61 commits

Author	SHA1	Message	Date
codex	251456acd2	Refresh the generated work record index ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB Assistant: claude-code Assistant-Model: opus Assistant-Process: 1275505@bnt-lap001 Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5	2026-09-09 14:42:10 +02:00
tegwick	a94d06dbcf	docs(custody): record attended KeyCape first-provision authority proof ... Assistant: codex Assistant-Model: gpt-5.6-luna Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc	2026-09-08 22:40:04 +02:00
codex	34e78e8937	Review blocked platform obligations and archive completed ESO recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 21:16:53 +02:00
codex	cb6396caab	Record verified Backup account activation and consumer refresh ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:50:26 +02:00
codex	08a406f2f8	Close three-lane ESO recovery with live verification and cleanup evidence ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 19:00:19 +02:00
codex	5d6d8724b4	Complete live State Hub signing activation and rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:12:37 +02:00
codex	a46a6d8213	Prepare bounded State Hub preflight signing lane ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:50:27 +02:00
codex	234b1b559f	Implement S3 service assurance and admission checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:43:55 +02:00
codex	9f83e426c7	Consolidate platform workplans and assess intent gaps ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:14:42 +02:00
codex	193b1276f3	Document credential lane designs and adopt fast projection sync ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:41:56 +02:00
codex	4c70fa83c5	Close identity repair after successful primary reconciliation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:24:35 +02:00
codex	0349a08e1b	Harden backup credentials and add durable image inventory publication ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 01:53:24 +02:00
codex	a51b8eb418	chore(consistency): refresh work-record index ... Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 23:00:07 +02:00
repo-manager	221668a487	chore(registrar): assign State Hub identifiers ... Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 17:47:00 +02:00
codex	453fed3b2d	Plan KeyCape exposure recovery ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:10:06 +02:00
codex	c9d02147d3	Adopt canonical flex-auth credential checks ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:03:40 +02:00
codex	913c03d6ec	Fix apps-pg tenancy evidence declaration ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 13:21:42 +02:00
repo-manager	e8e71191d8	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:51:40 +02:00
codex	517f68593d	feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:50:23 +02:00
codex	082c76979e	Add attended login containment workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 01:13:52 +02:00
codex	2a5c002aa5	Prepare canonical custody for audit E2 third attempt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de	2026-08-22 23:23:41 +02:00
codex	30e6edc236	Add versioned ephemeral custody lifecycle ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:56:42 +02:00
codex	08a3dd7660	Record WP-0024 recovery owner routing ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 13:18:50 +02:00
codex	bd25f7fa40	Add audit recovery exercise preflights ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 13:16:13 +02:00
codex	f04c8016d9	Refresh credential procedure work records ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 13:01:16 +02:00
codex	ab7dee5382	Refresh platform work record index ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:43:46 +02:00
codex	8e26afc6a6	Add audit custody and recovery coordination workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 12:34:25 +02:00
codex	429cc912ed	Finish coding-agent high-risk boundary coverage ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 10:03:54 +02:00
codex	d40eb3c2a9	Finish hub-core credential lane workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 00:28:18 +02:00
codex	456a80c2f6	Finish OpenRouter provider lane workplan	2026-08-21 21:22:52 +02:00
codex	4689645621	docs: record hub-core credential handoff	2026-08-21 21:07:10 +02:00
codex	bb7cfcb184	feat: add hub-core database lease projections	2026-08-21 17:30:44 +02:00
codex	382f04412a	Close CCR drift and high-risk policy gaps	2026-08-21 01:29:28 +02:00
codex	1206ed55da	Finish Core Hub private shadow onboarding	2026-08-21 00:51:06 +02:00
codex	07ed6217b7	Advance RPF-WP-0021 platform onboarding	2026-08-20 23:31:47 +02:00
codex	cb321deeab	Finish RPF-WP-0019 apps-pg controls and recovery	2026-08-20 22:58:45 +02:00
codex	402731fc53	docs: index attended OpenRouter rotation	2026-08-20 22:52:17 +02:00
