+), 15 deletions(-) diff --git a/docs/evidence/security-zone-admission-2026-08-22.md b/docs/evidence/security-zone-admission-2026-08-22.md index 44ce9e3..9ffce90 100644 --- a/docs/evidence/security-zone-admission-2026-08-22.md +++ b/docs/evidence/security-zone-admission-2026-08-22.md @@ -24,7 +24,10 @@ This record supports the `z1-operational` membership declared in - Data handling: `ADR-0002` makes ops-warden a transparent conduit and `ADR-0004`/`ADR-0007` prevent raw agent reads and fail safe on ungraded lanes. - Policy path: `history/2026-08-19-flex-auth-caller-identity-evidence.md` proves - the authenticated caller path and anonymous rejection. + the authenticated caller path and anonymous rejection. At adoption, the + migrated real operator config reran the check successfully through the + existing tunnel: HTTP 200, effect `allow`, decision + `decision:f3f7c88f9585582a`. ## Why not z2 diff --git a/scripts/check_policy_caller_identity.py b/scripts/check_policy_caller_identity.py index 38084c1..d2a4324 100755 --- a/scripts/check_policy_caller_identity.py +++ b/scripts/check_policy_caller_identity.py @@ -190,9 +190,9 @@ def main() -> int: ) return 1 print( - "\nREADY — the calling side presents an identity. Next: tell flex-auth to set " - "callerAuth.mode: enforce on flex-auth-ops-warden and re-run this check. " - "Zone-specific PEP failure modes already replace the retired global switches." + "\nREADY — the calling side presents an identity. Verify " + "callerAuth.mode remains enforce on flex-auth-ops-warden after rollout. " + "Zone-specific PEP failure modes replace the retired global switches." ) return 0 diff --git a/workplans/WARDEN-WP-0032-security-zones.md b/workplans/WARDEN-WP-0032-security-zones.md index 9c831ca..ecabf64 100644 --- a/workplans/WARDEN-WP-0032-security-zones.md +++ b/workplans/WARDEN-WP-0032-security-zones.md @@ -166,17 +166,10 @@ explicit `unknown` profile and its configured failure mode. stance over every v0.1 zone plus `unknown`, preserves native enforcement for `not-applicable`, and returns `audit_only` for advisory decisions. The required live caller check passed through the existing tunnel with command-mode caller -identity and decision `decision:f3f7c88f9585582a`; the check used a temporary -migrated copy because the operator's persistent config still carries the two -retired keys. Full repo tests pass and sign/audit evidence records zone, -failure mode, outcome, and decision id. - -The required readiness recheck was run on 2026-08-22 after `warden plan` -returned `autonomous`. It correctly returned **NOT READY** before obtaining or -printing any token because the active operator `warden.yaml` still contains -the two retired global keys. Operator configuration migration is therefore an -explicit remaining acceptance step, followed by the value-safe live -`/v1/check` smoke. Do not ask flex-auth to enforce caller authentication yet. +identity and decision `decision:f3f7c88f9585582a`. The operator config was then +migrated from the two rejected global keys to `zone_registry_path`, and the +same live check passed against that real config. Full repo tests pass and +sign/audit evidence records zone, failure mode, outcome, and decision id. ```task id: WARDEN-WP-0032-T03