199 commits

Author	SHA1	Message	Date
codex	32d5cf0211	Prepare the two approval client-side reader admissions ... RPF-WP-0035-T06. Adds CCR-2026-0019 (secrets-engine) and CCR-2026-0020 (approval-engine-operator) with their exact-path read policies, reusing the existing version-1 custody from the verifier activation. No reseed, rotation, shared reader or verifier Secret reuse; both requests are in_flight and nothing is applied. The two shapes were decided by read-only survey rather than assumed. secrets-engine consumes its client secret through an operator-run CLI reading a protected file, and its namespace holds no workload, so reader 1 is an attended operator-workstation OIDC lane rather than an ESO lane; its one missing input is the operator group claim, which NetKingdom and KeyCape own. approval-engine is not deployed and no owner source names who presents the operator client, so reader 2 records the undetermined actor instead of guessing one for the widest approval scope in the pair. Both declare openbao.auth missing rather than carrying a placeholder binding. T06 moves to wait on those two owner inputs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5	2026-09-09 14:41:01 +02:00
repo-manager	5507fac156	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 07:06:18 +02:00
codex	5679b86281	docs: close verifier custody and track client admission residual ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 07:06:05 +02:00
codex	c6dc4286e2	feat: verify live KeyCape custody and preserve versions on resume ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 02:18:12 +02:00
codex	b7861de20e	feat: admit and exercise KeyCape verifier custody activation ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 01:32:45 +02:00
codex	52b24eab9a	Close issuer pin prerequisite and prepare named custody review decisions ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 00:40:23 +02:00
tegwick	e06d7fc390	docs(records): attach issuer proof to the receiving admission task ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-09 00:07:02 +02:00
tegwick	8f40d73d0f	docs(identity): record verified live upstream issuer and completed cleanup ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-08 23:50:55 +02:00
tegwick	a94d06dbcf	docs(custody): record attended KeyCape first-provision authority proof ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-08 22:40:04 +02:00
codex	f3ba7ca882	Admit KeyCape approval-engine client custody paths and delivery ... Answers KEY-WP-0013-T02. Both proposed KV paths are confirmed unchanged; the field name is corrected to CLIENT_SECRET for the platform uppercase convention and the CCR validator. Kubernetes delivery references are confirmed against the live sso namespace. Attended authority is the governed openbao-platform-admin-login lane, and the rollout is one attended window ordered after the Authelia issuer precondition. Adds CCR-2026-0017/0018, two exact-path read policies, two namespace-limited ClusterSecretStores with Kubernetes auth, two ExternalSecrets, and RPF-WP-0035-T05. Nothing is applied and no value exists: both CCRs remain proposed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5	2026-09-08 14:53:32 +02:00
codex	4c320cf053	Track Q2 receiver implementation and live acceptance dependency ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 19:18:14 +02:00
codex	31386c8e63	Validate OpenBao snapshot evidence and record assurance closure gates ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 15:24:58 +02:00
codex	a867ec269a	Record archive recovery lifecycle and validate receipt provenance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 14:53:15 +02:00
codex	445f1361dc	Advance blocked assurance and operator callback work ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 14:16:49 +02:00
codex	a3ca4b708f	Verify full and essentials recovery and implement bounded retention tooling ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 11:10:50 +02:00
codex	4707bf08d7	Implement bounded primary archive transfer and explicit essentials capture ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 08:00:59 +02:00
codex	69187c2f45	Size backup retention and design Nextcloud essentials tier ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 01:41:43 +02:00
codex	5567fa979e	Record successful full offsite Forgejo recovery and remaining custody gate ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 01:36:39 +02:00
codex	4a9d6e6c7f	Record verified Forgejo Scaleway backup and recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 01:03:02 +02:00
repo-manager	54819fb3f4	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 00:48:27 +02:00
codex	978383fadb	Define scoped Forgejo native backup on the Scaleway primary ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 00:48:25 +02:00
codex	d05c3000c5	Verify Scaleway primary recovery and distinguish secondary backup coverage ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-06 00:34:43 +02:00
