tegwick
bf2b8f08ce
T01 executed and disproved the workplan's own first draft. core-hub's archive shows CORE-WP-0005 closed the production cutover gates on 2026-07-03 and CORE-WP-0007 retired the Haskell/IHP infrastructure by 2026-07-08, with a stabilization window and explicit operator approval to retire the Inter-Hub rollback deployment. The 0/0 Deployment on railiance01 is that rollback standby at its designed end state, not a lapse. The surviving finding is sharper and more urgent: hub.coulomb.social resolves to 92.205.130.254 — CoulombCore — so Core Hub's production runtime, in service since July, sits on the host being decommissioned, with no core-hub presence on railiance01 and hub-core still a package rather than a service. The workplan is retitled and re-centred on that. DECISIONS.md records the correction and why it generalises: the live documents described a retirement that had already happened while the completed evidence sat in an archived workplan, so a reader checking current files reaches the wrong conclusion. That requirement applies directly to the State Hub retirement this project is planning. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2.6 KiB
Decision Log
Auto-generated by the Custodian State Hub.
Restore the previously-live seven-action tenant-engine image rather than rebuild
Date: 2026-08-16
Decided by: grok
The four-action regression is a pin problem, not a policy-authoring problem. Image sha256:9320df39 was CI-built from e9911eb, previously live 2026-08-11, and confirmed by tenant-engine on 2026-08-13. The tenant-engine policy has not changed since that commit. A new image would re-bake unrelated later packages and would not be the artifact already verified. TEN-WP-0006 guardrail actions stay out of this restore.
Use the guardrail read/write split now: flex-auth may read, may not set
Date: 2026-08-16
Decided by: grok
TEN-WP-0006 split the actions so a PDP can read ceilings without changing them, and their tests call the read as actor=flex-auth. Leaving both actions on the single tenant-engine subject would keep the seam unused and leave the intended reader failing unknown_subject. This is a real difference: flex-auth set is denied action_not_granted. An ops write subject is out of scope; writes stay on the existing tenant-engine identity.
Generation 2 was retired correctly; the correction matters more than the finding
2026-08-20. SHR-WP-0002's first draft asserted that inter-hub had
"retired itself by attrition", inferring it from three true observations: no
~/inter-hub repo, a dead CoulombCore endpoint, and a railiance01 Deployment
scaled 0/0.
The inference was wrong. core-hub/workplans/archived/260708-CORE-WP-0007-haskell-retirement.md
records that CORE-WP-0005 closed the production cutover gates on 2026-07-03 —
hub.coulomb.social serving Core Hub, Inter-Hub compatibility, staging import
and dual-run smokes all closed — and that Haskell/IHP retirement followed on
2026-07-08 after a stabilization window and explicit operator approval to retire
the Inter-Hub rollback deployment. The 0/0 Deployment is that rollback
standby, at its designed end state.
Recorded because the failure mode generalises: live documents described a
retirement that had already happened, and the completed evidence was in an
archived workplan. core-hub/SCOPE.md still lists cutover planning as in
scope. A reader checking current files would reach the wrong conclusion, as this
project did. Retirement evidence needs to be discoverable from the live record,
not only from the archive — a requirement that applies directly to the State Hub
retirement this project is planning.
The real finding survived the correction and sharpened: the gen-3 runtime serves from the host being decommissioned.