coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions
ops-warden/workplans/ADHOC-2026-06-29.md
tegwick 030362085a
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
fix(workplans): qualify ad-hoc identifiers with the repository prefix 
`ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos
opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection
reset refused 9 records for exactly this reason.

Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as
`{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing
ids on the condition they are never *silently* re-derived. This is the explicit
migration that clause allows for.

The hub id is derived from the record id, so a changed id is a different
record: stale state_hub_*_id fields are dropped and fix-consistency re-derives.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-28 00:28:23 +02:00

1.6 KiB
Raw Blame History

id type title domain repo status owner topic_slug created updated
WARDEN-WP-ADHOC-2026-06-29 workplan Ad Hoc Tasks — 2026-06-29 infotech ops-warden finished claude custodian 2026-06-29 2026-06-29

Ad Hoc Tasks — 2026-06-29

T01 — Joint-smoke mode for the deployed flex-auth (assist FLEX-WP-0007 T4)

id: WARDEN-WP-ADHOC-2026-06-29-T01
status: done
priority: medium

flex-auth (msg ea00620b) asked ops-warden to help close FLEX-WP-0007 T4 (joint OpenBao

  • policy-gate production smoke). Their deployed runtime is reachable on CoulombCore via the flex-auth-coulombcore tunnel at 127.0.0.1:18090, but policy_gate_production_smoke.sh spawned its own local flex-auth binary — so it never exercised the deployed runtime.
  • Added FLEX_AUTH_EXTERNAL=1 mode to scripts/policy_gate_production_smoke.sh: skips the local serve/load-registry and runs the allow/deny/vault paths against the already-running deployed flex-auth, with a /healthz precheck that fails fast with a "is the flex-auth-coulombcore tunnel up?" hint (verified: clean exit 2 when down).
  • Verified the committed production_registry_snapshot.json is current (rebuilt from ~/.config/warden/inventory.yaml, diff-clean; 4 actors).
  • Answered flex-auth's three questions and handed the operator the exact CoulombCore runbook (see reply). Remaining T4 steps are operator-gated and cannot run from the workstation: mint a scoped VAULT_TOKEN (ops-warden holds no standing token by design), run the joint smoke on CoulombCore, then flip policy.enabled: true.