codex	195a51a62c	Record rejected historical backup, verified fresh capture and worker activation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 22:35:20 +02:00
codex	0cca68da96	Prepare isolated offsite restore and stream large backup transfers ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 22:18:05 +02:00
codex	34e78e8937	Review blocked platform obligations and archive completed ESO recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 21:16:53 +02:00
codex	cb6396caab	Record verified Backup account activation and consumer refresh ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:50:26 +02:00
repo-manager	708ba5d174	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:35:14 +02:00
codex	8fb4407832	Prepare dedicated Backup account cutover with quota and recovery verification ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:35:13 +02:00
codex	5ef016be01	Contain backup upload credentials and prepare provider recovery gates ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 19:21:06 +02:00
codex	08a406f2f8	Close three-lane ESO recovery with live verification and cleanup evidence ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 19:00:19 +02:00
repo-manager	dfc1641c49	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:38:20 +02:00
codex	bd2e6e86b8	Prepare bounded Kubernetes authentication recovery for three ESO lanes ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:38:19 +02:00
codex	5d6d8724b4	Complete live State Hub signing activation and rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:12:37 +02:00
codex	80793afe4f	Pin signing-lane writes to the verified primary cluster ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 16:41:46 +02:00
codex	a46a6d8213	Prepare bounded State Hub preflight signing lane ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:50:27 +02:00
codex	234b1b559f	Implement S3 service assurance and admission checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:43:55 +02:00
repo-manager	8f828c7609	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:14:44 +02:00
codex	9f83e426c7	Consolidate platform workplans and assess intent gaps ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:14:42 +02:00
repo-manager	9d958f8e09	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:42:02 +02:00
codex	193b1276f3	Document credential lane designs and adopt fast projection sync ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:41:56 +02:00
codex	4c70fa83c5	Close identity repair after successful primary reconciliation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:24:35 +02:00
codex	6b41a43fa3	Separate Core Hub onboarding from archived apps-pg identities ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:22:29 +02:00
repo-manager	07a959bac2	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:18:42 +02:00
codex	3dc005df1c	Close live inventory migration and prepare workplan identity repair ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:17:42 +02:00
repo-manager	05f315be84	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 09:41:10 +02:00
codex	f637989a69	Refuse prune apply when requested image inventories are unavailable ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 02:00:50 +02:00
codex	0349a08e1b	Harden backup credentials and add durable image inventory publication ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 01:53:24 +02:00
codex	e5f3497337	fix(workplans): qualify ad-hoc identifiers with the repository prefix ... `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-28 00:28:23 +02:00
codex	86209c756c	fix(workplans): resolve RPF-WP collisions created by the prefix migration ... The RAILIANCE-WP migration numbered from RPF-WP-0001 without checking whether the target prefix was already in use. It was: this repository already had RPF-WP records, and the migration collided at 0018, 0019 and 0020, putting two unrelated workplans on each identifier. Central was left holding mixed records — rpf-wp-0018 carried the status of one file and the backing path of the other, because the reset processed two files claiming one identifier. The three files the migration displaced move to 0025-0027; the pre-existing records keep their numbers. Projection UUIDs are re-derived. Refs STATE-WP-0083-T05 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-26 19:44:46 +02:00
codex	47d8ec8806	fix(workplans): migrate archived workplans off the retired RAILIANCE-WP prefix ... Completes the migration begun on 2026-08-25, which covered active workplans only. The archived copies kept their historical identifiers, and three repositories shared one number space — so their task identifiers collided, blocking task-level projection reset for those workplans. Numbering continues each repository's active sequence rather than restarting, so no identifier is reused. Projection UUIDs are re-derived from the new canonical ids. Refs CUST-WP-0068, STATE-WP-0083-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-26 08:05:38 +02:00