tegwick
4c8a7b9666
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663
213 lines
9.1 KiB
Markdown
213 lines
9.1 KiB
Markdown
---
|
|
id: PNEX-WP-0004
|
|
type: workplan
|
|
title: "Publish the first deferred fleet-standards batch and authenticate CI source acquisition"
|
|
domain: infotech
|
|
repo: policy-nexus
|
|
status: finished
|
|
owner: the-custodian
|
|
topic_slug: policy-nexus
|
|
created: "2026-08-31"
|
|
updated: "2026-08-31"
|
|
depends_on_workplans:
|
|
- PNEX-WP-0003
|
|
state_hub_workstream_id: "a4f65253-4aab-5a43-8a19-3d07c11da244"
|
|
---
|
|
|
|
# PNEX-WP-0004 — fleet standards publication and CI source authentication
|
|
|
|
## Goal
|
|
|
|
Publish the first coherent return from `CUST-IN-0016`: five reviewed,
|
|
Custodian-owned fleet standards. At the same time, make the scheduled Forgejo
|
|
candidate build capable of reading private source repositories through a
|
|
dedicated least-privilege credential rather than anonymous HTTP or an admin
|
|
token.
|
|
|
|
Done means the five standards have permanent current and immutable URLs, the
|
|
source inventory and ADR-review ledger reflect the Custodian rulings, the
|
|
retained-history/currency/release gates pass, and the CI workflow fails closed
|
|
with an actionable error when its dedicated source-read credential is absent.
|
|
|
|
## Publication batch
|
|
|
|
| id | Source | Address series |
|
|
| --- | --- | --- |
|
|
| `canon-autonomy-lanes` | `canon/standards/autonomy-lanes_v0.1.md` | `/standards/autonomy-lanes/v0.1/` |
|
|
| `canon-contrib-convention` | `canon/standards/contribution-convention_v0.1.md` | `/standards/contribution-convention/v0.1/` |
|
|
| `canon-project-repository-flavor` | `canon/standards/project-repository-flavor_v0.1.md` | `/standards/project-repository-flavor/v0.1/` |
|
|
| `canon-work-record-types` | `canon/standards/work-record-types_v0.1.md` | `/standards/work-record-types/v0.1/` |
|
|
| `canon-workplan-terminology-fleet` | `canon/standards/workplan-terminology-fleet_v0.1.md` | `/standards/workplan-terminology/v0.1/` |
|
|
|
|
All five are owned by `the-custodian`, reviewed on 2026-08-31, use revision
|
|
`accepted-1`, and retain a six-month review interval. Source-owner commit:
|
|
`the-custodian@4b951be`.
|
|
|
|
## Explicit exclusions and deferrals
|
|
|
|
- `bootstrap-protocol_v0.1.md` and `custodian_constitution_v0.1.md` declare
|
|
`sensitivity: internal`; they must not be published on the public surface.
|
|
- `repo-classification-standard_v1.0.md` remains deferred until its `active`
|
|
front-matter and body-level `Draft v1.0` statement are reconciled.
|
|
- `sbom-convention_v0.1.md` remains deferred until its authority and operating
|
|
model are reviewed against current SBOM Nexus architecture.
|
|
- The other owner repositories and all five conflict rows stay with
|
|
`CUST-IN-0016`; they are not pulled into this bounded batch.
|
|
|
|
## CI credential boundary
|
|
|
|
`fetch_sources.py` may accept a Forgejo token only through an environment
|
|
variable or an explicit caller-provided value. It sends the token solely to the configured
|
|
Forgejo origin over HTTPS, never prints it, never writes it to `source-lock`,
|
|
and refuses a credential for a remote on another origin. The workflow uses a
|
|
dedicated `FORGEJO_SOURCE_TOKEN` secret. Registry credentials remain confined
|
|
to registry login and are not reused for repository reads.
|
|
|
|
Provisioning the secret is an external Custodian/platform handoff: the token
|
|
must have organization-private repository read access and no package write,
|
|
admin, cluster, or deployment authority. Code and tests may land before that
|
|
secret is installed; the scheduled workflow must fail closed until it is.
|
|
|
|
## Tasks
|
|
|
|
### T01 — Owner review and disclosure gate
|
|
|
|
```task
|
|
id: PNEX-WP-0004-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "2301c729-841b-5c5c-a9dd-aa5d4390c36b"
|
|
```
|
|
|
|
Review the Custodian slice, add truthful publication metadata to the five
|
|
public fleet standards, and record the internal/deferred sources explicitly in
|
|
`CUST-IN-0016`.
|
|
|
|
Completed 2026-08-31 in `the-custodian@4b951be`. No normative body text was
|
|
changed.
|
|
|
|
### T02 — Register and audit the five standards
|
|
|
|
```task
|
|
id: PNEX-WP-0004-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a4378f0b-cf58-5dac-9f8e-2a69b07ff6e3"
|
|
```
|
|
|
|
Add five explicit `publication.json` entries, refresh the source inventory and
|
|
review ledger, and ensure the two internal constitution sources are never
|
|
classified as publishable output.
|
|
|
|
Completed 2026-08-31. The explicit registry contains 65 documents; the source
|
|
audit reports 65 published and 79 metadata-pending sources. The two internal
|
|
constitution records are ruled `local` and have no publication address.
|
|
|
|
### T03 — Authenticate private source acquisition
|
|
|
|
```task
|
|
id: PNEX-WP-0004-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e0c0fa67-5a90-5990-a4e9-35e517816a7d"
|
|
```
|
|
|
|
Add same-origin Forgejo-token support to `fetch_sources.py`, cover header,
|
|
redaction, and cross-origin refusal behavior with unit tests, and pass only the
|
|
dedicated source token from the Forgejo workflow. Authenticate the workflow's
|
|
own archive download as well as every declared owner-repository fetch.
