173 commits

Author	SHA1	Message	Date
repo-manager	708ba5d174	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:35:14 +02:00
codex	8fb4407832	Prepare dedicated Backup account cutover with quota and recovery verification ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 20:35:13 +02:00
codex	5ef016be01	Contain backup upload credentials and prepare provider recovery gates ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 19:21:06 +02:00
codex	08a406f2f8	Close three-lane ESO recovery with live verification and cleanup evidence ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 19:00:19 +02:00
repo-manager	dfc1641c49	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:38:20 +02:00
codex	bd2e6e86b8	Prepare bounded Kubernetes authentication recovery for three ESO lanes ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:38:19 +02:00
codex	5d6d8724b4	Complete live State Hub signing activation and rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:12:37 +02:00
codex	80793afe4f	Pin signing-lane writes to the verified primary cluster ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 16:41:46 +02:00
codex	a46a6d8213	Prepare bounded State Hub preflight signing lane ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:50:27 +02:00
codex	234b1b559f	Implement S3 service assurance and admission checks ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:43:55 +02:00
repo-manager	8f828c7609	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:14:44 +02:00
codex	9f83e426c7	Consolidate platform workplans and assess intent gaps ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 11:14:42 +02:00
repo-manager	9d958f8e09	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:42:02 +02:00
codex	193b1276f3	Document credential lane designs and adopt fast projection sync ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:41:56 +02:00
codex	4c70fa83c5	Close identity repair after successful primary reconciliation ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:24:35 +02:00
codex	6b41a43fa3	Separate Core Hub onboarding from archived apps-pg identities ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:22:29 +02:00
repo-manager	07a959bac2	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:18:42 +02:00
codex	3dc005df1c	Close live inventory migration and prepare workplan identity repair ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 10:17:42 +02:00
repo-manager	05f315be84	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 09:41:10 +02:00
codex	f637989a69	Refuse prune apply when requested image inventories are unavailable ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 02:00:50 +02:00
codex	0349a08e1b	Harden backup credentials and add durable image inventory publication ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 01:53:24 +02:00
codex	e5f3497337	fix(workplans): qualify ad-hoc identifiers with the repository prefix ... `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-28 00:28:23 +02:00
codex	86209c756c	fix(workplans): resolve RPF-WP collisions created by the prefix migration ... The RAILIANCE-WP migration numbered from RPF-WP-0001 without checking whether the target prefix was already in use. It was: this repository already had RPF-WP records, and the migration collided at 0018, 0019 and 0020, putting two unrelated workplans on each identifier. Central was left holding mixed records — rpf-wp-0018 carried the status of one file and the backing path of the other, because the reset processed two files claiming one identifier. The three files the migration displaced move to 0025-0027; the pre-existing records keep their numbers. Projection UUIDs are re-derived. Refs STATE-WP-0083-T05 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-26 19:44:46 +02:00
codex	47d8ec8806	fix(workplans): migrate archived workplans off the retired RAILIANCE-WP prefix ... Completes the migration begun on 2026-08-25, which covered active workplans only. The archived copies kept their historical identifiers, and three repositories shared one number space — so their task identifiers collided, blocking task-level projection reset for those workplans. Numbering continues each repository's active sequence rather than restarting, so no identifier is reused. Projection UUIDs are re-derived from the new canonical ids. Refs CUST-WP-0068, STATE-WP-0083-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-26 08:05:38 +02:00
codex	a51b8eb418	chore(consistency): refresh work-record index ... Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 23:00:07 +02:00
codex	e4af2a1d10	fix(workplans): migrate active workplans off the retired RAILIANCE-WP prefix ... RAILIANCE-WP is a family name, not a repository (ADR-007, and the prefix registry already lists it retired). Three repositories independently used one number space for unrelated work — RAILIANCE-WP-0012 was openbao extraction here, a cnpg backup in railiance-apps and a deploy-verify in railiance-cluster. This repository also carried two files both numbered 0016. Active workplans move to the successor prefix and are renumbered from 0001 in historical order. Archived workplans keep their historical identifiers. Projection UUIDs are re-derived from the new canonical ids. Records already registered under the old identifiers leave orphaned hub rows behind; that debt is recorded in CUST-WP-0068 and clears when ADR-012's reset-from-forge lands. Refs CUST-WP-0068-T03 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 22:58:35 +02:00
codex	ea2e9ec97d	fix(workplans): adopt ADR-007 derived identifiers for unregistered records ... These workplans exist only in the retired local hub. Their random pre-ADR-007 identifiers are refused by C-06 as stale references, so they cannot be registered. Deriving from the canonical record id takes no identity from anything: central does not hold them and the old ids die with the cache. Records central already holds were deliberately left untouched. Refs CUST-WP-0068-T06 Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 20:20:45 +02:00
repo-manager	221668a487	chore(registrar): assign State Hub identifiers ... Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-25 17:47:00 +02:00
codex	51361fbf8e	Track OpenBao custody handoff gate ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 22:01:21 +02:00
codex	f607d747da	Draft NetKingdom credential custody contract ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 21:48:29 +02:00
codex	60fcd0cdce	Record partial resolver update and operator stop ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 15:13:35 +02:00
codex	b879e85d6d	Pin privacyIDEA resolver reconciliation gate ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 15:06:50 +02:00
codex	18d61cd6a0	Record final KeyCape recovery receipt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:51:50 +02:00
codex	7f71dff945	docs(RAILIANCE-WP-0027): record attended callback NO-GO ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:41:10 +02:00
codex	7ce3bc8380	Record KeyCape exposure owner receipts ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:37:36 +02:00
codex	d18649fc6e	feat(RAILIANCE-WP-0027): add contained callback role update ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 14:37:01 +02:00
codex	453fed3b2d	Plan KeyCape exposure recovery ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:10:06 +02:00
codex	c9d02147d3	Adopt canonical flex-auth credential checks ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 14:03:40 +02:00
codex	8ae77ca006	Record KeyCape loopback callback evidence ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 13:23:35 +02:00
codex	913c03d6ec	Fix apps-pg tenancy evidence declaration ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093	2026-08-23 13:21:42 +02:00
repo-manager	e8e71191d8	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:51:40 +02:00
codex	517f68593d	feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4	2026-08-23 12:50:23 +02:00
codex	082c76979e	Add attended login containment workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 01:13:52 +02:00
codex	077c4f8699	Record WP0027 terminal no-go ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 01:08:30 +02:00
codex	f87a4aa1f4	Record WP0027 platform snapshot receipt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-23 00:32:20 +02:00
codex	2a5c002aa5	Prepare canonical custody for audit E2 third attempt ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02991-be07-7bb3-8b6d-e9701b5621de	2026-08-22 23:23:41 +02:00
repo-manager	fc198b896f	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:57:18 +02:00
codex	30e6edc236	Add versioned ephemeral custody lifecycle ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:56:42 +02:00
codex	04c858eff6	Record audit E2 retry readiness ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 21:00:29 +02:00
codex	a557208a4a	Add direct WP-0024 load driver handoff ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa	2026-08-22 16:17:03 +02:00