coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: archive SECRETS-WP-0003 whynot-design pilot closeout

Browse source 
All exit criteria met on 2026-07-03; workplan status set to archived and
moved to workplans/archived/ with completion-date prefix.
This commit is contained in:
tegwick 2026-07-08 00:34:07 +02:00
parent f374287a99
commit bde8ab2fac
1 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

40
workplans/SECRETS-WP-0003-pilot-closeout.md → workplans/archived/260703-SECRETS-WP-0003-pilot-closeout.md
View file

@ -4,11 +4,11 @@ type: workplan
title: "Close out the whynot-design npm publish pilot (real)"
domain: infotech
repo: secrets-engine
status: finished
status: archived
owner: codex
topic_slug: custodian
created: "2026-06-29"
updated: "2026-07-03"
updated: "2026-07-08"
state_hub_workstream_id: "07ee9cee-3efb-4abc-89a8-a30436d6a601"
---
@ -53,27 +53,27 @@ not change that gate.
- Every minted token gets a revocation task in `docs/hardening-backlog.md` (H0).
## 2026-07-03 File representation and blocker recheck
## 2026-07-08 Closeout complete
The workplan file is present at `workplans/SECRETS-WP-0003-pilot-closeout.md` with
`state_hub_workstream_id: 07ee9cee-3efb-4abc-89a8-a30436d6a601`. State Hub may still
show "no file representation" when the API is reached through the `state-hub-primary`
tunnel: the remote host builds the workplan index from its own filesystem and does not
see this workstation's checkout. `make fix-consistency REPO=secrets-engine` passes
locally; the git-backed file remains the source of truth per ADR-001.
All tasks T01–T05 are done. Exit criteria satisfied:
Live closeout blockers unchanged on recheck:
- Canonical State Hub decision `e6381a56-6b04-4fd5-b2de-f3ef59cde888` resolves with
`source: hub` and `APPROVED`.
- Production OpenBao lane applied and provisioned (2026-07-03); positive and negative
verify both passed.
- `@whynot/design@0.4.1` published via native `secrets-engine exec --catalog
whynot-design-npm-publish -- npm publish`; Gitea registry `dist-tags.latest` is
`0.4.1`.
- `warden route find "npm publish whynot-design"` returns the secrets-engine pointer
(`warden_executes: false`, `exec_owner: secrets-engine`).
- Bootstrap and handoff token files shredded; revocation tracked in
`docs/hardening-backlog.md` H0/H0a.
- production OpenBao (`https://bao.coulomb.social`) is **sealed**;
- `~/.secrets-engine/bootstrap/prod-whynot-design.token` is absent;
- `~/.secrets-engine/handoff/whynot-design-npm.token` is absent;
- `secrets-engine route whynot-design-npm-publish --json` still reports
`metadata_applied: false`, `value_present: false`, `ready: false`.
Adjacent evidence still stands: `@whynot/design@0.4.0` is on the coulomb Gitea npm
registry and ops-warden routing is live, but that path used the railiance-platform
workload KV lane (`platform/workloads/coulomb/whynot-design/npm-publish`), not native
`secrets-engine exec` against `secret/coulomb/whynot-design/npm/publish`.
Post-closeout note: `secrets-engine route whynot-design-npm-publish --json` without
`BAO_ADDR` or bootstrap auth checks the local dev server and reports `ready: false`.
With `BAO_ADDR=https://bao.coulomb.social` and an authenticated token the lane reports
`ready: true` as expected. Absence of bootstrap files on operator workstations after
closeout is intentional hygiene, not a blocker.
## 2026-06-29 Optimization Review