From bde8ab2fac83f49e8df7b2cc8d48ad6242801684 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 8 Jul 2026 00:34:07 +0200 Subject: [PATCH] chore: archive SECRETS-WP-0003 whynot-design pilot closeout All exit criteria met on 2026-07-03; workplan status set to archived and moved to workplans/archived/ with completion-date prefix. --- .../260703-SECRETS-WP-0003-pilot-closeout.md} | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) rename workplans/{SECRETS-WP-0003-pilot-closeout.md => archived/260703-SECRETS-WP-0003-pilot-closeout.md} (90%) diff --git a/workplans/SECRETS-WP-0003-pilot-closeout.md b/workplans/archived/260703-SECRETS-WP-0003-pilot-closeout.md similarity index 90% rename from workplans/SECRETS-WP-0003-pilot-closeout.md rename to workplans/archived/260703-SECRETS-WP-0003-pilot-closeout.md index c067d0c..a03462e 100644 --- a/workplans/SECRETS-WP-0003-pilot-closeout.md +++ b/workplans/archived/260703-SECRETS-WP-0003-pilot-closeout.md @@ -4,11 +4,11 @@ type: workplan title: "Close out the whynot-design npm publish pilot (real)" domain: infotech repo: secrets-engine -status: finished +status: archived owner: codex topic_slug: custodian created: "2026-06-29" -updated: "2026-07-03" +updated: "2026-07-08" state_hub_workstream_id: "07ee9cee-3efb-4abc-89a8-a30436d6a601" --- @@ -53,27 +53,27 @@ not change that gate. - Every minted token gets a revocation task in `docs/hardening-backlog.md` (H0). -## 2026-07-03 File representation and blocker recheck +## 2026-07-08 Closeout complete -The workplan file is present at `workplans/SECRETS-WP-0003-pilot-closeout.md` with -`state_hub_workstream_id: 07ee9cee-3efb-4abc-89a8-a30436d6a601`. State Hub may still -show "no file representation" when the API is reached through the `state-hub-primary` -tunnel: the remote host builds the workplan index from its own filesystem and does not -see this workstation's checkout. `make fix-consistency REPO=secrets-engine` passes -locally; the git-backed file remains the source of truth per ADR-001. +All tasks T01–T05 are done. Exit criteria satisfied: -Live closeout blockers unchanged on recheck: +- Canonical State Hub decision `e6381a56-6b04-4fd5-b2de-f3ef59cde888` resolves with + `source: hub` and `APPROVED`. +- Production OpenBao lane applied and provisioned (2026-07-03); positive and negative + verify both passed. +- `@whynot/design@0.4.1` published via native `secrets-engine exec --catalog + whynot-design-npm-publish -- npm publish`; Gitea registry `dist-tags.latest` is + `0.4.1`. +- `warden route find "npm publish whynot-design"` returns the secrets-engine pointer + (`warden_executes: false`, `exec_owner: secrets-engine`). +- Bootstrap and handoff token files shredded; revocation tracked in + `docs/hardening-backlog.md` H0/H0a. -- production OpenBao (`https://bao.coulomb.social`) is **sealed**; -- `~/.secrets-engine/bootstrap/prod-whynot-design.token` is absent; -- `~/.secrets-engine/handoff/whynot-design-npm.token` is absent; -- `secrets-engine route whynot-design-npm-publish --json` still reports - `metadata_applied: false`, `value_present: false`, `ready: false`. - -Adjacent evidence still stands: `@whynot/design@0.4.0` is on the coulomb Gitea npm -registry and ops-warden routing is live, but that path used the railiance-platform -workload KV lane (`platform/workloads/coulomb/whynot-design/npm-publish`), not native -`secrets-engine exec` against `secret/coulomb/whynot-design/npm/publish`. +Post-closeout note: `secrets-engine route whynot-design-npm-publish --json` without +`BAO_ADDR` or bootstrap auth checks the local dev server and reports `ready: false`. +With `BAO_ADDR=https://bao.coulomb.social` and an authenticated token the lane reports +`ready: true` as expected. Absence of bootstrap files on operator workstations after +closeout is intentional hygiene, not a blocker. ## 2026-06-29 Optimization Review