diff --git a/.custodian-brief.md b/.custodian-brief.md deleted file mode 100644 index 0cb912a..0000000 --- a/.custodian-brief.md +++ /dev/null @@ -1,58 +0,0 @@ - -# Custodian Brief — secrets-engine - -**Domain:** infotech -**Last synced:** 2026-10-11 17:52 UTC -**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* - -## Active Workstreams - -### Design and prove task-scoped protected OpenBao execution -Progress: 1/3 done | workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819` - -**Open tasks:** -- ! Implement and prove one native metadata action `5f8f7c41` -- ► Define the exact mediated execution contract `b2f0d462` - -### Activate native Claude credential delivery for Glas -Progress: 2/3 done | workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974` - -**Open tasks:** -- ! Activate the approved native lane and verify real owner delivery `f8069c8a` - *(wait: Next owner action: reconcile held parent reservation 6efa9436-6a91-47c0-94e5-b31b5a0e7e3a (EUR 10, observed USD still null) from existing provider records. No corrected runtime digest is admitted; do not retry or replay consumed approvals.)* - -### Adopt concrete OpenBao credential lanes from ops-warden -Progress: 4/6 done | workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82` - -**Open tasks:** -- ! Stage live apply and verification `fb103f1e` - *(wait: OpenRouter key-check native acceptance is recorded in SECRETS-WP-0010-T03. Other lanes still need exact approvals, scoped attended apply and per-lane positive/negative/health/revocation evidence.)* -- ! Reconcile routing ownership and retire interim proxies `1431edae` - *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)* - -### Production-safe provisioning, authorization, and lifecycle hardening -Progress: 6/7 done | workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3` - -**Open tasks:** -- ! Resume native production lane adoption `a0a1dd92` - *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)* - -### Evolve the Lifecycle engine to the accepted security layer model -Progress: 5/6 done | workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0` - -**Open tasks:** -- ! No standing engine credential `d7bc8bdc` - *(wait: Positive service-JWT login proof passed 2026-10-10 (SECRETS-WP-0012-T03, docs/evidence/2026-10-10-keycape-openbao-probe.json). Waits on railiance-platform closing RPF-WP-0035-T02 with the CCR-2026-0038 negative checks, then on routing live engine actions through service-jwt instead of bootstrap/env.)* - -## Inbox Hygiene - -**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 2 unread message(s) lack supersession chains. - ---- -## MCP Orientation (when available) - -If the state-hub MCP server is reachable, call: -`get_domain_summary("infotech")` -This provides richer cross-domain context. -If the MCP call fails, use this file as your orientation source. diff --git a/.generated-work-records.json b/.generated-work-records.json new file mode 100644 index 0000000..1771be6 --- /dev/null +++ b/.generated-work-records.json @@ -0,0 +1 @@ +{"version":1,"repo_slug":"secrets-engine"} diff --git a/.generated-work-records.mk b/.generated-work-records.mk new file mode 100644 index 0000000..b027b14 --- /dev/null +++ b/.generated-work-records.mk @@ -0,0 +1,8 @@ +# Explicit opt-in recipe; no environment files or external make includes. +CUSTODIAN_SOURCE ?= /home/worsch/the-custodian +GENERATED_REPO_SLUG ?= secrets-engine +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" +generated-work-records-check: + python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check diff --git a/.gitignore b/.gitignore index 66e7c65..c6349ba 100644 --- a/.gitignore +++ b/.gitignore @@ -182,3 +182,6 @@ bootstrap/ # repo-manager local index (other estate repos gitignore this too) .repo-manager/ + +# Generated workstation orientation; keep local, regenerate from State Hub. +/.custodian-brief.md diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..6c6086d --- /dev/null +++ b/Makefile @@ -0,0 +1,8 @@ +# Repository maintenance targets + +# CUST-WP-0079-T05: staged-source generation; hook uses the isolated recipe. +.PHONY: generated-work-records generated-work-records-check +generated-work-records: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records +generated-work-records-check: + $(MAKE) --no-print-directory -f .generated-work-records.mk generated-work-records-check diff --git a/SCOPE.md b/SCOPE.md index ea12c09..3cd9d77 100644 --- a/SCOPE.md +++ b/SCOPE.md @@ -405,3 +405,28 @@ description: Reports decision/readiness metadata and records scrubbed local and local evidence, not audit-core and not a secret-use observation API. keywords: [routing, evidence, state-hub, audit, secrets] ``` + + +## Repository maintenance reuse + +The tracked `.generated-work-records.json` adopts the Custodian staged-source +adapter for WORK-RECORDS.md. `make generated-work-records` uses the existing +State Hub renderer through `.generated-work-records.mk`; the shared pre-commit +hook runs this isolated recipe only for opted-in repositories. The corresponding +`make generated-work-records-check` is read-only. Canonical repository identity +is explicit and does not depend on the checkout directory. + +Unstaged source changes are preserved; conflicts and unstaged generated-file +changes stop the commit. For `git commit --only`, generate first and include +WORK-RECORDS.md with the selected source paths. Existing generated-only guards +and exact-scope secret scans remain in place. This is repository maintenance, +not a runtime service, authorization decision, deployment or publication. +Other index generators and hub-derived briefs retain their owner boundaries. + + +## Local orientation brief + +`.custodian-brief.md` is a generated local orientation snapshot. It remains on +disk for offline use and is root-ignored rather than versioned. Regenerate it +with the State Hub brief renderer; workplans and other authored repository +records remain authoritative. Brief refreshes must not create Git commits. diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 70e5831..4b16619 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -22,6 +22,8 @@ | workplan | SECRETS-WP-0011 | finished | — | workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md | | workplan | SECRETS-WP-0012 | finished | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | workplan | SECRETS-WP-0013 | proposed | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | +| workplan | SECRETS-WP-0014 | active | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | +| workplan | SECRETS-WP-0015 | active | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md | | task | SECRETS-WP-ADHOC-2026-08-21-T01 | done | — | workplans/ADHOC-2026-08-21.md | | task | SECRETS-WP-ADHOC-2026-08-23-T01 | done | — | workplans/ADHOC-2026-08-23.md | | task | SECRETS-WP-0001-T01 | done | — | workplans/SECRETS-WP-0001-statehub-bootstrap.md | @@ -83,9 +85,16 @@ | task | SECRETS-WP-0012-T02 | cancel | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | task | SECRETS-WP-0012-T03 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | | task | SECRETS-WP-0012-T04 | done | — | workplans/SECRETS-WP-0012-keycape-openbao-consumer-custody.md | -| task | SECRETS-WP-0013-T01 | progress | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | +| task | SECRETS-WP-0013-T01 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | | task | SECRETS-WP-0013-T02 | done | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | | task | SECRETS-WP-0013-T03 | wait | — | workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | +| task | SECRETS-WP-0014-T01 | done | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | +| task | SECRETS-WP-0014-T02 | progress | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | +| task | SECRETS-WP-0014-T03 | wait | — | workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md | +| task | SECRETS-WP-0015-T01 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md | +| task | SECRETS-WP-0015-T02 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md | +| task | SECRETS-WP-0015-T03 | done | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md | +| task | SECRETS-WP-0015-T04 | wait | — | workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md | | intake | SECRETS-IN-0001 | closed | — | intakes/intakes.md | | intake | SECRETS-IN-0002 | closed | — | intakes/intakes.md | | intake | SECRETS-IN-0003 | closed | — | intakes/intakes.md |