codex	ac69f90300	feat: prepare core hub platform onboarding	2026-08-20 11:18:30 +02:00
codex	7fb7c503df	chore(consistency): sync RPF-WP-0020 registration	2026-08-18 15:19:19 +02:00
codex	1cbde550b5	chore(consistency): regenerate WORK-RECORDS.md after RPF-WP-0018 close	2026-08-18 13:36:31 +02:00
codex	dc4245361d	Finish RPF-WP-0018; RPF-WP-0019 repository-complete ... RPF-WP-0018 closed: all seven tasks done. The provider-declaration finding was adopted upstream and its canonical form is the provider: block in tenancy.yaml; adaptive-pricing declined the standing co-signature and supplied typed tier minima instead, recorded in ADR-0002. Three corrections against our own output are recorded in the documents rather than edited away. RPF-WP-0019 T03 done (ceiling of three, memory binding, apps-pg-2 named as overflow, enforced by make apps-pg-verify-capacity). T01/T02 are repository-complete: backup target, retention, per-consumer connection limits, role timeouts and Burstable resources are declared in source and published in s3-consumer-interfaces 1.1.0 before rollout. They stay in progress because no live application, backup success or restore proof exists, and declared configuration is not a section 13 artifact. T04 waits on that window. apps-pg R reason corrected to say the target is declared-not-applied rather than absent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 13:35:04 +02:00
codex	cc4e659a9e	Correct the S3 posture declaration against Tenancy Posture SS13 ... Self-audit after reading SS6, SS11, SS12 and SS13 in full rather than the sections cited in review. openbao A:2 -> A:0. The claim was incoherent (it invoked the absence of tenant context to justify E:0 and ignored it to claim A2, which SS4.2 defines in terms of tenant context) and unevidenced at the moment of claiming, which SS13.1 forbids and SS13.1a does not excuse above the floor. The real authorization evidence, openbao-verify-token-grants.py, is consumer-boundary and is now cited under the provider statement. Floor claims carry reason: per SS13.1a; permanent-by-design lines are marked so SS12 guard does not read them as stalled. The provider-versus-consumer finding is narrowed: SS6 plus the flex-auth I1-forever precedent already express a structurally permanent low level, so that half is withdrawn. What survives is that a provider cannot state the level it makes reachable for its consumers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 22:56:03 +02:00
codex	e7e4e33bb8	RPF-WP-0018 T01-T06: publish S3 posture, placement policy, quotas, ADR surface ... T01 docs/tenancy-posture.md - vector set per service rather than one repo vector, with the provider-versus-consumer finding routed to net-kingdom. T02/T03/T06 docs/placement-policy.md - accepts placement ownership scoped to rule-here/number-there, records a placement owner per workload, reports the latency-critical + batch co-residency on platform-pg, marks the connection-ceiling trigger unmonitored pending railiance-telemetry, and answers the retention floor/ceiling question. T04 s3-consumer-interfaces 1.1.0 - quota disclosure per SS10.2. Surfaces that apps-pg has no backup, no resource limits and no tuned parameters. T05 docs/adr/ created with a mandatory-frontmatter convention and the first three ADRs. This repo previously held none. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-17 21:55:11 +02:00
codex	3b5d722bb1	chore(consistency): mark RAILIANCE-WP-0017 finished in work-record index	2026-08-15 14:57:06 +02:00
codex	bf8c26cd61	chore(consistency): mark architecture RAILIANCE-WP-0016 finished	2026-08-15 14:44:21 +02:00
codex	917d3a1687	workplan: RAILIANCE-WP-0017 enforce consumption mode ... Residual of resource-control RESOURCE-WP-0005: refuse new orders that would exceed a restricted entity's published allowance.	2026-08-14 13:15:30 +02:00
codex	beed7941af	chore(consistency): mark RAILIANCE-WP-0016 apps-pg evidence finished	2026-08-14 02:06:01 +02:00
codex	b5fb44b53e	chore(consistency): mark RAILIANCE-WP-0015 finished in work-record index	2026-08-14 00:48:13 +02:00
codex	6ab882cc44	chore(consistency): mark RAILIANCE-WP-0015-T02 done in work-record index	2026-08-14 00:40:01 +02:00
codex	b6ad81fe6b	Record the 10a outcome: estimate held, check paid for itself on first run ... 32 assertions, 31 pass on Railiance01. The one failure is a real defect the old loose assertion could never have seen: Flannel VXLAN declared open to Anywhere with no source restriction, currently absent from the host, so converging would introduce the exposure rather than correct drift. Also records the sharper finding from wiring it up: verify.yaml was missing the vars_files the bootstrap play had, so the firewall assertions rendered empty and silently asserted nothing - worse than having no check at all. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-12 03:30:34 +02:00