232 commits

Author	SHA1	Message	Date
tegwick	ccb285fc40	Record verified rename recovery and promoted image ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b	2026-09-05 20:20:22 +02:00
repo-manager	5944ea3c20	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b	2026-09-05 18:59:37 +02:00
tegwick	fe6b8d96c2	Recover external repository renames through verified Forgejo redirects ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b	2026-09-05 18:57:15 +02:00
tegwick	022cf4b727	fix: require signature invalidation in live rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 18:30:49 +02:00
tegwick	29428bb304	Close live preflight signing and rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883	2026-09-05 18:11:41 +02:00
repo-manager	74c687c6bc	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 16:39:04 +02:00
tegwick	e96ef197cf	feat: add API-only preflight signing delivery and rotation acceptance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 16:39:02 +02:00
repo-manager	485275d868	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 11:27:23 +02:00
tegwick	ccf691042d	docs: complete retirement inbox parity gate and track reader cutover ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 11:27:21 +02:00
repo-manager	2c60e5bcf7	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 10:25:39 +02:00
tegwick	f04de759a1	docs: advance retirement with SBOM receipts and caller migrations ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 10:24:54 +02:00
repo-manager	74a3b22c05	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 09:40:58 +02:00
tegwick	3578dc2f32	fix: bound repository collection identity projection ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102	2026-09-05 02:03:52 +02:00
tegwick	0b44cf12f5	feat: complete cluster self-sufficiency hardening ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43	2026-09-04 22:23:42 +02:00
tegwick	87047faa8e	docs: rebaseline cluster self-sufficiency workplan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43	2026-09-04 21:40:41 +02:00
repo-manager	bec702d842	repo.work.assign_missing_identifiers ... source: repo-manager reason: deterministic projection registration Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43	2026-09-04 21:16:19 +02:00
tegwick	e663f209f7	fix(register): require explicit topic when ambiguous ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43	2026-09-04 21:16:07 +02:00
tegwick	803bb95e1d	record D2 Fabric dual-read cutover evidence ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 23:22:43 +02:00
tegwick	903a2fb090	record fabric retirement gate readiness ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 22:26:51 +02:00
tegwick	0e35f84ad5	record ops hub retirement gate completion ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 21:36:46 +02:00
tegwick	8f0667d8ff	close rename plan and restate retirement gates ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 20:07:51 +02:00
tegwick	142c94287e	docs: advance remaining state hub workplans ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 12:14:33 +02:00
tegwick	566d21f3bf	deploy: close projection identity reset ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 02:07:31 +02:00
tegwick	a32112e5ab	fix: preserve stale task identity history ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 02:02:35 +02:00
tegwick	ddce470944	fix: bound task identity ambiguity ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 01:57:46 +02:00
tegwick	14e865ab30	chore: converge state-hub live identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 01:37:23 +02:00
tegwick	151fdcf397	feat: converge mixed identifier projections ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-31 01:27:21 +02:00
tegwick	fc8ec49d9e	fix: package quality-debt CLI support ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-30 23:36:23 +02:00
tegwick	c5e15c7d7f	docs: close fast projection rollout ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-30 23:24:15 +02:00
tegwick	8e36b22e26	chore: assign missing ad-hoc task identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-30 22:51:34 +02:00
tegwick	34f5cb3fc3	feat: add fast forge work-record reconciliation ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c	2026-08-30 22:38:54 +02:00
tegwick	41b0b24195	docs: register flex-auth rename adoption plan ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 18:06:54 +02:00
tegwick	f7402bd711	docs: complete repository rename operator handoff ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 15:46:43 +02:00
tegwick	9f0a104b56	feat: prove repository rename continuity ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 15:05:09 +02:00
tegwick	ef0b6df3b8	feat: generate repository rename adoption plans ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 13:08:02 +02:00
tegwick	6b82215ae7	feat: add repository rename orchestration CLI ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 12:00:22 +02:00
tegwick	2e2ae1e5d0	feat: make repository reads alias-aware ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 10:47:51 +02:00
tegwick	82ea38b180	feat: add repository rename lifecycle API ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-29 03:17:37 +02:00
tegwick	8988a093f2	feat: persist repository rename identity ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-28 22:08:21 +02:00
tegwick	0020286bab	docs(STATE-WP-0083-T04): record central fleet refuse-mode run ... 125 repos on main-54b09ee: 52 applied, 69 noop, 2 refused (identifier collisions), 2 unreadable, 0 errors, 0 retirements. Assistant: grok Assistant-Session: 01a04996-76e8-7f53-b971-1885cfbed436	2026-08-28 21:42:05 +02:00
