From 65a7e323ab8056ff8f6e89bed65ac83883a44340 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 30 Sep 2026 20:31:46 +0200 Subject: [PATCH] REUSE-WP-0023-T02: hosted hub registration reconciled; workplan finished Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9 --- ...USE-WP-0023-access-engine-source-rename.md | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md index 5000365..4351dbd 100644 --- a/workplans/REUSE-WP-0023-access-engine-source-rename.md +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -4,13 +4,13 @@ type: workplan title: "Follow the access-engine repository rename in federation sources" domain: infotech repo: reuse-surface -status: blocked +status: finished flavor: residual owner: claude origin: residual origin_ref: FLEX-WP-0020 created: "2026-09-20" -updated: "2026-09-28" +updated: "2026-09-30" state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06" --- @@ -73,9 +73,7 @@ capability-semantic migration is authorized by this task. ```task id: REUSE-WP-0023-T02 -status: wait -needs_human: true -blocking_reason: "Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step." +status: done flavor: residual priority: medium state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a" @@ -124,3 +122,19 @@ Changed `registry/federation/sources.yaml` (repo + URL) and only `source_repo`/`source_url`/`source_index` of the one entry changed, capability identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are ignored cache and were left. T02 (hosted hub) handed to an operator. + +## T02 evidence — 2026-09-30 + +Operator ran, with their own OpenBao login (`bao kv get -field=REUSE_SURFACE_TOKEN +platform/workloads/reuse/reuse-surface/runtime-secrets`): `hub register --repo +access-engine --domain helix_forge --url ` (ok) and +`hub update --repo flex-auth --no-enabled --description "Superseded by +access-engine ..."` (ok). The `warden access --exec` lane was refused by design +(WARDEN-WP-0039: resource.system=railiance-platform vs. ops-warden binding; no +delegated-read contract yet) — not rename breakage; the owner-native `bao` read +is the working route. + +Verified read-only against `https://reuse.coulomb.social`: `/v1/repos` shows +access-engine enabled and flex-auth disabled with the replacement note; +`/v1/federated` serves `capability.authorization.policy-evaluate` from the +access-engine URL, 65 capabilities (unchanged), `stale: false`.