tegwick
65a7e323ab
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9
140 lines
6.1 KiB
Markdown
140 lines
6.1 KiB
Markdown
---
|
|
id: REUSE-WP-0023
|
|
type: workplan
|
|
title: "Follow the access-engine repository rename in federation sources"
|
|
domain: infotech
|
|
repo: reuse-surface
|
|
status: finished
|
|
flavor: residual
|
|
owner: claude
|
|
origin: residual
|
|
origin_ref: FLEX-WP-0020
|
|
created: "2026-09-20"
|
|
updated: "2026-09-30"
|
|
state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06"
|
|
---
|
|
|
|
# access-engine source-coordinate handoff
|
|
|
|
flex-auth is being renamed to access-engine under FLEX-WP-0020. Forge
|
|
repository ID 42 is unchanged and the State Hub repo UUID
|
|
`fda8ad85-a7d7-4055-8f21-902a533e59df` stays. **Runtime names stay
|
|
`flex-auth`** per FLEX-DEC-2026-013 — this is a repository-coordinate rename
|
|
only, not a service or capability rename.
|
|
|
|
This repository owns the federation-source side: the URL, cache path, and
|
|
roster entry that point at the renamed repository, plus evidence that the
|
|
published capability survives the move unchanged.
|
|
|
|
This is the same shape as **REUSE-WP-0021** (identity-canon → commerce-canon,
|
|
finished 2026-09-20); reuse that workplan's approach and evidence format.
|
|
|
|
## Status at registration — 2026-09-20
|
|
|
|
**The rename has not landed yet.** Probed on 2026-09-20:
|
|
|
|
- `https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` → **404**
|
|
- `https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml` → **303** (still resolves)
|
|
|
|
T01 therefore starts in `wait`. Do not pre-emptively rewrite the source
|
|
coordinates: flipping the URL before the forge rename lands would break an
|
|
enabled, publish-passing source and drop its capability from the composed
|
|
index. Start T01 when `access-engine` serves the raw index.
|
|
|
|
## Update source coordinates and verify federation
|
|
|
|
```task
|
|
id: REUSE-WP-0023-T01
|
|
status: done
|
|
flavor: residual
|
|
priority: medium
|
|
state_hub_task_id: "d97094d4-4cad-5b35-aa88-eb952215937a"
|
|
```
|
|
|
|
Blocked until the forge rename lands (see above).
|
|
|
|
Update `registry/federation/sources.yaml` and
|
|
`registry/federation/local-repo-roster.yaml` to the canonical access-engine
|
|
URL and path. Refresh that source's cache and recompose
|
|
`registry/indexes/federated.yaml` through the repository's federation tooling.
|
|
|
|
Preserve the capability identifier published by flex-auth — a repository
|
|
rename alone does not redefine a capability, and runtime names are explicitly
|
|
unchanged by FLEX-DEC-2026-013. Source owner/URL/cache metadata should match
|
|
the newly published access-engine registry.
|
|
|
|
Verify the capability entry remains discoverable with canonical source links,
|
|
confirm the composed row count does not drop, record commands and results,
|
|
commit, and hand evidence back to FLEX-WP-0020. Leave historical
|
|
workplan/completion provenance intact. No credential, runtime service, or
|
|
capability-semantic migration is authorized by this task.
|
|
|
|
## Reconcile the hosted hub registration
|
|
|
|
```task
|
|
id: REUSE-WP-0023-T02
|
|
status: done
|
|
flavor: residual
|
|
priority: medium
|
|
state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a"
|
|
```
|
|
|
|
Blocked on T01.
|
|
|
|
The production hub at `https://reuse.coulomb.social` carries its own repo
|
|
registrations independent of the checked-in manifest. Register the
|
|
access-engine coordinates there and retire the flex-auth registration the same
|
|
way commerce-canon was handled under REUSE-WP-0021: keep the superseded
|
|
registration disabled with a replacement note rather than deleting it, so the
|
|
rename stays auditable. Confirm the hub's composed index serves the capability
|
|
from the canonical URL with no target warnings.
|
|
|
|
## Loose-end review — 2026-09-28
|
|
|
|
Reviewed all 23 repository workplans, including archived files. The 22 closed
|
|
workplans have no unfinished task blocks; T01 and T02 here are the only open
|
|
tasks. Neither can complete before the upstream FLEX-WP-0020 rename lands.
|
|
This workplan is now `blocked`, with both tasks remaining `wait`; no new tasks
|
|
or workplans were opened.
|
|
|
|
Fresh read-only probes used `curl -sS -L -o <temporary-file> -w '%{http_code}'`
|
|
against the raw capability-index URLs listed above:
|
|
|
|
- `access-engine/raw/main/registry/indexes/capabilities.yaml`: HTTP **404**.
|
|
- `flex-auth/raw/main/registry/indexes/capabilities.yaml`: HTTP **200** after
|
|
following redirects.
|
|
|
|
The 2026-09-20 flex-auth inbox handoff also confirms T01 must follow
|
|
FLEX-WP-0020-T06, with the upstream owner responsible for announcing that the
|
|
new raw index is available. The checked-in source and local roster still use
|
|
`flex-auth`, correctly preserving the working source until that prerequisite
|
|
is met. T02 remains blocked on T01; the hosted registration must follow the
|
|
verified source migration. Resume these existing tasks when the canonical
|
|
access-engine raw index is available and validates successfully.
|
|
|
|
## T01 evidence — 2026-09-30
|
|
|
|
FLEX-WP-0020 rename landed (access-engine, head b943d9a). Probe:
|
|
`/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` returns 303 then 200.
|
|
Changed `registry/federation/sources.yaml` (repo + URL) and
|
|
`local-repo-roster.yaml` (slug + path ~/access-engine). Ran
|
|
`reuse-surface federation compose --refresh`: 65 capabilities before and after;
|
|
only `source_repo`/`source_url`/`source_index` of the one entry changed, capability
|
|
identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are
|
|
ignored cache and were left. T02 (hosted hub) handed to an operator.
|
|
|
|
## T02 evidence — 2026-09-30
|
|
|
|
Operator ran, with their own OpenBao login (`bao kv get -field=REUSE_SURFACE_TOKEN
|
|
platform/workloads/reuse/reuse-surface/runtime-secrets`): `hub register --repo
|
|
access-engine --domain helix_forge --url <access-engine raw index>` (ok) and
|
|
`hub update --repo flex-auth --no-enabled --description "Superseded by
|
|
access-engine ..."` (ok). The `warden access --exec` lane was refused by design
|
|
(WARDEN-WP-0039: resource.system=railiance-platform vs. ops-warden binding; no
|
|
delegated-read contract yet) — not rename breakage; the owner-native `bao` read
|
|
is the working route.
|
|
|
|
Verified read-only against `https://reuse.coulomb.social`: `/v1/repos` shows
|
|
access-engine enabled and flex-auth disabled with the replacement note;
|
|
`/v1/federated` serves `capability.authorization.policy-evaluate` from the
|
|
access-engine URL, 65 capabilities (unchanged), `stale: false`.
|