custodian-sync	136256fa3d	chore(consistency): renormalize lifecycle state [auto] ... Updated by fix-consistency on 2026-08-28: - workplan status: ready → active Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-28 21:22:24 +02:00
repo-manager	bb1b8f4c95	chore(registrar): assign State Hub identifiers ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-28 21:04:05 +02:00
tegwick	b08a5d43a0	docs(workplan): plan lineage-preserving repository renames ... Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a049a4-ee9f-78e1-9d66-2cb0f9bea3e3	2026-08-28 21:01:21 +02:00
tegwick	4f68c5609f	fix(workplans): qualify ad-hoc identifiers with the repository prefix ... `ADHOC-YYYY-MM-DD` is unique per date but not per repository, so any two repos opening an ad-hoc on the same day collide. The 2026-08-26 fleet projection reset refused 9 records for exactly this reason. Canon (work-record-types_v0.1, CUST-WP-0066) settled the form as `{PREFIX}-WP-ADHOC-YYYY-MM-DD`, filename unchanged, and grandfathered existing ids on the condition they are never *silently* re-derived. This is the explicit migration that clause allows for. The hub id is derived from the record id, so a changed id is a different record: stale state_hub_*_id fields are dropped and fix-consistency re-derives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-28 00:28:24 +02:00
tegwick	470ece82ed	feat(forge): resolve an optional forge read credential (STATE-WP-0084-T02/T03) ... Nine repositories are invisible to derivation because central may not read them. This adds the consuming half of the credential lane MASON-WP-0003 built. The cluster has no agent injector and no secrets-store CSI driver, so the pod authenticates to OpenBao with a projected ServiceAccount token (audience `openbao`, not the API server) and reads the KV path itself. `forgeRead.*` carries coordinates only; no credential is a chart value, an image layer, or a Kubernetes Secret. The credential reaches git through GIT_CONFIG_* setting http.extraHeader, not through `-c` and not through userinfo in the clone URL — both of those put the token in the process listing. It is redacted from ForgeDeriveError, which is logged, stored in reset outcomes, and returned over the API. Absent stays a supported state: with no credential, or with OpenBao unreachable, resolution returns None and public derivation runs unchanged. Raising would turn "nine repositories are unreadable" into "the pass failed", which is what T01 exists to prevent. Chart default is disabled. 717 pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-27 23:12:57 +02:00
tegwick	929bc29513	chore(workplan): STATE-WP-0084 active — T01 landed ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166	2026-08-26 21:48:04 +02:00
tegwick	85181cd3e4	feat(forge): report unreadable repositories as unreadable (STATE-WP-0084-T01) ... A private repository failed derivation the same way a broken one did, so "cannot read" and "does not exist" were indistinguishable from outside. They authorise opposite things: only the second can justify retiring a record. - ForgeUnreadableError (a ForgeDeriveError, so old callers still catch it) for permission-shaped clone failures, including Forgejo's 404 for an unauthenticated private repo — indistinguishable here, and the safe reading of an ambiguous answer cannot destroy a record. - GIT_TERMINAL_PROMPT=0: an unattended pass must fail, not block on a username prompt. Failing is what makes the case observable. - DerivedProjection.retirement_eligible separates "no records found" from "no records exist". A checkout with no workplans/ directory cannot evidence an absence — the empty-clone path that would have proposed every record in a repository for retirement. - Retirement from an ineligible source is refused even when acknowledged. - Fleet keeps unreadable out of the error bucket. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166	2026-08-26 21:45:03 +02:00
repo-manager	8b38f815e5	chore(registrar): assign State Hub identifiers ... Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166	2026-08-26 21:30:30 +02:00
tegwick	fc814bd094	feat(workplan): open STATE-WP-0084 for private-repository derivation ... Takes the three tasks split out of ops-mason/MASON-WP-0003: mount the forge read credential, teach derive_from_forge() to use it, and re-run the fleet reset over the nine repositories that failed in STATE-WP-0083-T04. T01 (report unreadable as unreadable, never as retirement work) is promoted ahead of the credential work: it does not depend on it, it closes the empty-clone path that nearly retired vergabe-teilnahme, and MASON-WP-0003-T01's breadth recommendation is contingent on it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3377672@bnt-lap001 Assistant-Session: 15463ccf-238f-4e13-b163-93aa25c6d166	2026-08-26 21:25:55 +02:00
tegwick	52da6a17cb	feat(workplan): close STATE-WP-0083-T05 — every hub record derives from a file ... 51 records retired across the fleet; 106 of 121 repositories now noop. Zero repositories hold a record that no longer derives. 26 real workplans were rescued from wrongful retirement — more than half the number retired. vergabe-teilnahme (17) predated the convention entirely; nine further files across five repositories carried no type field, three of them created by this session's own renames. Also records the RPF-WP collision this session introduced by numbering from 0001 without checking whether the target prefix was in use. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 2583210@bnt-lap001 Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006	2026-08-26 21:04:16 +02:00