From 01b45ab8b3e9473db212b393c0432e26ad3e3e26 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 14:38:51 +0200 Subject: [PATCH] Record flex-auth digest contract fix Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a0217e-8c4c-7383-be6b-f50a6e485306 --- workplans/SECRETS-WP-0007-production-lifecycle-hardening.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md b/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md index 13bb815..8837662 100644 --- a/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md +++ b/workplans/SECRETS-WP-0007-production-lifecycle-hardening.md @@ -212,9 +212,8 @@ OpenBao while State Hub lacks the durable endpoint. Legacy local decisions are reachable for prod-labeled lanes only with an explicit unsafe-demo switch, disabled Hub URL, and loopback OpenBao. The throwaway scripts declare that exception. Live destroy remains disabled independently. State Hub endpoint and -authenticated approval storage are still outstanding; the flex-auth example's -committed digest was also found stale against its Go `CheckRequest` encoder and -must be corrected upstream. +authenticated approval storage are still outstanding. flex-auth corrected its +example digest and added a complete binding regression assertion in `d402408`. Define and enforce the decision contract needed by production commands. A resolved approval must bind at least: