From b06d1f0b37e0aaa8e22671f582f04ccabfdde161 Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 19 Oct 2026 13:30:55 +0200 Subject: [PATCH] build: adopt staged records and retain reviewed orientation snapshot Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181 --- .custodian-brief.md | 8 +++----- .generated-work-records.json | 1 + .generated-work-records.mk | 8 ++++++++ Makefile | 7 +++++++ SCOPE.md | 17 ++++++++++++++++ WORK-RECORDS.md | 38 ++++++++++++++++++++++++++++++++++-- 6 files changed, 72 insertions(+), 7 deletions(-) create mode 100644 .generated-work-records.json create mode 100644 .generated-work-records.mk diff --git a/.custodian-brief.md b/.custodian-brief.md index 4d6bd6f..5cd1a19 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — railiance-platform **Domain:** financials -**Last synced:** 2026-10-18 10:41 UTC +**Last synced:** 2026-10-18 10:49 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -29,12 +29,10 @@ Progress: 3/4 done | workplan_id: `f4640325-e89c-591d-b58e-ec6b087900ac` *(wait: Single-node outage exercise needs operator access and a declared restart order coordinated with railiance-infra, railiance-cluster, audit-core and the OpenBao package owner.)* ### Self-service CCR intake: clients file and progress CCRs without a platform worker -Progress: 2/5 done | workplan_id: `bad0cc9b-e8ad-572b-8d0d-fb3adb208b4a` +Progress: 4/5 done | workplan_id: `bad0cc9b-e8ad-572b-8d0d-fb3adb208b4a` **Open tasks:** -- ► T03 — CI gate on `ccr/*` branches `0fd97924` -- ► T04 — Hub decision on submit and client-run `sync-decision` `15ac9eae` -- · T05 — Client documentation and first self-service CCR `27797fa5` +- ! T05 — Client documentation and first self-service CCR `27797fa5` ### Admit hourly receiver cadence and exact Qonto collector custody Progress: 3/4 done | workplan_id: `d57eeafb-c406-5e1e-841c-5d1288aacabf` diff --git a/.generated-work-records.json b/.generated-work-records.json new file mode 100644 index 0000000..c79e8bc --- /dev/null +++ b/.generated-work-records.json @@ -0,0 +1 @@ +{"version":1,"repo_slug":"railiance-platform"} diff --git a/.generated-work-records.mk b/.generated-work-records.mk new file mode 100644 index 0000000..751f25c --- /dev/null +++ b/.generated-work-records.mk @@ -0,0 +1,8 @@ +# Explicit opt-in recipe; no environment files or external make includes. +CUSTODIAN_SOURCE ?= /home/worsch/the-custodian +GENERATED_REPO_SLUG ?= railiance-platform +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" +generated-work-records-check: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check diff --git a/Makefile b/Makefile index ed420e5..cc7e265 100644 --- a/Makefile +++ b/Makefile @@ -647,3 +647,10 @@ keycape-factor-tests: ## Validate factor custody, scope, renewal and config pres .PHONY: keycape-factor-live-acceptance keycape-factor-live-acceptance: ## Verify native scope and rotation (creates bounded proof/renewal Jobs) PYTHONDONTWRITEBYTECODE=1 python3 scripts/keycape_factor_acceptance.py + +# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe. +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records +generated-work-records-check: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check diff --git a/SCOPE.md b/SCOPE.md index b693503..1771eb5 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -154,3 +154,20 @@ remain RPF-WP-0038-T04. The account cutover and archive-integrity fix do not establish that coverage. WP-0029 retains secondary credential invalidation/recovery; its completion must not be presented as full primary-backup assurance. + + +## Repository maintenance reuse + +The tracked `.generated-work-records.json` adopts the Custodian staged-source +adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing +State Hub renderer through `.generated-work-records.mk`; the shared pre-commit +hook runs this isolated recipe only for opted-in repositories. The corresponding +`make generated-work-records-check` is read-only. Canonical repository identity +is explicit and does not depend on the checkout directory. + +Unstaged source changes are preserved; conflicts and unstaged generated-file +changes stop the commit. For `git commit --only`, generate first and include +WORK-RECORDS.md with the selected source paths. Existing generated-only guards +and exact-scope secret scans remain in place. This is repository maintenance, +not a runtime service, authorization decision, deployment or publication. +Other index generators and hub-derived briefs retain their owner boundaries. