tegwick
030362085a
`ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos
opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection
reset refused 9 records for exactly this reason.
Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as
`{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing
ids on the condition they are never *silently* re-derived. This is the explicit
migration that clause allows for.
The hub id is derived from the record id, so a changed id is a different
record: stale state_hub_*_id fields are dropped and fix-consistency re-derives.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
38 lines
1.6 KiB
Markdown
38 lines
1.6 KiB
Markdown
---
|
|
id: WARDEN-WP-ADHOC-2026-06-29
|
|
type: workplan
|
|
title: "Ad Hoc Tasks — 2026-06-29"
|
|
domain: infotech
|
|
repo: ops-warden
|
|
status: finished
|
|
owner: claude
|
|
topic_slug: custodian
|
|
created: "2026-06-29"
|
|
updated: "2026-06-29"
|
|
---
|
|
|
|
# Ad Hoc Tasks — 2026-06-29
|
|
|
|
### T01 — Joint-smoke mode for the deployed flex-auth (assist FLEX-WP-0007 T4)
|
|
|
|
```task
|
|
id: WARDEN-WP-ADHOC-2026-06-29-T01
|
|
status: done
|
|
priority: medium
|
|
```
|
|
|
|
flex-auth (msg `ea00620b`) asked ops-warden to help close FLEX-WP-0007 T4 (joint OpenBao
|
|
+ policy-gate production smoke). Their deployed runtime is reachable on CoulombCore via
|
|
the flex-auth-coulombcore tunnel at `127.0.0.1:18090`, but `policy_gate_production_smoke.sh`
|
|
spawned its **own** local flex-auth binary — so it never exercised the deployed runtime.
|
|
|
|
- [x] Added `FLEX_AUTH_EXTERNAL=1` mode to `scripts/policy_gate_production_smoke.sh`: skips
|
|
the local `serve`/`load-registry` and runs the allow/deny/vault paths against the
|
|
already-running deployed flex-auth, with a `/healthz` precheck that fails fast with a
|
|
"is the flex-auth-coulombcore tunnel up?" hint (verified: clean exit 2 when down).
|
|
- [x] Verified the committed `production_registry_snapshot.json` is **current** (rebuilt
|
|
from `~/.config/warden/inventory.yaml`, diff-clean; 4 actors).
|
|
- [x] Answered flex-auth's three questions and handed the operator the exact CoulombCore
|
|
runbook (see reply). Remaining T4 steps are operator-gated and cannot run from the
|
|
workstation: mint a scoped `VAULT_TOKEN` (ops-warden holds no standing token by
|
|
design), run the joint smoke on CoulombCore, then flip `policy.enabled: true`.
|