|
|
|
|
Completed 2026-08-31. Five authentication-boundary tests cover same-origin
|
|
header injection, cross-origin refusal, paired token/origin configuration,
|
|
anonymous mode, and full-revision archive addressing. The complete 22-test
|
|
suite passes. Installing the read-only Forgejo Actions secret remains the
|
|
credential-owner handoff and is not a code-completion gate.
|
|
|
|
### T04 — Build and publish the immutable candidate
|
|
|
|
```task
|
|
id: PNEX-WP-0004-T04
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a6f789ea-5d90-55cf-b67b-5cf401b81e66"
|
|
```
|
|
|
|
Run `make check`, retained-history build, currency, and release verification.
|
|
Publish the OCI candidate and record its image, publication-manifest,
|
|
source-inventory, and source-set digests.
|
|
|
|
2026-08-31: the local retained-history build, release verifier, and currency
|
|
gate pass for all 65 documents. Pre-publication identities are publication
|
|
manifest `c54efb4226f964b8af4e37cebcccda6d3becaa5db1cd9465c166392d2a87c842`,
|
|
source inventory
|
|
`b061ebc593f8e6353929eb795663d66278eca094429f139b6060e7b236e3d8d8`, and
|
|
source set
|
|
`7e0f0ee3fdf3bcdc8d34e7fc9ba12304ba84864b06c63e9226324e6aa0ea4e7f`.
|
|
|
|
Completed 2026-08-31 from clean Policy Nexus commit `5fbd44a`. The pushed
|
|
candidate identities are OCI
|
|
`sha256:da2c7ce7c431c6d6c4809c1539d7cf11218221505c376688122d27bae9666421`,
|
|
publication manifest
|
|
`e745f1b396f83c3a42e97478f28988327475b81540ba6d6a6d8e21e572efa8e3`,
|
|
source inventory
|
|
`64dad35098300f1fa0642ed7bb265f7c7d333d69478ff26aac5d9f0fd4e05c21`, and
|
|
source set
|
|
`8ee7f6db504b6a2dfda2c32fe820283b9df3e56fa97f47a748cc38e4fb39e9fc`.
|
|
|
|
### T05 — Promote, smoke, and close
|
|
|
|
```task
|
|
id: PNEX-WP-0004-T05
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "07c9c18d-95cf-5b09-940a-40b5ff5828a7"
|
|
```
|
|
|
|
Update the paired `rapp-policy-nexus` and `railiance-apps` bindings, pass
|
|
server-side admission, deploy atomically, and verify all five current and
|
|
immutable `accepted-1` URLs before closing this workplan.
|
|
|
|
Completed 2026-08-31. Paired binding commits `rapp-policy-nexus@29273fc` and
|
|
`railiance-apps@96d3716` passed package, image, render, and server-side
|
|
admission gates. Helm revision 6 deployed atomically; the live verifier matched
|
|
all four identities, and all five current plus five immutable `accepted-1`
|
|
addresses returned HTTPS 200.
|
|
|
|
## Closure
|
|
|
|
Finished 2026-08-31. The public collection now contains 65 explicit documents.
|
|
Five current fleet standards have permanent current and immutable addresses;
|
|
the internal constitutions remain unpublished, and 28 additional publish
|
|
rulings plus five conflicts remain visible through `CUST-IN-0016`.
|
|
|
|
Private-source CI support is implemented and tested. Credential routing found
|
|
no acceptable existing read-only token, so `railiance-platform@361005c` opened
|
|
`CCR-2026-0014`; State Hub message
|
|
`15d4ba0d-67d9-4765-b474-0004a1b398ad` requested platform review. The scheduled
|
|
build remained fail-closed while approval and installation were pending, with
|
|
the documented local clean-source path retained as the release mechanism.
|
|
|
|
Follow-up completed 2026-09-01. `CCR-2026-0014` is active with an exact,
|
|
high-risk, resolvable Warden route. Forgejo Actions run 32 succeeded for Policy
|
|
Nexus commit `1e6720b9eeba819b42133afcdfb9693608cddb42`, fetched the complete
|
|
private-source inventory through the dedicated `read:repository` credential,
|
|
passed release verification, and published candidate OCI digest
|
|
`sha256:a3a2b7b8b9432535771b588b9c78c554924ec1adc6d5a9bbc1c35b28fea6b724`.
|
|
The scheduled candidate path is therefore operational.
|
|
|
|
Production promotion completed 2026-09-01 through paired binding commits
|
|
`rapp-policy-nexus@4b8cafb0660d91b2749b0273b68ed6c738ea689d` and
|
|
`railiance-apps@36a9937be126c17d1c2b10945e25938f707a2075`. Package,
|
|
registry, render, and Kubernetes server-side admission gates passed; Helm
|
|
revision 7 deployed atomically with revision 6 retained as the rollback
|
|
baseline. The live four-identity and public-surface smoke passed, with evidence
|
|
at `rapp-policy-nexus/evidence/live/2026-09-01-railiance01-governed-source-release.json`.
|
|
|
|
## Residuals
|
|
|
|
- Rotation remains with the credential owner surfaced by
|
|
`warden route show policy-nexus-forgejo-source-read`; no token value enters
|
|
this repository or State Hub.
|
|
- `CUST-IN-0016` remains open for 26 other-owner metadata returns, two
|
|
substantive Custodian reviews, and five owner conflict rows. The two internal
|
|
constitutions are explicit local/excluded outcomes, not publication backlog.
|