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index dc7f3aa..dd329b6 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -34,12 +34,18 @@ | workplan | RPF-WP-0053 | proposed | — | workplans/RPF-WP-0053-coulomb-paired-backup-admission.md | | workplan | RPF-WP-0054 | finished | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md | | workplan | RPF-WP-0055 | backlog | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md | +| workplan | RPF-WP-0056 | blocked | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| workplan | RPF-WP-0057 | active | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| workplan | RPF-WP-0058 | active | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| workplan | RPF-WP-0059 | active | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | +| workplan | RPF-WP-0060 | active | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | +| workplan | RPF-WP-0061 | active | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | | task | RPF-WP-ADHOC-2026-10-10-T01 | done | — | workplans/ADHOC-2026-10-10.md | | task | RPF-WP-ADHOC-2026-10-11-T01 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-ADHOC-2026-10-11-T02 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-ADHOC-2026-10-11-T03 | done | — | workplans/ADHOC-2026-10-11.md | | task | RPF-WP-0015-T01 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | -| task | RPF-WP-0015-T02 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | +| task | RPF-WP-0015-T02 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T03 | wait | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0015-T04 | done | — | workplans/RPF-WP-0015-audit-core-custody-and-recovery-coordination.md | | task | RPF-WP-0025-T01 | done | — | workplans/RPF-WP-0025-openbao-operator-only-access.md | @@ -77,7 +83,7 @@ | task | RPF-WP-0038-T01 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md | | task | RPF-WP-0038-T02 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md | | task | RPF-WP-0038-T03 | done | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md | -| task | RPF-WP-0038-T04 | todo | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md | +| task | RPF-WP-0038-T04 | wait | — | workplans/RPF-WP-0038-forgejo-scaleway-primary-coverage.md | | task | RPF-WP-0039-T01 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md | | task | RPF-WP-0039-T02 | done | — | workplans/RPF-WP-0039-vergabe-demo-company-database.md | | task | RPF-WP-0040-T01 | done | — | workplans/RPF-WP-0040-keycape-factor-credential-custody.md | @@ -147,6 +153,34 @@ | task | RPF-WP-0054-T06 | done | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md | | task | RPF-WP-0054-T07 | cancel | — | workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md | | task | RPF-WP-0055-T01 | todo | — | workplans/RPF-WP-0055-keycape-client-secret-rotation-residual.md | +| task | RPF-WP-0056-T01 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0056-T02 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0056-T03 | wait | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0056-T04 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0056-T05 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0056-T06 | done | — | workplans/RPF-WP-0056-playwright-consumer-admission.md | +| task | RPF-WP-0057-T01 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0057-T02 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0057-T03 | done | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0057-T04 | progress | — | workplans/RPF-WP-0057-sign-in-diagnosis-caller-proof.md | +| task | RPF-WP-0058-T01 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0058-T02 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0058-T03 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0058-T04 | done | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0058-T05 | wait | — | workplans/RPF-WP-0058-reuse-private-source-reader.md | +| task | RPF-WP-0059-T01 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | +| task | RPF-WP-0059-T02 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | +| task | RPF-WP-0059-T03 | done | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | +| task | RPF-WP-0059-T04 | progress | — | workplans/RPF-WP-0059-hourly-cadence-receiver-custody.md | +| task | RPF-WP-0060-T01 | progress | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | +| task | RPF-WP-0060-T02 | done | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | +| task | RPF-WP-0060-T03 | todo | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | +| task | RPF-WP-0060-T04 | todo | — | workplans/RPF-WP-0060-browser-case-platform-bindings.md | +| task | RPF-WP-0061-T01 | done | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | +| task | RPF-WP-0061-T02 | done | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | +| task | RPF-WP-0061-T03 | done | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | +| task | RPF-WP-0061-T04 | done | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | +| task | RPF-WP-0061-T05 | wait | — | workplans/RPF-WP-0061-self-service-ccr-intake.md | | intake | RPF-IN-0001 | closed | — | intakes/intakes.md | | intake | RPF-IN-0002 | open | — | intakes/intakes.md | | intake | RPF-IN-0003 | open | — | intakes/intakes.md |