coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Prepare WP-0006 first-lane native cutover packet
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Re-render admitted-lane plans as kv-mount-check plus exact-path AppRole.
Name openrouter-llm-connect as the first candidate. Document apply,
verify, and rollback without authorizing live mutation. T05 stays wait
on T04 serving and attended authority.

Assistant: grok
Assistant-Session: 01a05f07-ae72-7781-9fcb-19efd61add00
This commit is contained in:
tegwick 2026-09-03 23:36:42 +02:00
parent 72d3327c28
commit 3b355de300
5 changed files with 113 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/SECRETS-WP-0006-catalog-lane-adoption.md
View file

@ -8,7 +8,7 @@ status: active
owner: codex
topic_slug: custodian
created: "2026-08-21"
updated: "2026-09-02"
updated: "2026-09-03"
state_hub_workstream_id: "31f7f8ea-7f73-516c-8877-f03a13f1db82"
---
@ -198,6 +198,16 @@ priority: high
state_hub_task_id: "fb103f1e-2ff7-5de5-9a2c-191a19c43542"
```
Progress 2026-09-03. Re-rendered guarded plans on the post-hardening engine.
Every admitted lane is still `kv-mount-check` + exact-path read policy +
bounded AppRole. First live candidate is `openrouter-llm-connect` (narrowest
consumer/field set). Procedure: `docs/native-lane-cutover.md`. Coordinated:
railiance-platform `0190c9b3` (AppRole-only apply, no KV/ESO mutation),
ops-warden `c2c01262` (keep all five proxies), llm-connect `6f9b460a` (ESO
stays theirs). Live apply still wait on T04 serving plus a canonical
`action=apply` approval and scoped attended authority. CCR-2026-0003 remains
provenance, not that approval. Proxies stay until T06 per lane.
Readiness update 2026-08-21: rendered non-mutating production dry-runs for all
five lanes. Every plan checks the externally managed `platform` mount without
mutation, writes one exact-path read policy, and proposes the reviewed bounded