coulomb/reuse-surface
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

REUSE-WP-0023-T02: hosted hub registration reconciled; workplan finished
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
ci / validate-registry (push) Has been cancelled
Details

Browse source 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 264646@bnt-lap001
Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9
This commit is contained in:
tegwick 2026-09-30 20:31:46 +02:00
parent a07db530f5
commit 65a7e323ab
1 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

24
workplans/REUSE-WP-0023-access-engine-source-rename.md
View file

@ -4,13 +4,13 @@ type: workplan
title: "Follow the access-engine repository rename in federation sources"
domain: infotech
repo: reuse-surface
status: blocked
status: finished
flavor: residual
owner: claude
origin: residual
origin_ref: FLEX-WP-0020
created: "2026-09-20"
updated: "2026-09-28"
updated: "2026-09-30"
state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06"
---
@ -73,9 +73,7 @@ capability-semantic migration is authorized by this task.
```task
id: REUSE-WP-0023-T02
status: wait
needs_human: true
blocking_reason: "Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step."
status: done
flavor: residual
priority: medium
state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a"
@ -124,3 +122,19 @@ Changed `registry/federation/sources.yaml` (repo + URL) and
only `source_repo`/`source_url`/`source_index` of the one entry changed, capability
identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are
ignored cache and were left. T02 (hosted hub) handed to an operator.
## T02 evidence — 2026-09-30
Operator ran, with their own OpenBao login (`bao kv get -field=REUSE_SURFACE_TOKEN
platform/workloads/reuse/reuse-surface/runtime-secrets`): `hub register --repo
access-engine --domain helix_forge --url <access-engine raw index>` (ok) and
`hub update --repo flex-auth --no-enabled --description "Superseded by
access-engine ..."` (ok). The `warden access --exec` lane was refused by design
(WARDEN-WP-0039: resource.system=railiance-platform vs. ops-warden binding; no
delegated-read contract yet) — not rename breakage; the owner-native `bao` read
is the working route.
Verified read-only against `https://reuse.coulomb.social`: `/v1/repos` shows
access-engine enabled and flex-auth disabled with the replacement note;
`/v1/federated` serves `capability.authorization.policy-evaluate` from the
access-engine URL, 65 capabilities (unchanged), `stale: false`.